<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="790">
<package pkgid="025ca519338f6aaaa0d5cf0f4e079f5d5ea8107b539c7853bc5fba2ba7e576e7" name="aaa_base" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="0b01075518f884b372d1f81ea9253bd635cec6b0e0f84e905f2cd2e34b697e18" name="aaa_base" arch="src">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="daaa881123df8f47e6826d9de28473dbb9887076df26a6f68fe008f1542a0a02" name="aaa_base" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.3.1"/>
  <changelog author="ro@suse.de" date="1563451200">- Add patch git-06-8640f848c6677f1149b9765a8c86135956604007.patch
  * Make systemd detection cgroup oblivious (bsc#1140647)
    systemd can work in three exclusive cgroup modes: legacy, hybrid and
    unified. The mode affects where and what cgroup hierarchies are mounted.
    detect running systemd as systemd itself does it
    (src/libsystemd/sd-daemon/sd-daemon.c, function sd_booted)</changelog>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
</package>
<package pkgid="98da512bfba549daa887cb481653f3387f2561a7d6686acbafb3067fb50280c4" name="audit" arch="aarch64">
  <version epoch="0" ver="3.0.6" rel="150400.4.6.1"/>
  <changelog author="tonyj@suse.com" date="1578916800">- Update to version 2.8.5:
  * Fix segfault on shutdown
  * Fix hang on startup (#1587995)
  * Add sleep to script to dump state so file is ready when needed
  * Add auparse_normalizer support for SOFTWARE_UPDATE event
  * Mark netlabel events as simple events so that get processed quicker
  * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
  * Add 30-ospp-v42.rules to meet new Common Criteria requirements
  * Update lookup tables for the 4.18 kernel
  * In aureport, fix segfault in file report
  * Add auparse_normalizer support for labeled networking events
  * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
  * Event aging is off by a second
  * In ausearch/auparse, correct event ordering to process oldest first
  * auparse_reset was not clearing everything it should
  * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
  * In ausearch/report, lightly parse selinux portion of USER_AVC events
  * In ausearch/report, limit record size when malformed
  * In auditd, fix extract_type function for network originating events
  * In auditd, calculate right size and location for network originating events
  * Treat all network originating events as VER2 so dispatcher doesn't format it
  * In audisp-remote do an initial connection attempt (#1625156)
  * In auditd, allow expression of space left as a percentage (#1650670)
  * On PPC64LE systems, only allow 64 bit rules (#1462178)
  * Make some parts of auditd state report optional based on config
  * Fix ausearch when checkpointing a single file (Burn Alting)
  * Fix scripting in 31-privileged.rules wrt filecap (#1662516)
  * In ausearch, do not checkpt if stdin is input source
  * In libev, remove __cold__ attribute for functions to allow proper hardening
  * Add tests to configure.ac for openldap support
  * Make systemd support files use /run rather than /var/run (Christian Hesse)
  * Fix minor memory leak in auditd kerberos credentials code
  * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
  * In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Fix build errors when using gcc-10 no-common default (bsc#1160384)
  New patch: audit-fno-common.patch
- Refresh audit-allow-manual-stop.patch</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="abergmann@suse.com" date="1606910400">- Enable Aarch64 processor support. (bsc#1179515 bsc#1179806)</changelog>
  <changelog author="ematsumiya@suse.com" date="1611835200">- Create new "audit" group for read access to logs (bsc#1178154)
  * add change-default-log_group.patch
  * update audit-secondary.spec</changelog>
  <changelog author="dimstar@opensuse.org" date="1612180800">- Do not explicitly provide group(audit) in system-users-audit:
  this is automatically handled by rpm/providers.</changelog>
  <changelog author="ematsumiya@suse.com" date="1623672000">- Adjust audit.spec and audit-secondary.spec to support new version
- Include fix for libev
  * add libev-werror.patch
- Update to version 3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations
- In auditd, do not allow spaces in the hostname name format
- Big documentation cleanup (MIZUTA Takeshi)
- Update syscall table to the 5.12 kernel
- Update the auparse normalizer for new event types
- Fix compiler warnings in ids subsystem
- Block a couple signals from flush &amp; reconfigure threads
- In auditd, don't wait on flush thread when exiting
- Output error message if the path of input files are too long ausearch/report
  Included fixes from 3.0.1
- Update syscall table to the 5.11 kernel
- Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
- Only enable periodic timers when listening on the network
- Upgrade libev to 4.33
- Add auparse_new_buffer function to auparse library
- Use the select libev backend unless aggregating events
- Add sudoers to some base audit rules
- Update the auparse normalizer for some new syscalls and event types
  Included fixes from 3.0
- Generate checkpoint file even when no results are returned (Burn Alting)
- Fix log file creation when file logging is disabled entirely (Vlad Glagolev)
- Convert auparse_test to run with python3 (Tomá? Chvátal)
- Drop support for prelude
- Adjust backlog_wait_time in rules to the kernel default (#1482848)
- Remove ids key syntax checking of rules in auditctl
- Use SIGCONT to dump auditd internal state (#1504251)
- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903)
- Fix parsing of uid &amp; success for ausearch
- Add support for not equal operator in audit by executable (Ondrej Mosnacek)
- Hide lru symbols in auparse
- Add systemd process protections
- Fix aureport summary time range reporting
- Allow unlimited retries on startup for remote logging
- Add queue_depth to remote logging stats and increase default queue_depth size
- Fix segfault on shutdown
- Merge auditd and audispd code
- Close on execute init_pipe fd (#1587995)
- Breakout audisp syslog plugin to be standalone program
- Create a common internal library to reduce code
- Move all audispd config files under /etc/audit/
- Move audispd.conf settings into auditd.conf
- Add queue depth statistics to internal state dump report
- Add network statistics to internal state dump report
- SIGUSR now also restarts queue processing if its suspended
- Update lookup tables for the 4.18 kernel
- Add auparse_normalizer support for SOFTWARE_UPDATE event
- Add 30-ospp-v42.rules to meet new Common Criteria requirements
- Deprecate enable_krb and replace with transport config opt for remote logging
- Mark netlabel events as simple events so that get processed quicker
- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
- In aureport, fix segfault in file report
- Add auparse_normalizer support for labeled networking events
- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
- In ausearch/auparse, event aging is off by a second
- In ausearch/auparse, correct event ordering to process oldest first
- Migrate auparse python test to python3
- auparse_reset was not clearing everything it should
- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
- In ausearch/report, lightly parse selinux portion of USER_AVC events
- Add bpf syscall command argument interpretation to auparse
- In ausearch/report, limit record size when malformed
- Port af_unix plugin to libev
- In auditd, fix extract_type function for network originating events
- In auditd, calculate right size and location for network originating events
- Make legacy script wait for auditd to terminate (#1643567)
- Treat all network originating events as VER2 so dispatcher doesn't format it
- If an event has a node name make it VER2 so dispatcher doesnt format it
- In audisp-remote do an initial connection attempt (#1625156)
- In auditd, allow expression of space left as a percentage (#1650670)
- On PPC64LE systems, only allow 64 bit rules (#1462178)
- Make some parts of auditd state report optional based on config
- Update to libev-4.25
- Fix ausearch when checkpointing a single file (Burn Alting)
- Fix scripting in 31-privileged.rules wrt filecap (#1662516)
- In ausearch, do not checkpt if stdin is input source
- In libev, remove __cold__ attribute for functions to allow proper hardening
- Add tests to configure.ac for openldap support
- Make systemd support files use /run rather than /var/run (Christian Hesse)
- Fix minor memory leak in auditd kerberos credentials code
- Allow exclude and user filter by executable name (Ondrej Mosnacek)
- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
- In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Add substitue functions for strndupa &amp; rawmemchr
- Fix memleak in auparse caused by corrected event ordering
- Fix legacy reload script to reload audit rules when daemon is reloaded
- Support for unescaping in trusted messages (Dmitry Voronin)
- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
- In aureport, fix segfault for malformed USER_CMD events
- Add exe field to audit_log_user_command in libaudit
- In auditctl support filter on socket address families (Richard Guy Briggs)
- Deprecate support for Alpha &amp; IA64 processors
- If space_left_action is rotate, allow it every time (#1718444)
- In auparse, drop standalone EOE events
- Add milliseconds column for ausearch extra time csv format
- Fix aureport first event reporting when no start given
- In audisp-remote, add new config item for startup connection errors
- Remove dependency on chkconfig
- Install rules to /usr/share/audit/sample-rules/
- Split up ospp rules to make SCAP scanning easier (#1746018)
- In audisp-syslog, support interpreting records (#1497279)
- Audit USER events now sends msg as name value pair
- Add support for AUDIT_BPF event
- Auditd should not process AUDIT_REPLACE events
- Update syscall tables to the 5.5 kernel
- Improve personality interpretation by using PERS_MASK
- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup
- Change auparse python bindings to shared object (Issue #121)
- Add error messages for watch permissions
- If audit rules file doesn't exist log error message instead of info message
- Revise error message for unmatched options in auditctl
- In audisp-remote, fixup remote endpoint disappearin in ascii format
- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander)
- In auditctl, add support for sending a signal to auditd
- Removes audit-fno-common.patch: fixed in upstream
- Removes audit-python3.patch: fixed in upstream</changelog>
  <changelog author="ematsumiya@suse.com" date="1627646400">- Update to version 3.0.3:
  * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined
  * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids
  * Change auparse_feed_has_data in auparse to include incomplete events
  * Auditd, stop linking against -lrt
  * Add ProtectHome and RestrictRealtime to auditd.service
  * In auditd, read up to 3 netlink packets in a row
  * In auditd, do not validate path to plugin unless active
  * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists
- use https source urls</changelog>
  <changelog author="meissner@suse.com" date="1629115200">- harden_auditd.service.patch: automatic hardening applied to systemd
  services</changelog>
  <changelog author="ematsumiya@suse.com" date="1631793600">- Change default log_format from ENRICHED to RAW (bsc#1190500):
  * add change-default-log_format.patch (SUSE-specific patch)
- Update to version 3.0.5:
  * In auditd, flush uid/gid caches when user/group added/deleted/modified
  * Fixed various issues when dealing with corrupted logs
  * In auditd, check if log_file is valid before closing handle
- Include fixed from 3.0.4:
  * Apply performance speedups to auparse library
  * Optimize rule loading in auditctl
  * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath
  * Update syscall table to the 5.14 kernel
  * Fixed various issues when dealing with corrupted logs</changelog>
  <changelog author="ematsumiya@suse.com" date="1632139200">- Fix hardened auditd.service (bsc#1181400)
  * add fix-hardened-service.patch
    Make /etc/audit read-write from the service.
    Remove PrivateDevices=true to expose /dev/* to auditd.service.
- Enable stop rules for audit.service (cf. bsc#1190227)
  * add enable-stop-rules.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1634126400">- Create separate service for augenrules (bsc#1191614, bsc#1181400)
  * add create-augenrules-service.patch
  Remove ReadWritePaths=/etc/audit from auditd.service, also removes
  augenrules call from ExecStartPost.
  Create augenrules.service with the ReadWritePaths directive above.
  This makes /etc/audit only accessible by augenrules.service and
  let auditd.service (and daemon) to be sandboxed again.
- Update audit-secondary.spec to accomodate the new service file.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634299200">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636286400">- Update to version 3.0.6:
  * fixes a segfault on some SELINUX_ERR records
  * makes IPX packet interpretation dependent on the ipx header
    file existing
  * adds b32/b64 support to ausyscall
  * adds support for armv8l
  * fixes auditctl list of syscalls on PPC
  * auditd.service now restarts auditd under some conditions</changelog>
  <changelog author="fvogt@suse.com" date="1638187200">- Use %autosetup
- Don't include sample rules as %doc, they're already installed
  as normal files
- Fix create-augenrules-service.patch:
  * auditd.service needs to require augenrules.service,
    not the other way around
- Fix documentation for enable-stop-rules.patch</changelog>
  <changelog author="dmueller@suse.com" date="1648036800">- add audit-userspace-517-compat.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1648209600">- Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645)
  * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
- Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517)
  * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Fix buildrequire for openldap2-devel - audit doesn't require the
  (outdated) C++ binding, but the C headers that happen to be pulled
  in by buildrequiring the C++ devel package</changelog>
  <changelog author="jengelh@inai.de" date="1649678400">- Drop buildrequire on C++ compiler.
- Modernize specfile constructs.</changelog>
  <changelog author="ali.abdallah@suse.com" date="1659441600">- Update audit-secondary.spec: create symbolic link from
  /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519).</changelog>
  <changelog author="lidong.zhong@suse.com" date="1667304000">- Fix rules not loaded when restarting auditd.service(bsc#1204844)</changelog>
</package>
<package pkgid="8687efc2f05093d59ab120cf86ecdfcfc218bb5ca4f86b5e5766e7ac1544ac3c" name="audit" arch="x86_64">
  <version epoch="0" ver="3.0.6" rel="150400.4.6.1"/>
  <changelog author="tonyj@suse.com" date="1578916800">- Update to version 2.8.5:
  * Fix segfault on shutdown
  * Fix hang on startup (#1587995)
  * Add sleep to script to dump state so file is ready when needed
  * Add auparse_normalizer support for SOFTWARE_UPDATE event
  * Mark netlabel events as simple events so that get processed quicker
  * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
  * Add 30-ospp-v42.rules to meet new Common Criteria requirements
  * Update lookup tables for the 4.18 kernel
  * In aureport, fix segfault in file report
  * Add auparse_normalizer support for labeled networking events
  * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
  * Event aging is off by a second
  * In ausearch/auparse, correct event ordering to process oldest first
  * auparse_reset was not clearing everything it should
  * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
  * In ausearch/report, lightly parse selinux portion of USER_AVC events
  * In ausearch/report, limit record size when malformed
  * In auditd, fix extract_type function for network originating events
  * In auditd, calculate right size and location for network originating events
  * Treat all network originating events as VER2 so dispatcher doesn't format it
  * In audisp-remote do an initial connection attempt (#1625156)
  * In auditd, allow expression of space left as a percentage (#1650670)
  * On PPC64LE systems, only allow 64 bit rules (#1462178)
  * Make some parts of auditd state report optional based on config
  * Fix ausearch when checkpointing a single file (Burn Alting)
  * Fix scripting in 31-privileged.rules wrt filecap (#1662516)
  * In ausearch, do not checkpt if stdin is input source
  * In libev, remove __cold__ attribute for functions to allow proper hardening
  * Add tests to configure.ac for openldap support
  * Make systemd support files use /run rather than /var/run (Christian Hesse)
  * Fix minor memory leak in auditd kerberos credentials code
  * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
  * In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Fix build errors when using gcc-10 no-common default (bsc#1160384)
  New patch: audit-fno-common.patch
- Refresh audit-allow-manual-stop.patch</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="abergmann@suse.com" date="1606910400">- Enable Aarch64 processor support. (bsc#1179515 bsc#1179806)</changelog>
  <changelog author="ematsumiya@suse.com" date="1611835200">- Create new "audit" group for read access to logs (bsc#1178154)
  * add change-default-log_group.patch
  * update audit-secondary.spec</changelog>
  <changelog author="dimstar@opensuse.org" date="1612180800">- Do not explicitly provide group(audit) in system-users-audit:
  this is automatically handled by rpm/providers.</changelog>
  <changelog author="ematsumiya@suse.com" date="1623672000">- Adjust audit.spec and audit-secondary.spec to support new version
- Include fix for libev
  * add libev-werror.patch
- Update to version 3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations
- In auditd, do not allow spaces in the hostname name format
- Big documentation cleanup (MIZUTA Takeshi)
- Update syscall table to the 5.12 kernel
- Update the auparse normalizer for new event types
- Fix compiler warnings in ids subsystem
- Block a couple signals from flush &amp; reconfigure threads
- In auditd, don't wait on flush thread when exiting
- Output error message if the path of input files are too long ausearch/report
  Included fixes from 3.0.1
- Update syscall table to the 5.11 kernel
- Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
- Only enable periodic timers when listening on the network
- Upgrade libev to 4.33
- Add auparse_new_buffer function to auparse library
- Use the select libev backend unless aggregating events
- Add sudoers to some base audit rules
- Update the auparse normalizer for some new syscalls and event types
  Included fixes from 3.0
- Generate checkpoint file even when no results are returned (Burn Alting)
- Fix log file creation when file logging is disabled entirely (Vlad Glagolev)
- Convert auparse_test to run with python3 (Tomá? Chvátal)
- Drop support for prelude
- Adjust backlog_wait_time in rules to the kernel default (#1482848)
- Remove ids key syntax checking of rules in auditctl
- Use SIGCONT to dump auditd internal state (#1504251)
- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903)
- Fix parsing of uid &amp; success for ausearch
- Add support for not equal operator in audit by executable (Ondrej Mosnacek)
- Hide lru symbols in auparse
- Add systemd process protections
- Fix aureport summary time range reporting
- Allow unlimited retries on startup for remote logging
- Add queue_depth to remote logging stats and increase default queue_depth size
- Fix segfault on shutdown
- Merge auditd and audispd code
- Close on execute init_pipe fd (#1587995)
- Breakout audisp syslog plugin to be standalone program
- Create a common internal library to reduce code
- Move all audispd config files under /etc/audit/
- Move audispd.conf settings into auditd.conf
- Add queue depth statistics to internal state dump report
- Add network statistics to internal state dump report
- SIGUSR now also restarts queue processing if its suspended
- Update lookup tables for the 4.18 kernel
- Add auparse_normalizer support for SOFTWARE_UPDATE event
- Add 30-ospp-v42.rules to meet new Common Criteria requirements
- Deprecate enable_krb and replace with transport config opt for remote logging
- Mark netlabel events as simple events so that get processed quicker
- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
- In aureport, fix segfault in file report
- Add auparse_normalizer support for labeled networking events
- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
- In ausearch/auparse, event aging is off by a second
- In ausearch/auparse, correct event ordering to process oldest first
- Migrate auparse python test to python3
- auparse_reset was not clearing everything it should
- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
- In ausearch/report, lightly parse selinux portion of USER_AVC events
- Add bpf syscall command argument interpretation to auparse
- In ausearch/report, limit record size when malformed
- Port af_unix plugin to libev
- In auditd, fix extract_type function for network originating events
- In auditd, calculate right size and location for network originating events
- Make legacy script wait for auditd to terminate (#1643567)
- Treat all network originating events as VER2 so dispatcher doesn't format it
- If an event has a node name make it VER2 so dispatcher doesnt format it
- In audisp-remote do an initial connection attempt (#1625156)
- In auditd, allow expression of space left as a percentage (#1650670)
- On PPC64LE systems, only allow 64 bit rules (#1462178)
- Make some parts of auditd state report optional based on config
- Update to libev-4.25
- Fix ausearch when checkpointing a single file (Burn Alting)
- Fix scripting in 31-privileged.rules wrt filecap (#1662516)
- In ausearch, do not checkpt if stdin is input source
- In libev, remove __cold__ attribute for functions to allow proper hardening
- Add tests to configure.ac for openldap support
- Make systemd support files use /run rather than /var/run (Christian Hesse)
- Fix minor memory leak in auditd kerberos credentials code
- Allow exclude and user filter by executable name (Ondrej Mosnacek)
- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
- In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Add substitue functions for strndupa &amp; rawmemchr
- Fix memleak in auparse caused by corrected event ordering
- Fix legacy reload script to reload audit rules when daemon is reloaded
- Support for unescaping in trusted messages (Dmitry Voronin)
- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
- In aureport, fix segfault for malformed USER_CMD events
- Add exe field to audit_log_user_command in libaudit
- In auditctl support filter on socket address families (Richard Guy Briggs)
- Deprecate support for Alpha &amp; IA64 processors
- If space_left_action is rotate, allow it every time (#1718444)
- In auparse, drop standalone EOE events
- Add milliseconds column for ausearch extra time csv format
- Fix aureport first event reporting when no start given
- In audisp-remote, add new config item for startup connection errors
- Remove dependency on chkconfig
- Install rules to /usr/share/audit/sample-rules/
- Split up ospp rules to make SCAP scanning easier (#1746018)
- In audisp-syslog, support interpreting records (#1497279)
- Audit USER events now sends msg as name value pair
- Add support for AUDIT_BPF event
- Auditd should not process AUDIT_REPLACE events
- Update syscall tables to the 5.5 kernel
- Improve personality interpretation by using PERS_MASK
- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup
- Change auparse python bindings to shared object (Issue #121)
- Add error messages for watch permissions
- If audit rules file doesn't exist log error message instead of info message
- Revise error message for unmatched options in auditctl
- In audisp-remote, fixup remote endpoint disappearin in ascii format
- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander)
- In auditctl, add support for sending a signal to auditd
- Removes audit-fno-common.patch: fixed in upstream
- Removes audit-python3.patch: fixed in upstream</changelog>
  <changelog author="ematsumiya@suse.com" date="1627646400">- Update to version 3.0.3:
  * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined
  * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids
  * Change auparse_feed_has_data in auparse to include incomplete events
  * Auditd, stop linking against -lrt
  * Add ProtectHome and RestrictRealtime to auditd.service
  * In auditd, read up to 3 netlink packets in a row
  * In auditd, do not validate path to plugin unless active
  * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists
- use https source urls</changelog>
  <changelog author="meissner@suse.com" date="1629115200">- harden_auditd.service.patch: automatic hardening applied to systemd
  services</changelog>
  <changelog author="ematsumiya@suse.com" date="1631793600">- Change default log_format from ENRICHED to RAW (bsc#1190500):
  * add change-default-log_format.patch (SUSE-specific patch)
- Update to version 3.0.5:
  * In auditd, flush uid/gid caches when user/group added/deleted/modified
  * Fixed various issues when dealing with corrupted logs
  * In auditd, check if log_file is valid before closing handle
- Include fixed from 3.0.4:
  * Apply performance speedups to auparse library
  * Optimize rule loading in auditctl
  * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath
  * Update syscall table to the 5.14 kernel
  * Fixed various issues when dealing with corrupted logs</changelog>
  <changelog author="ematsumiya@suse.com" date="1632139200">- Fix hardened auditd.service (bsc#1181400)
  * add fix-hardened-service.patch
    Make /etc/audit read-write from the service.
    Remove PrivateDevices=true to expose /dev/* to auditd.service.
- Enable stop rules for audit.service (cf. bsc#1190227)
  * add enable-stop-rules.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1634126400">- Create separate service for augenrules (bsc#1191614, bsc#1181400)
  * add create-augenrules-service.patch
  Remove ReadWritePaths=/etc/audit from auditd.service, also removes
  augenrules call from ExecStartPost.
  Create augenrules.service with the ReadWritePaths directive above.
  This makes /etc/audit only accessible by augenrules.service and
  let auditd.service (and daemon) to be sandboxed again.
- Update audit-secondary.spec to accomodate the new service file.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634299200">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636286400">- Update to version 3.0.6:
  * fixes a segfault on some SELINUX_ERR records
  * makes IPX packet interpretation dependent on the ipx header
    file existing
  * adds b32/b64 support to ausyscall
  * adds support for armv8l
  * fixes auditctl list of syscalls on PPC
  * auditd.service now restarts auditd under some conditions</changelog>
  <changelog author="fvogt@suse.com" date="1638187200">- Use %autosetup
- Don't include sample rules as %doc, they're already installed
  as normal files
- Fix create-augenrules-service.patch:
  * auditd.service needs to require augenrules.service,
    not the other way around
- Fix documentation for enable-stop-rules.patch</changelog>
  <changelog author="dmueller@suse.com" date="1648036800">- add audit-userspace-517-compat.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1648209600">- Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645)
  * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
- Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517)
  * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Fix buildrequire for openldap2-devel - audit doesn't require the
  (outdated) C++ binding, but the C headers that happen to be pulled
  in by buildrequiring the C++ devel package</changelog>
  <changelog author="jengelh@inai.de" date="1649678400">- Drop buildrequire on C++ compiler.
- Modernize specfile constructs.</changelog>
  <changelog author="ali.abdallah@suse.com" date="1659441600">- Update audit-secondary.spec: create symbolic link from
  /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519).</changelog>
  <changelog author="lidong.zhong@suse.com" date="1667304000">- Fix rules not loaded when restarting auditd.service(bsc#1204844)</changelog>
</package>
<package pkgid="f98d25588e41ac90f477edd4f5b46c77fb59508f7d998124f780eee44c113571" name="audit-audispd-plugins" arch="aarch64">
  <version epoch="0" ver="3.0.6" rel="150400.4.6.1"/>
  <changelog author="tonyj@suse.com" date="1578916800">- Update to version 2.8.5:
  * Fix segfault on shutdown
  * Fix hang on startup (#1587995)
  * Add sleep to script to dump state so file is ready when needed
  * Add auparse_normalizer support for SOFTWARE_UPDATE event
  * Mark netlabel events as simple events so that get processed quicker
  * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
  * Add 30-ospp-v42.rules to meet new Common Criteria requirements
  * Update lookup tables for the 4.18 kernel
  * In aureport, fix segfault in file report
  * Add auparse_normalizer support for labeled networking events
  * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
  * Event aging is off by a second
  * In ausearch/auparse, correct event ordering to process oldest first
  * auparse_reset was not clearing everything it should
  * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
  * In ausearch/report, lightly parse selinux portion of USER_AVC events
  * In ausearch/report, limit record size when malformed
  * In auditd, fix extract_type function for network originating events
  * In auditd, calculate right size and location for network originating events
  * Treat all network originating events as VER2 so dispatcher doesn't format it
  * In audisp-remote do an initial connection attempt (#1625156)
  * In auditd, allow expression of space left as a percentage (#1650670)
  * On PPC64LE systems, only allow 64 bit rules (#1462178)
  * Make some parts of auditd state report optional based on config
  * Fix ausearch when checkpointing a single file (Burn Alting)
  * Fix scripting in 31-privileged.rules wrt filecap (#1662516)
  * In ausearch, do not checkpt if stdin is input source
  * In libev, remove __cold__ attribute for functions to allow proper hardening
  * Add tests to configure.ac for openldap support
  * Make systemd support files use /run rather than /var/run (Christian Hesse)
  * Fix minor memory leak in auditd kerberos credentials code
  * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
  * In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Fix build errors when using gcc-10 no-common default (bsc#1160384)
  New patch: audit-fno-common.patch
- Refresh audit-allow-manual-stop.patch</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="abergmann@suse.com" date="1606910400">- Enable Aarch64 processor support. (bsc#1179515 bsc#1179806)</changelog>
  <changelog author="ematsumiya@suse.com" date="1611835200">- Create new "audit" group for read access to logs (bsc#1178154)
  * add change-default-log_group.patch
  * update audit-secondary.spec</changelog>
  <changelog author="dimstar@opensuse.org" date="1612180800">- Do not explicitly provide group(audit) in system-users-audit:
  this is automatically handled by rpm/providers.</changelog>
  <changelog author="ematsumiya@suse.com" date="1623672000">- Adjust audit.spec and audit-secondary.spec to support new version
- Include fix for libev
  * add libev-werror.patch
- Update to version 3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations
- In auditd, do not allow spaces in the hostname name format
- Big documentation cleanup (MIZUTA Takeshi)
- Update syscall table to the 5.12 kernel
- Update the auparse normalizer for new event types
- Fix compiler warnings in ids subsystem
- Block a couple signals from flush &amp; reconfigure threads
- In auditd, don't wait on flush thread when exiting
- Output error message if the path of input files are too long ausearch/report
  Included fixes from 3.0.1
- Update syscall table to the 5.11 kernel
- Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
- Only enable periodic timers when listening on the network
- Upgrade libev to 4.33
- Add auparse_new_buffer function to auparse library
- Use the select libev backend unless aggregating events
- Add sudoers to some base audit rules
- Update the auparse normalizer for some new syscalls and event types
  Included fixes from 3.0
- Generate checkpoint file even when no results are returned (Burn Alting)
- Fix log file creation when file logging is disabled entirely (Vlad Glagolev)
- Convert auparse_test to run with python3 (Tomá? Chvátal)
- Drop support for prelude
- Adjust backlog_wait_time in rules to the kernel default (#1482848)
- Remove ids key syntax checking of rules in auditctl
- Use SIGCONT to dump auditd internal state (#1504251)
- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903)
- Fix parsing of uid &amp; success for ausearch
- Add support for not equal operator in audit by executable (Ondrej Mosnacek)
- Hide lru symbols in auparse
- Add systemd process protections
- Fix aureport summary time range reporting
- Allow unlimited retries on startup for remote logging
- Add queue_depth to remote logging stats and increase default queue_depth size
- Fix segfault on shutdown
- Merge auditd and audispd code
- Close on execute init_pipe fd (#1587995)
- Breakout audisp syslog plugin to be standalone program
- Create a common internal library to reduce code
- Move all audispd config files under /etc/audit/
- Move audispd.conf settings into auditd.conf
- Add queue depth statistics to internal state dump report
- Add network statistics to internal state dump report
- SIGUSR now also restarts queue processing if its suspended
- Update lookup tables for the 4.18 kernel
- Add auparse_normalizer support for SOFTWARE_UPDATE event
- Add 30-ospp-v42.rules to meet new Common Criteria requirements
- Deprecate enable_krb and replace with transport config opt for remote logging
- Mark netlabel events as simple events so that get processed quicker
- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
- In aureport, fix segfault in file report
- Add auparse_normalizer support for labeled networking events
- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
- In ausearch/auparse, event aging is off by a second
- In ausearch/auparse, correct event ordering to process oldest first
- Migrate auparse python test to python3
- auparse_reset was not clearing everything it should
- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
- In ausearch/report, lightly parse selinux portion of USER_AVC events
- Add bpf syscall command argument interpretation to auparse
- In ausearch/report, limit record size when malformed
- Port af_unix plugin to libev
- In auditd, fix extract_type function for network originating events
- In auditd, calculate right size and location for network originating events
- Make legacy script wait for auditd to terminate (#1643567)
- Treat all network originating events as VER2 so dispatcher doesn't format it
- If an event has a node name make it VER2 so dispatcher doesnt format it
- In audisp-remote do an initial connection attempt (#1625156)
- In auditd, allow expression of space left as a percentage (#1650670)
- On PPC64LE systems, only allow 64 bit rules (#1462178)
- Make some parts of auditd state report optional based on config
- Update to libev-4.25
- Fix ausearch when checkpointing a single file (Burn Alting)
- Fix scripting in 31-privileged.rules wrt filecap (#1662516)
- In ausearch, do not checkpt if stdin is input source
- In libev, remove __cold__ attribute for functions to allow proper hardening
- Add tests to configure.ac for openldap support
- Make systemd support files use /run rather than /var/run (Christian Hesse)
- Fix minor memory leak in auditd kerberos credentials code
- Allow exclude and user filter by executable name (Ondrej Mosnacek)
- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
- In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Add substitue functions for strndupa &amp; rawmemchr
- Fix memleak in auparse caused by corrected event ordering
- Fix legacy reload script to reload audit rules when daemon is reloaded
- Support for unescaping in trusted messages (Dmitry Voronin)
- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
- In aureport, fix segfault for malformed USER_CMD events
- Add exe field to audit_log_user_command in libaudit
- In auditctl support filter on socket address families (Richard Guy Briggs)
- Deprecate support for Alpha &amp; IA64 processors
- If space_left_action is rotate, allow it every time (#1718444)
- In auparse, drop standalone EOE events
- Add milliseconds column for ausearch extra time csv format
- Fix aureport first event reporting when no start given
- In audisp-remote, add new config item for startup connection errors
- Remove dependency on chkconfig
- Install rules to /usr/share/audit/sample-rules/
- Split up ospp rules to make SCAP scanning easier (#1746018)
- In audisp-syslog, support interpreting records (#1497279)
- Audit USER events now sends msg as name value pair
- Add support for AUDIT_BPF event
- Auditd should not process AUDIT_REPLACE events
- Update syscall tables to the 5.5 kernel
- Improve personality interpretation by using PERS_MASK
- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup
- Change auparse python bindings to shared object (Issue #121)
- Add error messages for watch permissions
- If audit rules file doesn't exist log error message instead of info message
- Revise error message for unmatched options in auditctl
- In audisp-remote, fixup remote endpoint disappearin in ascii format
- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander)
- In auditctl, add support for sending a signal to auditd
- Removes audit-fno-common.patch: fixed in upstream
- Removes audit-python3.patch: fixed in upstream</changelog>
  <changelog author="ematsumiya@suse.com" date="1627646400">- Update to version 3.0.3:
  * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined
  * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids
  * Change auparse_feed_has_data in auparse to include incomplete events
  * Auditd, stop linking against -lrt
  * Add ProtectHome and RestrictRealtime to auditd.service
  * In auditd, read up to 3 netlink packets in a row
  * In auditd, do not validate path to plugin unless active
  * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists
- use https source urls</changelog>
  <changelog author="meissner@suse.com" date="1629115200">- harden_auditd.service.patch: automatic hardening applied to systemd
  services</changelog>
  <changelog author="ematsumiya@suse.com" date="1631793600">- Change default log_format from ENRICHED to RAW (bsc#1190500):
  * add change-default-log_format.patch (SUSE-specific patch)
- Update to version 3.0.5:
  * In auditd, flush uid/gid caches when user/group added/deleted/modified
  * Fixed various issues when dealing with corrupted logs
  * In auditd, check if log_file is valid before closing handle
- Include fixed from 3.0.4:
  * Apply performance speedups to auparse library
  * Optimize rule loading in auditctl
  * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath
  * Update syscall table to the 5.14 kernel
  * Fixed various issues when dealing with corrupted logs</changelog>
  <changelog author="ematsumiya@suse.com" date="1632139200">- Fix hardened auditd.service (bsc#1181400)
  * add fix-hardened-service.patch
    Make /etc/audit read-write from the service.
    Remove PrivateDevices=true to expose /dev/* to auditd.service.
- Enable stop rules for audit.service (cf. bsc#1190227)
  * add enable-stop-rules.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1634126400">- Create separate service for augenrules (bsc#1191614, bsc#1181400)
  * add create-augenrules-service.patch
  Remove ReadWritePaths=/etc/audit from auditd.service, also removes
  augenrules call from ExecStartPost.
  Create augenrules.service with the ReadWritePaths directive above.
  This makes /etc/audit only accessible by augenrules.service and
  let auditd.service (and daemon) to be sandboxed again.
- Update audit-secondary.spec to accomodate the new service file.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634299200">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636286400">- Update to version 3.0.6:
  * fixes a segfault on some SELINUX_ERR records
  * makes IPX packet interpretation dependent on the ipx header
    file existing
  * adds b32/b64 support to ausyscall
  * adds support for armv8l
  * fixes auditctl list of syscalls on PPC
  * auditd.service now restarts auditd under some conditions</changelog>
  <changelog author="fvogt@suse.com" date="1638187200">- Use %autosetup
- Don't include sample rules as %doc, they're already installed
  as normal files
- Fix create-augenrules-service.patch:
  * auditd.service needs to require augenrules.service,
    not the other way around
- Fix documentation for enable-stop-rules.patch</changelog>
  <changelog author="dmueller@suse.com" date="1648036800">- add audit-userspace-517-compat.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1648209600">- Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645)
  * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
- Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517)
  * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Fix buildrequire for openldap2-devel - audit doesn't require the
  (outdated) C++ binding, but the C headers that happen to be pulled
  in by buildrequiring the C++ devel package</changelog>
  <changelog author="jengelh@inai.de" date="1649678400">- Drop buildrequire on C++ compiler.
- Modernize specfile constructs.</changelog>
  <changelog author="ali.abdallah@suse.com" date="1659441600">- Update audit-secondary.spec: create symbolic link from
  /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519).</changelog>
  <changelog author="lidong.zhong@suse.com" date="1667304000">- Fix rules not loaded when restarting auditd.service(bsc#1204844)</changelog>
</package>
<package pkgid="25d344a883e1c965b412aba01485c6d0ea83d10bf13f183795d108902fd80651" name="audit-audispd-plugins" arch="x86_64">
  <version epoch="0" ver="3.0.6" rel="150400.4.6.1"/>
  <changelog author="tonyj@suse.com" date="1578916800">- Update to version 2.8.5:
  * Fix segfault on shutdown
  * Fix hang on startup (#1587995)
  * Add sleep to script to dump state so file is ready when needed
  * Add auparse_normalizer support for SOFTWARE_UPDATE event
  * Mark netlabel events as simple events so that get processed quicker
  * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
  * Add 30-ospp-v42.rules to meet new Common Criteria requirements
  * Update lookup tables for the 4.18 kernel
  * In aureport, fix segfault in file report
  * Add auparse_normalizer support for labeled networking events
  * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
  * Event aging is off by a second
  * In ausearch/auparse, correct event ordering to process oldest first
  * auparse_reset was not clearing everything it should
  * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
  * In ausearch/report, lightly parse selinux portion of USER_AVC events
  * In ausearch/report, limit record size when malformed
  * In auditd, fix extract_type function for network originating events
  * In auditd, calculate right size and location for network originating events
  * Treat all network originating events as VER2 so dispatcher doesn't format it
  * In audisp-remote do an initial connection attempt (#1625156)
  * In auditd, allow expression of space left as a percentage (#1650670)
  * On PPC64LE systems, only allow 64 bit rules (#1462178)
  * Make some parts of auditd state report optional based on config
  * Fix ausearch when checkpointing a single file (Burn Alting)
  * Fix scripting in 31-privileged.rules wrt filecap (#1662516)
  * In ausearch, do not checkpt if stdin is input source
  * In libev, remove __cold__ attribute for functions to allow proper hardening
  * Add tests to configure.ac for openldap support
  * Make systemd support files use /run rather than /var/run (Christian Hesse)
  * Fix minor memory leak in auditd kerberos credentials code
  * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
  * In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Fix build errors when using gcc-10 no-common default (bsc#1160384)
  New patch: audit-fno-common.patch
- Refresh audit-allow-manual-stop.patch</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="abergmann@suse.com" date="1606910400">- Enable Aarch64 processor support. (bsc#1179515 bsc#1179806)</changelog>
  <changelog author="ematsumiya@suse.com" date="1611835200">- Create new "audit" group for read access to logs (bsc#1178154)
  * add change-default-log_group.patch
  * update audit-secondary.spec</changelog>
  <changelog author="dimstar@opensuse.org" date="1612180800">- Do not explicitly provide group(audit) in system-users-audit:
  this is automatically handled by rpm/providers.</changelog>
  <changelog author="ematsumiya@suse.com" date="1623672000">- Adjust audit.spec and audit-secondary.spec to support new version
- Include fix for libev
  * add libev-werror.patch
- Update to version 3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations
- In auditd, do not allow spaces in the hostname name format
- Big documentation cleanup (MIZUTA Takeshi)
- Update syscall table to the 5.12 kernel
- Update the auparse normalizer for new event types
- Fix compiler warnings in ids subsystem
- Block a couple signals from flush &amp; reconfigure threads
- In auditd, don't wait on flush thread when exiting
- Output error message if the path of input files are too long ausearch/report
  Included fixes from 3.0.1
- Update syscall table to the 5.11 kernel
- Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
- Only enable periodic timers when listening on the network
- Upgrade libev to 4.33
- Add auparse_new_buffer function to auparse library
- Use the select libev backend unless aggregating events
- Add sudoers to some base audit rules
- Update the auparse normalizer for some new syscalls and event types
  Included fixes from 3.0
- Generate checkpoint file even when no results are returned (Burn Alting)
- Fix log file creation when file logging is disabled entirely (Vlad Glagolev)
- Convert auparse_test to run with python3 (Tomá? Chvátal)
- Drop support for prelude
- Adjust backlog_wait_time in rules to the kernel default (#1482848)
- Remove ids key syntax checking of rules in auditctl
- Use SIGCONT to dump auditd internal state (#1504251)
- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903)
- Fix parsing of uid &amp; success for ausearch
- Add support for not equal operator in audit by executable (Ondrej Mosnacek)
- Hide lru symbols in auparse
- Add systemd process protections
- Fix aureport summary time range reporting
- Allow unlimited retries on startup for remote logging
- Add queue_depth to remote logging stats and increase default queue_depth size
- Fix segfault on shutdown
- Merge auditd and audispd code
- Close on execute init_pipe fd (#1587995)
- Breakout audisp syslog plugin to be standalone program
- Create a common internal library to reduce code
- Move all audispd config files under /etc/audit/
- Move audispd.conf settings into auditd.conf
- Add queue depth statistics to internal state dump report
- Add network statistics to internal state dump report
- SIGUSR now also restarts queue processing if its suspended
- Update lookup tables for the 4.18 kernel
- Add auparse_normalizer support for SOFTWARE_UPDATE event
- Add 30-ospp-v42.rules to meet new Common Criteria requirements
- Deprecate enable_krb and replace with transport config opt for remote logging
- Mark netlabel events as simple events so that get processed quicker
- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
- In aureport, fix segfault in file report
- Add auparse_normalizer support for labeled networking events
- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
- In ausearch/auparse, event aging is off by a second
- In ausearch/auparse, correct event ordering to process oldest first
- Migrate auparse python test to python3
- auparse_reset was not clearing everything it should
- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
- In ausearch/report, lightly parse selinux portion of USER_AVC events
- Add bpf syscall command argument interpretation to auparse
- In ausearch/report, limit record size when malformed
- Port af_unix plugin to libev
- In auditd, fix extract_type function for network originating events
- In auditd, calculate right size and location for network originating events
- Make legacy script wait for auditd to terminate (#1643567)
- Treat all network originating events as VER2 so dispatcher doesn't format it
- If an event has a node name make it VER2 so dispatcher doesnt format it
- In audisp-remote do an initial connection attempt (#1625156)
- In auditd, allow expression of space left as a percentage (#1650670)
- On PPC64LE systems, only allow 64 bit rules (#1462178)
- Make some parts of auditd state report optional based on config
- Update to libev-4.25
- Fix ausearch when checkpointing a single file (Burn Alting)
- Fix scripting in 31-privileged.rules wrt filecap (#1662516)
- In ausearch, do not checkpt if stdin is input source
- In libev, remove __cold__ attribute for functions to allow proper hardening
- Add tests to configure.ac for openldap support
- Make systemd support files use /run rather than /var/run (Christian Hesse)
- Fix minor memory leak in auditd kerberos credentials code
- Allow exclude and user filter by executable name (Ondrej Mosnacek)
- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
- In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Add substitue functions for strndupa &amp; rawmemchr
- Fix memleak in auparse caused by corrected event ordering
- Fix legacy reload script to reload audit rules when daemon is reloaded
- Support for unescaping in trusted messages (Dmitry Voronin)
- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
- In aureport, fix segfault for malformed USER_CMD events
- Add exe field to audit_log_user_command in libaudit
- In auditctl support filter on socket address families (Richard Guy Briggs)
- Deprecate support for Alpha &amp; IA64 processors
- If space_left_action is rotate, allow it every time (#1718444)
- In auparse, drop standalone EOE events
- Add milliseconds column for ausearch extra time csv format
- Fix aureport first event reporting when no start given
- In audisp-remote, add new config item for startup connection errors
- Remove dependency on chkconfig
- Install rules to /usr/share/audit/sample-rules/
- Split up ospp rules to make SCAP scanning easier (#1746018)
- In audisp-syslog, support interpreting records (#1497279)
- Audit USER events now sends msg as name value pair
- Add support for AUDIT_BPF event
- Auditd should not process AUDIT_REPLACE events
- Update syscall tables to the 5.5 kernel
- Improve personality interpretation by using PERS_MASK
- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup
- Change auparse python bindings to shared object (Issue #121)
- Add error messages for watch permissions
- If audit rules file doesn't exist log error message instead of info message
- Revise error message for unmatched options in auditctl
- In audisp-remote, fixup remote endpoint disappearin in ascii format
- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander)
- In auditctl, add support for sending a signal to auditd
- Removes audit-fno-common.patch: fixed in upstream
- Removes audit-python3.patch: fixed in upstream</changelog>
  <changelog author="ematsumiya@suse.com" date="1627646400">- Update to version 3.0.3:
  * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined
  * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids
  * Change auparse_feed_has_data in auparse to include incomplete events
  * Auditd, stop linking against -lrt
  * Add ProtectHome and RestrictRealtime to auditd.service
  * In auditd, read up to 3 netlink packets in a row
  * In auditd, do not validate path to plugin unless active
  * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists
- use https source urls</changelog>
  <changelog author="meissner@suse.com" date="1629115200">- harden_auditd.service.patch: automatic hardening applied to systemd
  services</changelog>
  <changelog author="ematsumiya@suse.com" date="1631793600">- Change default log_format from ENRICHED to RAW (bsc#1190500):
  * add change-default-log_format.patch (SUSE-specific patch)
- Update to version 3.0.5:
  * In auditd, flush uid/gid caches when user/group added/deleted/modified
  * Fixed various issues when dealing with corrupted logs
  * In auditd, check if log_file is valid before closing handle
- Include fixed from 3.0.4:
  * Apply performance speedups to auparse library
  * Optimize rule loading in auditctl
  * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath
  * Update syscall table to the 5.14 kernel
  * Fixed various issues when dealing with corrupted logs</changelog>
  <changelog author="ematsumiya@suse.com" date="1632139200">- Fix hardened auditd.service (bsc#1181400)
  * add fix-hardened-service.patch
    Make /etc/audit read-write from the service.
    Remove PrivateDevices=true to expose /dev/* to auditd.service.
- Enable stop rules for audit.service (cf. bsc#1190227)
  * add enable-stop-rules.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1634126400">- Create separate service for augenrules (bsc#1191614, bsc#1181400)
  * add create-augenrules-service.patch
  Remove ReadWritePaths=/etc/audit from auditd.service, also removes
  augenrules call from ExecStartPost.
  Create augenrules.service with the ReadWritePaths directive above.
  This makes /etc/audit only accessible by augenrules.service and
  let auditd.service (and daemon) to be sandboxed again.
- Update audit-secondary.spec to accomodate the new service file.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634299200">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636286400">- Update to version 3.0.6:
  * fixes a segfault on some SELINUX_ERR records
  * makes IPX packet interpretation dependent on the ipx header
    file existing
  * adds b32/b64 support to ausyscall
  * adds support for armv8l
  * fixes auditctl list of syscalls on PPC
  * auditd.service now restarts auditd under some conditions</changelog>
  <changelog author="fvogt@suse.com" date="1638187200">- Use %autosetup
- Don't include sample rules as %doc, they're already installed
  as normal files
- Fix create-augenrules-service.patch:
  * auditd.service needs to require augenrules.service,
    not the other way around
- Fix documentation for enable-stop-rules.patch</changelog>
  <changelog author="dmueller@suse.com" date="1648036800">- add audit-userspace-517-compat.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1648209600">- Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645)
  * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
- Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517)
  * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Fix buildrequire for openldap2-devel - audit doesn't require the
  (outdated) C++ binding, but the C headers that happen to be pulled
  in by buildrequiring the C++ devel package</changelog>
  <changelog author="jengelh@inai.de" date="1649678400">- Drop buildrequire on C++ compiler.
- Modernize specfile constructs.</changelog>
  <changelog author="ali.abdallah@suse.com" date="1659441600">- Update audit-secondary.spec: create symbolic link from
  /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519).</changelog>
  <changelog author="lidong.zhong@suse.com" date="1667304000">- Fix rules not loaded when restarting auditd.service(bsc#1204844)</changelog>
</package>
<package pkgid="b875f637e3a1ae314094a457292bbd411386c33c5ee244e3b935033cd56e8a70" name="audit-secondary" arch="src">
  <version epoch="0" ver="3.0.6" rel="150400.4.6.1"/>
  <changelog author="tonyj@suse.com" date="1578916800">- Update to version 2.8.5:
  * Fix segfault on shutdown
  * Fix hang on startup (#1587995)
  * Add sleep to script to dump state so file is ready when needed
  * Add auparse_normalizer support for SOFTWARE_UPDATE event
  * Mark netlabel events as simple events so that get processed quicker
  * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
  * Add 30-ospp-v42.rules to meet new Common Criteria requirements
  * Update lookup tables for the 4.18 kernel
  * In aureport, fix segfault in file report
  * Add auparse_normalizer support for labeled networking events
  * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
  * Event aging is off by a second
  * In ausearch/auparse, correct event ordering to process oldest first
  * auparse_reset was not clearing everything it should
  * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
  * In ausearch/report, lightly parse selinux portion of USER_AVC events
  * In ausearch/report, limit record size when malformed
  * In auditd, fix extract_type function for network originating events
  * In auditd, calculate right size and location for network originating events
  * Treat all network originating events as VER2 so dispatcher doesn't format it
  * In audisp-remote do an initial connection attempt (#1625156)
  * In auditd, allow expression of space left as a percentage (#1650670)
  * On PPC64LE systems, only allow 64 bit rules (#1462178)
  * Make some parts of auditd state report optional based on config
  * Fix ausearch when checkpointing a single file (Burn Alting)
  * Fix scripting in 31-privileged.rules wrt filecap (#1662516)
  * In ausearch, do not checkpt if stdin is input source
  * In libev, remove __cold__ attribute for functions to allow proper hardening
  * Add tests to configure.ac for openldap support
  * Make systemd support files use /run rather than /var/run (Christian Hesse)
  * Fix minor memory leak in auditd kerberos credentials code
  * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
  * In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Fix build errors when using gcc-10 no-common default (bsc#1160384)
  New patch: audit-fno-common.patch
- Refresh audit-allow-manual-stop.patch</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="abergmann@suse.com" date="1606910400">- Enable Aarch64 processor support. (bsc#1179515 bsc#1179806)</changelog>
  <changelog author="ematsumiya@suse.com" date="1611835200">- Create new "audit" group for read access to logs (bsc#1178154)
  * add change-default-log_group.patch
  * update audit-secondary.spec</changelog>
  <changelog author="dimstar@opensuse.org" date="1612180800">- Do not explicitly provide group(audit) in system-users-audit:
  this is automatically handled by rpm/providers.</changelog>
  <changelog author="ematsumiya@suse.com" date="1623672000">- Adjust audit.spec and audit-secondary.spec to support new version
- Include fix for libev
  * add libev-werror.patch
- Update to version 3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations
- In auditd, do not allow spaces in the hostname name format
- Big documentation cleanup (MIZUTA Takeshi)
- Update syscall table to the 5.12 kernel
- Update the auparse normalizer for new event types
- Fix compiler warnings in ids subsystem
- Block a couple signals from flush &amp; reconfigure threads
- In auditd, don't wait on flush thread when exiting
- Output error message if the path of input files are too long ausearch/report
  Included fixes from 3.0.1
- Update syscall table to the 5.11 kernel
- Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
- Only enable periodic timers when listening on the network
- Upgrade libev to 4.33
- Add auparse_new_buffer function to auparse library
- Use the select libev backend unless aggregating events
- Add sudoers to some base audit rules
- Update the auparse normalizer for some new syscalls and event types
  Included fixes from 3.0
- Generate checkpoint file even when no results are returned (Burn Alting)
- Fix log file creation when file logging is disabled entirely (Vlad Glagolev)
- Convert auparse_test to run with python3 (Tomá? Chvátal)
- Drop support for prelude
- Adjust backlog_wait_time in rules to the kernel default (#1482848)
- Remove ids key syntax checking of rules in auditctl
- Use SIGCONT to dump auditd internal state (#1504251)
- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903)
- Fix parsing of uid &amp; success for ausearch
- Add support for not equal operator in audit by executable (Ondrej Mosnacek)
- Hide lru symbols in auparse
- Add systemd process protections
- Fix aureport summary time range reporting
- Allow unlimited retries on startup for remote logging
- Add queue_depth to remote logging stats and increase default queue_depth size
- Fix segfault on shutdown
- Merge auditd and audispd code
- Close on execute init_pipe fd (#1587995)
- Breakout audisp syslog plugin to be standalone program
- Create a common internal library to reduce code
- Move all audispd config files under /etc/audit/
- Move audispd.conf settings into auditd.conf
- Add queue depth statistics to internal state dump report
- Add network statistics to internal state dump report
- SIGUSR now also restarts queue processing if its suspended
- Update lookup tables for the 4.18 kernel
- Add auparse_normalizer support for SOFTWARE_UPDATE event
- Add 30-ospp-v42.rules to meet new Common Criteria requirements
- Deprecate enable_krb and replace with transport config opt for remote logging
- Mark netlabel events as simple events so that get processed quicker
- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
- In aureport, fix segfault in file report
- Add auparse_normalizer support for labeled networking events
- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
- In ausearch/auparse, event aging is off by a second
- In ausearch/auparse, correct event ordering to process oldest first
- Migrate auparse python test to python3
- auparse_reset was not clearing everything it should
- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
- In ausearch/report, lightly parse selinux portion of USER_AVC events
- Add bpf syscall command argument interpretation to auparse
- In ausearch/report, limit record size when malformed
- Port af_unix plugin to libev
- In auditd, fix extract_type function for network originating events
- In auditd, calculate right size and location for network originating events
- Make legacy script wait for auditd to terminate (#1643567)
- Treat all network originating events as VER2 so dispatcher doesn't format it
- If an event has a node name make it VER2 so dispatcher doesnt format it
- In audisp-remote do an initial connection attempt (#1625156)
- In auditd, allow expression of space left as a percentage (#1650670)
- On PPC64LE systems, only allow 64 bit rules (#1462178)
- Make some parts of auditd state report optional based on config
- Update to libev-4.25
- Fix ausearch when checkpointing a single file (Burn Alting)
- Fix scripting in 31-privileged.rules wrt filecap (#1662516)
- In ausearch, do not checkpt if stdin is input source
- In libev, remove __cold__ attribute for functions to allow proper hardening
- Add tests to configure.ac for openldap support
- Make systemd support files use /run rather than /var/run (Christian Hesse)
- Fix minor memory leak in auditd kerberos credentials code
- Allow exclude and user filter by executable name (Ondrej Mosnacek)
- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
- In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Add substitue functions for strndupa &amp; rawmemchr
- Fix memleak in auparse caused by corrected event ordering
- Fix legacy reload script to reload audit rules when daemon is reloaded
- Support for unescaping in trusted messages (Dmitry Voronin)
- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
- In aureport, fix segfault for malformed USER_CMD events
- Add exe field to audit_log_user_command in libaudit
- In auditctl support filter on socket address families (Richard Guy Briggs)
- Deprecate support for Alpha &amp; IA64 processors
- If space_left_action is rotate, allow it every time (#1718444)
- In auparse, drop standalone EOE events
- Add milliseconds column for ausearch extra time csv format
- Fix aureport first event reporting when no start given
- In audisp-remote, add new config item for startup connection errors
- Remove dependency on chkconfig
- Install rules to /usr/share/audit/sample-rules/
- Split up ospp rules to make SCAP scanning easier (#1746018)
- In audisp-syslog, support interpreting records (#1497279)
- Audit USER events now sends msg as name value pair
- Add support for AUDIT_BPF event
- Auditd should not process AUDIT_REPLACE events
- Update syscall tables to the 5.5 kernel
- Improve personality interpretation by using PERS_MASK
- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup
- Change auparse python bindings to shared object (Issue #121)
- Add error messages for watch permissions
- If audit rules file doesn't exist log error message instead of info message
- Revise error message for unmatched options in auditctl
- In audisp-remote, fixup remote endpoint disappearin in ascii format
- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander)
- In auditctl, add support for sending a signal to auditd
- Removes audit-fno-common.patch: fixed in upstream
- Removes audit-python3.patch: fixed in upstream</changelog>
  <changelog author="ematsumiya@suse.com" date="1627646400">- Update to version 3.0.3:
  * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined
  * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids
  * Change auparse_feed_has_data in auparse to include incomplete events
  * Auditd, stop linking against -lrt
  * Add ProtectHome and RestrictRealtime to auditd.service
  * In auditd, read up to 3 netlink packets in a row
  * In auditd, do not validate path to plugin unless active
  * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists
- use https source urls</changelog>
  <changelog author="meissner@suse.com" date="1629115200">- harden_auditd.service.patch: automatic hardening applied to systemd
  services</changelog>
  <changelog author="ematsumiya@suse.com" date="1631793600">- Change default log_format from ENRICHED to RAW (bsc#1190500):
  * add change-default-log_format.patch (SUSE-specific patch)
- Update to version 3.0.5:
  * In auditd, flush uid/gid caches when user/group added/deleted/modified
  * Fixed various issues when dealing with corrupted logs
  * In auditd, check if log_file is valid before closing handle
- Include fixed from 3.0.4:
  * Apply performance speedups to auparse library
  * Optimize rule loading in auditctl
  * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath
  * Update syscall table to the 5.14 kernel
  * Fixed various issues when dealing with corrupted logs</changelog>
  <changelog author="ematsumiya@suse.com" date="1632139200">- Fix hardened auditd.service (bsc#1181400)
  * add fix-hardened-service.patch
    Make /etc/audit read-write from the service.
    Remove PrivateDevices=true to expose /dev/* to auditd.service.
- Enable stop rules for audit.service (cf. bsc#1190227)
  * add enable-stop-rules.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1634126400">- Create separate service for augenrules (bsc#1191614, bsc#1181400)
  * add create-augenrules-service.patch
  Remove ReadWritePaths=/etc/audit from auditd.service, also removes
  augenrules call from ExecStartPost.
  Create augenrules.service with the ReadWritePaths directive above.
  This makes /etc/audit only accessible by augenrules.service and
  let auditd.service (and daemon) to be sandboxed again.
- Update audit-secondary.spec to accomodate the new service file.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634299200">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636286400">- Update to version 3.0.6:
  * fixes a segfault on some SELINUX_ERR records
  * makes IPX packet interpretation dependent on the ipx header
    file existing
  * adds b32/b64 support to ausyscall
  * adds support for armv8l
  * fixes auditctl list of syscalls on PPC
  * auditd.service now restarts auditd under some conditions</changelog>
  <changelog author="fvogt@suse.com" date="1638187200">- Use %autosetup
- Don't include sample rules as %doc, they're already installed
  as normal files
- Fix create-augenrules-service.patch:
  * auditd.service needs to require augenrules.service,
    not the other way around
- Fix documentation for enable-stop-rules.patch</changelog>
  <changelog author="dmueller@suse.com" date="1648036800">- add audit-userspace-517-compat.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1648209600">- Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645)
  * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
- Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517)
  * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Fix buildrequire for openldap2-devel - audit doesn't require the
  (outdated) C++ binding, but the C headers that happen to be pulled
  in by buildrequiring the C++ devel package</changelog>
  <changelog author="jengelh@inai.de" date="1649678400">- Drop buildrequire on C++ compiler.
- Modernize specfile constructs.</changelog>
  <changelog author="ali.abdallah@suse.com" date="1659441600">- Update audit-secondary.spec: create symbolic link from
  /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519).</changelog>
  <changelog author="lidong.zhong@suse.com" date="1667304000">- Fix rules not loaded when restarting auditd.service(bsc#1204844)</changelog>
</package>
<package pkgid="cac1c9efaf70593d074c83f5579a540b397c8a3613a566114930d85bdc072cdc" name="bash-completion" arch="noarch">
  <version epoch="0" ver="2.7" rel="150400.13.3.1"/>
  <changelog author="werner@suse.de" date="1443009600">- Add patch LVM-completion-bsc946875.patch to make LVM comands
  work even without any scan happen (bsc#946875)</changelog>
  <changelog author="werner@suse.de" date="1450440000">- Add patch respect-variables-boo940837.patch to avoid completions
  which results in e.g. ls \$HO
- Add patch rm-completion-smart-boo958462.patch to allow completions
  list e.g. rm prefix*.jpg&lt;TAB&gt;&lt;TAB&gt;
- Modify patch LVM-completion-bsc946875.patch that is add the
  new patch from Liuhua Wang</changelog>
  <changelog author="werner@suse.de" date="1453896000">- Add patch backticks-bsc963140.patch to handle sub commands
  which will be expanded by backticks (bsc#963140)</changelog>
  <changelog author="werner@suse.de" date="1461758400">- Add documentation for this packages below to get the reference
  of the e.g. the variable COMP_FILEDIR_FALLBACK (boo#977336)</changelog>
  <changelog author="werner@suse.de" date="1461758401">- Add patch sh-script-completion-boo977336.patch to make _filedir
  work with COMP_FILEDIR_FALLBACK even if local directries exists
  this is for bug boo##977336</changelog>
  <changelog author="sbrabec@suse.com" date="1461758402">- Remove completions conflicting with util-linux (boo#977259#c3).</changelog>
  <changelog author="werner@suse.de" date="1463572800">- Split off sub packages devel and doc to avoid dependency cycles</changelog>
  <changelog author="sbrabec@suse.com" date="1463572801">- Split doc build into a separate spec file. It makes possible to
  build package in two stages and prevent build loop.</changelog>
  <changelog author="tchvatal@suse.com" date="1472040000">- Mark the documentation as noarch</changelog>
  <changelog author="werner@suse.de" date="1481716800">- Change upstream home to https://github.com/scop/bash-completion
- Update to version 2.4
  * xetex, xelatex, luatex, lualatex: Associate with tex files
  * Support pod document files for perldoc (#39)
  * tipc: add tipc completions
  * rpm: Offer --filetriggers with -q
  * javadoc: Add bunch of option arg (non)completions
  * lrzip: Add -m arg noncompletion
  * pypy*: Add basic --jit arg completion
  * pypy3: Alias to python
  * hcitool,svcadm,tar: Spelling fixes
  * tipc: Invoke ls with "command"
  * tipc: Indentation fix
  * abook: Parse long options from command including full path
  * pyvenv: New completion
  * chroot: New (generic long options) completion, see #38
  * aptitude: List packages using _apt_cache_packages, fixes #33
  * vncviewer: Cleanup shopt use, drop an eval
  * make: Avoid a grep
  * rpm: Fix --whatenhances arg completion
  * aspell, minicom, mysql: Replace use of ls with printf
  * The BitKeeper completion used the wrong set of commands
  * Completion for python zip archives
  * lvm: pvcreate should be able to use all block devcices
  * lvm: fix all commands that should get all PVs
  * tar: Detect GNU/other from --version only once per session
  * tar: Remove unused variable
  * tar: Fix GNU tar help output parsing regex, fixes #15
  * tar: Don't write to /tmp/jetel
  * python: Simplify code
  * python: Complete all files also after -m
  * python: Don't offer options after -c
  * python: Complete all files only if -c is before current word
  * unzip, zipinfo: Complete on *.pyz
  * _lvm: using a single-pattern case and invoking function according
    to words[1]
  * lvm: _lvm_count_args parameter must be quoted in order to failglob
    not to complain
  * gendiff: Quoting suffix pattern to avoid triggering failglob
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (Alioth:
    [#314709])
  * Refactor bts and uscan, since they use common functions
  * uscan: New completion, thanks to Federico Ceratto
  * bts: New completion, thanks to Federico Ceratto.
  * nmcli completion was integrated upstream
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (take 2)
    (Alioth: #314709)
  * umount: Fix mount points escaping/unescaping with Bash-4.3
  * slapt-src: Handle --config=FILE option properly
  * sbopkg, slapt-{get,src}: expand tilde in config file name
  * slapt-{get,src}: Fix issue with sed not being able to handle some
    characters
  * slapt-src: split options from their arguments
  * psql: Tell psql to not load .psqlrc as it may change output format
    (Alioth: #314636)
  * mplayer: -dvd-devices takes dvd devices, dirs and .iso files as
    argument
  * 7z: Improve completion
  * f77, f95: Use the same completion as for g77, g95 if they are
    links to gfortran
  * make: Use only posix basic regexps with sed (Alioth: #314345)
  * perl: -d/-dt option argument is optional (Alioth: #314242)
  * Add config for cmake to bash-completion.
  * kcov: Add new sort types, complete --replace-src-path arguments
  * feh: Add new sort type
  * man: Use -w instead of --path
  * chronyc: Update help text parsing
  * chronyc: Add missing subcommands
  * chronyc: Add -6 option
  * minicom: Recognize user ~/.minirc.* as config files
  * rpmbuild: Complete *.spec on --clean (RedHat: #1132959)
  * tar: rework the completion completely
  * portsnap: New completion.
  * modprobe: fix params with multi-line descriptions
  * gdb: support --args style completion (Alioth: #314664)
  * make: Fix basic regex for portability (Alioth: #314345)
  * gnokii: New completion
  * xmllint, xmlwf, xsltproc: Complete on Mallard *.page files
  * pypy: New completion identical to python (Alioth: #314501)
  * make: Don't pick up variables when makefile is reloaded
  * make: Offer hidden targets when it is clear that the user is
    trying to complete one of them
  * make: Fix detection of intermediate targets where make has changed
    its database whitespace
  * make: completion shouldn't be confused by the output of $(info
    confuse: make)
  * zopflipng: New completion
  * ssh: Extract duplicate code to _ssh_configfile
  * gnokii, minicom: Use grep through "command"
  * Update URLs and various instructions to GitHub
  * ssh: Avoid completing commands before hostname
  * chronyc: Parse command args from help output
  * chronyc: Wrap long lines
  * Load completions also from $XDG_DATA_DIRS (RedHat: #1264094)
  * (testsuite) Ignore files generated by complete-ant-cmd.pl
  * scp, sftp: Complete -S on commands
  * scp, sftp: Fix querying ssh options
  * sftp: Add -l arg non-completion
  * ssh-copy-id: Offer only *.pub to -i
  * mpv: Remove mplayer-aliased completion
  * modplug*: Associate *.oct and *.okt
  * rpm: Add --whatenhances/recommends/suggests/supplements and
  - -recommends/supplements completions
  * pgrep, pidof, pkill, pwdx, vmstat: Add support for procps-ng
  * pdftotext: New completion
  * checksec: New completion
  * ssh: Complete HostbasedKeyTypes,HostKeyAlgorithms,KexAlgorithms
    values
  * ssh: Query ciphers and macs from ssh before hardcoded fallback
  * ssh: Add -Q argument completion
  * sysctl: Return early on --help, --version
  * sysctl: Try parsing options from help before usage
  * eog: Complete on *.ppm (RedHat: #1090481)
  * tar: Plug $line var leak
  * tar: Style tweaks
  * bsdtar, tar: Remove symlinks from git, have make create them
  * jshint: New completion
  * gnokii: Include and install it
  * gnokii: Fix completions of options that are prefixes for others
  * gnokii: Drop dead code
  * (testsuite): Add basic gnokii test case
  * gnokii: Various minor and cosmetic fixes
  * Load user completions from $BASH_COMPLETION_USER_DIR/completions
  * synclient: New completion
  * tune2fs: Add missing return in -M arg completion
  * reptyr: Rename file to _reptyr to avoid conflict with upstreamed
    completion
  * dropuser: New completion
  * createuser: New completion
  * createdb, dropdb: Drop -o default, it does not appear to do
    anything good here
  * tshark: Simplify cut usage
  * mcrypt: Simplify -m arg completion
  * strings: Fix -T/--target arg completion with non-English locale
  * chrome, firefox etc: Complete on *.pdf
  * ccache: Add -o/--set-config arg name completion
  * gphoto2: Replace tail with awk
  * gphoto2: Fix split argument handing, and colon treatment in --port
    args
  * Actually install the lz4 completion
  * _pnames: Add -s for producing (possibly) truncated names (RedHat:
    [#744406])
  * (testsuite) Add cd in dir without subdirs or CDPATH test case
  * Protect various compgen invocations from -* leakage (Debian:
    [#766163])
  * pigz, unpigz: Handle *.zz
  * rpmbuild: Complete *.spec on --nobuild
  * mplayer, *xine: Complete on *.mts (Debian: #759219)
  * ant: Support buildfile set in $ANT_ARGS (Alioth: #314735)
  * ant: Don't offer more completions after options that exit
  * 7z, adb: Trivial cleanups
  * python(3): Add -X argument non-completion
  * xsltproc. TODO fix for previous commit
  * xmllint, xmlwf, xsltproc: Complete on *.dbk and *.docbook (Alioth:
    [#314770])
  * xz: Complete -T/--threads argument
  * adb: New completion
  * modprobe: Try parsing help before using hardcoding option list
  * mpv: New completion alias + adjustments for mplayer (Debian:
    [#749115])
  * hostname: New completion
  * nslookup: complete on hosts (Alioth: #314673)
  * eog: Complete on *.pgm (RedHat: #1090481)
  * pngfix: New completion
  * qemu: Fix -balloon arg completion
  * qemu: Apply completion to qemu-kvm/-system-i386/-system-x86_64 too
  * xrandr: Use the invoked command internally, not hardcoded "xrandr"
  * xrandr: Add (some) --setprovider* arg completion support
  * ri: Fix class completion with ri &gt;= 3.
  * ri: Fix colon handling in class completion.
  * flake8: New completion
  * pyflakes: New completion
  * cal,chfn,chsh,dmesg,eject,hexdump,look,newgrp,renice,runuser,su,wr
    ite: Deprecate on Linux in favor of util-linux ones (Debian:
    [#737672])
  * hwclock,ionice,rtcwake: Deprecate in favor of util-linux ones
    (Debian: #737672)
  * ssh-keygen: New completion
  * jpegoptim: New completion
  * ip: Add some addr, addrlabel, and route arg completions
  * aptitude, dpkg: Replace some grep+cuts with awk
  * gcc, lintian, make, pkgadd, slackpkg: grep -&gt; "command grep"
    (Debian: #734095)
  * lintian: Replace some grep+cuts with awk
  * lz4: New completion.
  * optipng: New completion.
  * cppcheck: Include - in --file-list completions.
  * wtf: Look for acronym db from /usr/share/games/bsdgames/acronyms
    too.
  * wtf: Don't offer -f if it was already specified.
  * wtf: Hush stderr when db file doesn't exist.
  * appdata-validate: New completion.
  * timeout: New completion.
  * abook, kldunload: Pre-expand \t instead of relying on sed
    supporting it.
  * dict: Trivial regex cleanup.
  * zopfli: New completion.
  * bzip2, gzip, lzma: Cleanups.
  * 2to3: New completion.
  * file-roller: Reuse unzip's xspec.
  * 7z: New completion.
  * hcitool, rfcomm, ciptool, hciconfig: Don't leak $args.
  * perl: Fix -dt: completion.
  * perl*: Fix handling of relative paths in @INC.
  * wget: Add --accept-regex/--reject-regex/--regex-type arg
    (non)completions.
  * wget: Drop incorrect -nv arg completion.
  * wget: Stop completing after --help/--version.
  * Clean up/compact various globs.
  * cvs: Fix checkout -j non-completion.
  * sh: Complete script arguments with all filenames (Alioth:
    [#314226]).
  * nmcli: Deprecate our completion, upstream has one in 0.9.8.0.
  * cvs rm: Don't filter existing files with -f (RedHat: #949479).
- Drop patches now upstream
  init-completion-boo922758.patch
  pushd-completion-bnc818365.patch
- Rename patches
  bash-completion-2.1.patch becomes bash-completion-2.4.patch
- Port the patches to newer version 2.4
  FOO-dir-completion-boo905348.patch
  LVM-completion-bsc946875.patch
  PS1-completion-boo903362.patch
  backtick-completion-boo940835.patch
  backticks-bsc963140.patch
  ls-completion-boo889319.patch
  respect-variables-boo940837.patch
  rm-completion-smart-boo958462.patch
  sh-script-completion-boo977336.patch
- Only remove completion for umount/mount for older SUSE versions (boo#995045)</changelog>
  <changelog author="werner@suse.de" date="1481716801">- Add patch tar-completion.patch to allow mixed options with long
  and short options (boo#1012212)</changelog>
  <changelog author="werner@suse.de" date="1481803200">- Fix cut&amp;paste error in final ls completion</changelog>
  <changelog author="werner@suse.de" date="1481803201">- Detect if the completions for mount/umount have to be removed
  for modern util-linux package but without using suse_version</changelog>
  <changelog author="nico.kruber@gmail.com" date="1496145600">- Update to version 2.5
  * Support for python gui source files (#91)
  * mr: New completion
  * ssh-keygen: support ed25519 keys (#79)
  * Add sidedoor to _ssh() completion (#106)
  * .ipa is just a zip file and we should let unzip handle it (#71)
  * ant: parse targets in imported buildfiles (#84)
  * Add more tests for ccache
  * ccache: fix completing compiler's flags
  * test suite: Add java/javac non-completion fixture
  * javac: Complete -cp like -classpath
  * travis: Skip bluez and nis for now due to post-install script
    issues
  * test/config/*: Delete trailing whitespace
  * (test suite): Avoid loading user's ~/.bash_completion, fixes #87
  * ip: Recognize a as alias for address and l for link
  * ip: Recognize address in addition to addr
  * mr: Disable "clean" test case, command N/A before mr 1.20141023
  * ssh-keygen: Parse switches with _parse_usage, not _parse_help
  * mplayer: Associate with *.mjpg, *.mjpeg (Debian: #837779)
  * dd: Sync completions with coreutils 8.24
  * travis: Add mr
  * perl: Remove full path to cat in PERLDOC_PAGER call
  * deja-dup: New completion
  * CONTRIBUTING: Reorder sections
  * *: Move indentation settings to .editorconfig
  * make: Declare _make_target_extract_script like other functions
  * Travis: zopfli is AWOL?
  * *: Whitespace fixes
  * Minor edits to README.md (mostly formatting) (#110)
  * Fix bug in 'make' completion when using BSD sed (#108)
  * Add support for Include in ssh config (#70) (#80)
- adapt LVM-completion-bsc946875.patch</changelog>
  <changelog author="werner@suse.de" date="1499169600">- Update to version 2.7
  * Makefile: update default compatdir (#132)
  * Make user completion file configurable, disable in tests
  * test suite: Generalize xspec completion install check
  * pyflakes: Remove redundant xspec completion
  * test suite: Fix __expand_tilde_by_ref test expectation output
  * pdfunite: New *.pdf completion
  + bash-completion (2.6)
  * Add missing sidedoor to .gitignore (#114)
  * test suite: Mark expected centos6 CI _filedir failures as such
  * Expose version in BASH_COMPLETION_VERSINFO, use it in profile.d
    script
  * test suite: Skip an expected make test case failure in centos6 CI
  * test suite: Fix ifdown and ifup CI test skipping
  * test suite: Ignore env var pulled in by use of scp in tests
  * test suite: If colon trim doesn't do anything, trim as usual
  * tar: Comment spelling fixes
  * test suite: Mark dpkg -L test case untested if no packages
    installed
  * test suite: Cosmetic tweaks
  * dpkg: Fix dpkg -i home dir completion
  * test suite: Improve ls home dir test descriptions
  * python: Split module completion to separate helper
  * micropython: New completion, aliased from python
  * test suite: Add Python module completion test case
  * python: Fix traceback avoidance on module completion error
  * openssl: Parse available digests from dgst -h
  * openssl: Add sha2 commands
  * gm: New completion, commands only for now
  * (test suite): Test screen -T completions
  * (test suite): Set TERM to dumb, not dummy
  * Revert "(test suite): Fix alias and cd cursor position tests"
  * mplayer: Remove duplicate *.m4a and *.m4v associations
  * mplayer, xine, etc: Associate *.mp4a and *.mp4v
  * xine etc: Fix *.m4a association
  * bind: Add option and argument (non-)completions
  * _user_at_host: Set nospace only when completing username part
  * _user_at_host: Append @ suffix to username part completions
  * man: Don't check OSTYPE or GNU userland, just enable on all
    systems
  * (test suite): Set dcop result to untested if dcop server is not
    running
  * (test suite): Don't insist on loading all completions dynamically
  * _configured_interfaces: Parse from /etc/network/interfaces.d/* on
    Debian
  * py.test: New completion
  * oowriter: Associate with *.pdf
  * Don't define BASH_COMPLETION_COMPAT_DIR
  * ri: Add option and arg completions
  * (test suite): Add our own dummy ri test fixture
  * (test suite): Info test needs docs, don't exclude from CentOS
  * (test suite): Fix CentOS 6 tcllib setup
  * (test suite): Simplify renice test, fix with only one completion
  * (test suite): Don't assume configured interfaces in CI setups
  * Don't offer * as configured interface when there are none
  * (test suite): Add basic CentOS 6 container for bash 4.1 coverage
  * (test suite): Ignore runtime loaded env function changes
  * (test suite): Add mailman bin dir to PATH for arch test
  * arch: Parse options from --help
  * (test suite): Load tested completions dynamically
  * (test suite): Accept non-whitespace single word in
    assert_complete_any
  * (test suite): Avoid interference from user and system dirs (#87)
  * (test suite): Install some things N/A in ubuntu14 to fedoradev
  * (test suite): Add unrar to ubuntu14 container
  * (test suite): Fix alias and cd cursor position tests
  * (test suite): Add basic alpine test case
  * alpine: Parse opts from -h output, add some opt arg completions
  * (test suite): Install jshint globally in ubuntu14
  * (test suite): Add mailman bin dir to PATH for some mailman tools
  * (test suite): Install jshint to ubuntu14 container with npm
  * unshunt: Parse options from --help
  * (test suite): Test lsof on ubuntu14
  * (test suite): Add basic hping3 test case
  * (test suite): Add our ./configure to PATH to test it, test opts
  * (test suite): Add bunch of packages to ubuntu14 container
  * (test suite): Ensure /usr/(local/)games is in $PATH
  * (test suite): Fix perl -d* test cases with no Devel::* installed
  * (test suite): curl has lots of options, add more test prefix
  * (test suite): Fix tar test case for ones having --owner-map
  * (test suite): Unsupport various kill, renice cases if ps is N/A
  * (test suite): Make chkconfig test behave better in container
  * (test suite): Don't assume mounted filesystems in quota* tests
  * newlist: Parse options from --help, add some arg non-completions
  * (test suite): Delete trailing whitespace
  * (test suite): Don't assume lists set up in newlist test cases
  * (docker): Pull in missing fedoradev xvfb-run which dependency
  * mr: Avoid stderr trash and test suite failure if man is N/A
  * (test suite): Fix mmsitepass completion test
  * tshark -G: Avoid stderr noise when running as superuser
  * (docker): Run completion tests with xvfb-run, e.g. for gkrellm
  * ssh-keygen: Make option parsing work with OpenSSH &lt; 7
  * synclient, udevadm: Avoid use of posix char classes for awk
  * test suite: Add WIP Fedora dev config
  * Travis: Switch tests to docker, update to Ubuntu 14
  * xv: Associate with *.j2c, *.j2k, *.jp2, *.jpf, and *.jpg2 (Debian:
    [#859774])
  * eog: Associate with *.j2c and *.jpg2
  * Bump copyright years
  * xine etc: Associate uppercase *.WM[AV]
  * mplayer: Associate *.weba (#112)
  * xine etc: Associate *.webm and *.weba (#112)
- Modify patches
  * FOO-dir-completion-boo905348.patch
  * PS1-completion-boo903362.patch
  * backtick-completion-boo940835.patch
  * backticks-bsc963140.patch
  * bash-completion-2.4.patch
  * bash-completion.changes
  * bash-completion.spec
  * ls-completion-boo889319.patch
  * respect-variables-boo940837.patch
  * rm-completion-smart-boo958462.patch
  * sh-script-completion-boo977336.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1513598400">- Remove rfkill conflicting with util-linux-2.31.</changelog>
  <changelog author="werner@suse.de" date="1540209600">- Modify patch PS1-completion-boo903362.patch to make it work with
  mksh as well (boo#1104531)</changelog>
  <changelog author="werner@suse.de" date="1633348800">- Add patch boo1190929-9af4afd0.patch for boo#1190929
  modinfo completion fails to recognize .ko.xz</changelog>
  <changelog author="werner@suse.de" date="1653307200">- Add patch bsc1199724-modules.patch (bsc#1199724)
  * Enable upstream commit to list ko.zst modules as well</changelog>
  <changelog author="otto.hollmann@suse.com" date="1658836800">- Add patch fix-curl-help-completion-bsc1200791.patch (bsc#1200791)
  * List all options for `curl --&lt;TAB&gt;`</changelog>
</package>
<package pkgid="9cd97829612548eb8a4b2f9ea7a22de1e2c723d84bebb4fef088142780880b1e" name="bash-completion" arch="src">
  <version epoch="0" ver="2.7" rel="150400.13.3.1"/>
  <changelog author="werner@suse.de" date="1443009600">- Add patch LVM-completion-bsc946875.patch to make LVM comands
  work even without any scan happen (bsc#946875)</changelog>
  <changelog author="werner@suse.de" date="1450440000">- Add patch respect-variables-boo940837.patch to avoid completions
  which results in e.g. ls \$HO
- Add patch rm-completion-smart-boo958462.patch to allow completions
  list e.g. rm prefix*.jpg&lt;TAB&gt;&lt;TAB&gt;
- Modify patch LVM-completion-bsc946875.patch that is add the
  new patch from Liuhua Wang</changelog>
  <changelog author="werner@suse.de" date="1453896000">- Add patch backticks-bsc963140.patch to handle sub commands
  which will be expanded by backticks (bsc#963140)</changelog>
  <changelog author="werner@suse.de" date="1461758400">- Add documentation for this packages below to get the reference
  of the e.g. the variable COMP_FILEDIR_FALLBACK (boo#977336)</changelog>
  <changelog author="werner@suse.de" date="1461758401">- Add patch sh-script-completion-boo977336.patch to make _filedir
  work with COMP_FILEDIR_FALLBACK even if local directries exists
  this is for bug boo##977336</changelog>
  <changelog author="sbrabec@suse.com" date="1461758402">- Remove completions conflicting with util-linux (boo#977259#c3).</changelog>
  <changelog author="werner@suse.de" date="1463572800">- Split off sub packages devel and doc to avoid dependency cycles</changelog>
  <changelog author="sbrabec@suse.com" date="1463572801">- Split doc build into a separate spec file. It makes possible to
  build package in two stages and prevent build loop.</changelog>
  <changelog author="tchvatal@suse.com" date="1472040000">- Mark the documentation as noarch</changelog>
  <changelog author="werner@suse.de" date="1481716800">- Change upstream home to https://github.com/scop/bash-completion
- Update to version 2.4
  * xetex, xelatex, luatex, lualatex: Associate with tex files
  * Support pod document files for perldoc (#39)
  * tipc: add tipc completions
  * rpm: Offer --filetriggers with -q
  * javadoc: Add bunch of option arg (non)completions
  * lrzip: Add -m arg noncompletion
  * pypy*: Add basic --jit arg completion
  * pypy3: Alias to python
  * hcitool,svcadm,tar: Spelling fixes
  * tipc: Invoke ls with "command"
  * tipc: Indentation fix
  * abook: Parse long options from command including full path
  * pyvenv: New completion
  * chroot: New (generic long options) completion, see #38
  * aptitude: List packages using _apt_cache_packages, fixes #33
  * vncviewer: Cleanup shopt use, drop an eval
  * make: Avoid a grep
  * rpm: Fix --whatenhances arg completion
  * aspell, minicom, mysql: Replace use of ls with printf
  * The BitKeeper completion used the wrong set of commands
  * Completion for python zip archives
  * lvm: pvcreate should be able to use all block devcices
  * lvm: fix all commands that should get all PVs
  * tar: Detect GNU/other from --version only once per session
  * tar: Remove unused variable
  * tar: Fix GNU tar help output parsing regex, fixes #15
  * tar: Don't write to /tmp/jetel
  * python: Simplify code
  * python: Complete all files also after -m
  * python: Don't offer options after -c
  * python: Complete all files only if -c is before current word
  * unzip, zipinfo: Complete on *.pyz
  * _lvm: using a single-pattern case and invoking function according
    to words[1]
  * lvm: _lvm_count_args parameter must be quoted in order to failglob
    not to complain
  * gendiff: Quoting suffix pattern to avoid triggering failglob
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (Alioth:
    [#314709])
  * Refactor bts and uscan, since they use common functions
  * uscan: New completion, thanks to Federico Ceratto
  * bts: New completion, thanks to Federico Ceratto.
  * nmcli completion was integrated upstream
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (take 2)
    (Alioth: #314709)
  * umount: Fix mount points escaping/unescaping with Bash-4.3
  * slapt-src: Handle --config=FILE option properly
  * sbopkg, slapt-{get,src}: expand tilde in config file name
  * slapt-{get,src}: Fix issue with sed not being able to handle some
    characters
  * slapt-src: split options from their arguments
  * psql: Tell psql to not load .psqlrc as it may change output format
    (Alioth: #314636)
  * mplayer: -dvd-devices takes dvd devices, dirs and .iso files as
    argument
  * 7z: Improve completion
  * f77, f95: Use the same completion as for g77, g95 if they are
    links to gfortran
  * make: Use only posix basic regexps with sed (Alioth: #314345)
  * perl: -d/-dt option argument is optional (Alioth: #314242)
  * Add config for cmake to bash-completion.
  * kcov: Add new sort types, complete --replace-src-path arguments
  * feh: Add new sort type
  * man: Use -w instead of --path
  * chronyc: Update help text parsing
  * chronyc: Add missing subcommands
  * chronyc: Add -6 option
  * minicom: Recognize user ~/.minirc.* as config files
  * rpmbuild: Complete *.spec on --clean (RedHat: #1132959)
  * tar: rework the completion completely
  * portsnap: New completion.
  * modprobe: fix params with multi-line descriptions
  * gdb: support --args style completion (Alioth: #314664)
  * make: Fix basic regex for portability (Alioth: #314345)
  * gnokii: New completion
  * xmllint, xmlwf, xsltproc: Complete on Mallard *.page files
  * pypy: New completion identical to python (Alioth: #314501)
  * make: Don't pick up variables when makefile is reloaded
  * make: Offer hidden targets when it is clear that the user is
    trying to complete one of them
  * make: Fix detection of intermediate targets where make has changed
    its database whitespace
  * make: completion shouldn't be confused by the output of $(info
    confuse: make)
  * zopflipng: New completion
  * ssh: Extract duplicate code to _ssh_configfile
  * gnokii, minicom: Use grep through "command"
  * Update URLs and various instructions to GitHub
  * ssh: Avoid completing commands before hostname
  * chronyc: Parse command args from help output
  * chronyc: Wrap long lines
  * Load completions also from $XDG_DATA_DIRS (RedHat: #1264094)
  * (testsuite) Ignore files generated by complete-ant-cmd.pl
  * scp, sftp: Complete -S on commands
  * scp, sftp: Fix querying ssh options
  * sftp: Add -l arg non-completion
  * ssh-copy-id: Offer only *.pub to -i
  * mpv: Remove mplayer-aliased completion
  * modplug*: Associate *.oct and *.okt
  * rpm: Add --whatenhances/recommends/suggests/supplements and
  - -recommends/supplements completions
  * pgrep, pidof, pkill, pwdx, vmstat: Add support for procps-ng
  * pdftotext: New completion
  * checksec: New completion
  * ssh: Complete HostbasedKeyTypes,HostKeyAlgorithms,KexAlgorithms
    values
  * ssh: Query ciphers and macs from ssh before hardcoded fallback
  * ssh: Add -Q argument completion
  * sysctl: Return early on --help, --version
  * sysctl: Try parsing options from help before usage
  * eog: Complete on *.ppm (RedHat: #1090481)
  * tar: Plug $line var leak
  * tar: Style tweaks
  * bsdtar, tar: Remove symlinks from git, have make create them
  * jshint: New completion
  * gnokii: Include and install it
  * gnokii: Fix completions of options that are prefixes for others
  * gnokii: Drop dead code
  * (testsuite): Add basic gnokii test case
  * gnokii: Various minor and cosmetic fixes
  * Load user completions from $BASH_COMPLETION_USER_DIR/completions
  * synclient: New completion
  * tune2fs: Add missing return in -M arg completion
  * reptyr: Rename file to _reptyr to avoid conflict with upstreamed
    completion
  * dropuser: New completion
  * createuser: New completion
  * createdb, dropdb: Drop -o default, it does not appear to do
    anything good here
  * tshark: Simplify cut usage
  * mcrypt: Simplify -m arg completion
  * strings: Fix -T/--target arg completion with non-English locale
  * chrome, firefox etc: Complete on *.pdf
  * ccache: Add -o/--set-config arg name completion
  * gphoto2: Replace tail with awk
  * gphoto2: Fix split argument handing, and colon treatment in --port
    args
  * Actually install the lz4 completion
  * _pnames: Add -s for producing (possibly) truncated names (RedHat:
    [#744406])
  * (testsuite) Add cd in dir without subdirs or CDPATH test case
  * Protect various compgen invocations from -* leakage (Debian:
    [#766163])
  * pigz, unpigz: Handle *.zz
  * rpmbuild: Complete *.spec on --nobuild
  * mplayer, *xine: Complete on *.mts (Debian: #759219)
  * ant: Support buildfile set in $ANT_ARGS (Alioth: #314735)
  * ant: Don't offer more completions after options that exit
  * 7z, adb: Trivial cleanups
  * python(3): Add -X argument non-completion
  * xsltproc. TODO fix for previous commit
  * xmllint, xmlwf, xsltproc: Complete on *.dbk and *.docbook (Alioth:
    [#314770])
  * xz: Complete -T/--threads argument
  * adb: New completion
  * modprobe: Try parsing help before using hardcoding option list
  * mpv: New completion alias + adjustments for mplayer (Debian:
    [#749115])
  * hostname: New completion
  * nslookup: complete on hosts (Alioth: #314673)
  * eog: Complete on *.pgm (RedHat: #1090481)
  * pngfix: New completion
  * qemu: Fix -balloon arg completion
  * qemu: Apply completion to qemu-kvm/-system-i386/-system-x86_64 too
  * xrandr: Use the invoked command internally, not hardcoded "xrandr"
  * xrandr: Add (some) --setprovider* arg completion support
  * ri: Fix class completion with ri &gt;= 3.
  * ri: Fix colon handling in class completion.
  * flake8: New completion
  * pyflakes: New completion
  * cal,chfn,chsh,dmesg,eject,hexdump,look,newgrp,renice,runuser,su,wr
    ite: Deprecate on Linux in favor of util-linux ones (Debian:
    [#737672])
  * hwclock,ionice,rtcwake: Deprecate in favor of util-linux ones
    (Debian: #737672)
  * ssh-keygen: New completion
  * jpegoptim: New completion
  * ip: Add some addr, addrlabel, and route arg completions
  * aptitude, dpkg: Replace some grep+cuts with awk
  * gcc, lintian, make, pkgadd, slackpkg: grep -&gt; "command grep"
    (Debian: #734095)
  * lintian: Replace some grep+cuts with awk
  * lz4: New completion.
  * optipng: New completion.
  * cppcheck: Include - in --file-list completions.
  * wtf: Look for acronym db from /usr/share/games/bsdgames/acronyms
    too.
  * wtf: Don't offer -f if it was already specified.
  * wtf: Hush stderr when db file doesn't exist.
  * appdata-validate: New completion.
  * timeout: New completion.
  * abook, kldunload: Pre-expand \t instead of relying on sed
    supporting it.
  * dict: Trivial regex cleanup.
  * zopfli: New completion.
  * bzip2, gzip, lzma: Cleanups.
  * 2to3: New completion.
  * file-roller: Reuse unzip's xspec.
  * 7z: New completion.
  * hcitool, rfcomm, ciptool, hciconfig: Don't leak $args.
  * perl: Fix -dt: completion.
  * perl*: Fix handling of relative paths in @INC.
  * wget: Add --accept-regex/--reject-regex/--regex-type arg
    (non)completions.
  * wget: Drop incorrect -nv arg completion.
  * wget: Stop completing after --help/--version.
  * Clean up/compact various globs.
  * cvs: Fix checkout -j non-completion.
  * sh: Complete script arguments with all filenames (Alioth:
    [#314226]).
  * nmcli: Deprecate our completion, upstream has one in 0.9.8.0.
  * cvs rm: Don't filter existing files with -f (RedHat: #949479).
- Drop patches now upstream
  init-completion-boo922758.patch
  pushd-completion-bnc818365.patch
- Rename patches
  bash-completion-2.1.patch becomes bash-completion-2.4.patch
- Port the patches to newer version 2.4
  FOO-dir-completion-boo905348.patch
  LVM-completion-bsc946875.patch
  PS1-completion-boo903362.patch
  backtick-completion-boo940835.patch
  backticks-bsc963140.patch
  ls-completion-boo889319.patch
  respect-variables-boo940837.patch
  rm-completion-smart-boo958462.patch
  sh-script-completion-boo977336.patch
- Only remove completion for umount/mount for older SUSE versions (boo#995045)</changelog>
  <changelog author="werner@suse.de" date="1481716801">- Add patch tar-completion.patch to allow mixed options with long
  and short options (boo#1012212)</changelog>
  <changelog author="werner@suse.de" date="1481803200">- Fix cut&amp;paste error in final ls completion</changelog>
  <changelog author="werner@suse.de" date="1481803201">- Detect if the completions for mount/umount have to be removed
  for modern util-linux package but without using suse_version</changelog>
  <changelog author="nico.kruber@gmail.com" date="1496145600">- Update to version 2.5
  * Support for python gui source files (#91)
  * mr: New completion
  * ssh-keygen: support ed25519 keys (#79)
  * Add sidedoor to _ssh() completion (#106)
  * .ipa is just a zip file and we should let unzip handle it (#71)
  * ant: parse targets in imported buildfiles (#84)
  * Add more tests for ccache
  * ccache: fix completing compiler's flags
  * test suite: Add java/javac non-completion fixture
  * javac: Complete -cp like -classpath
  * travis: Skip bluez and nis for now due to post-install script
    issues
  * test/config/*: Delete trailing whitespace
  * (test suite): Avoid loading user's ~/.bash_completion, fixes #87
  * ip: Recognize a as alias for address and l for link
  * ip: Recognize address in addition to addr
  * mr: Disable "clean" test case, command N/A before mr 1.20141023
  * ssh-keygen: Parse switches with _parse_usage, not _parse_help
  * mplayer: Associate with *.mjpg, *.mjpeg (Debian: #837779)
  * dd: Sync completions with coreutils 8.24
  * travis: Add mr
  * perl: Remove full path to cat in PERLDOC_PAGER call
  * deja-dup: New completion
  * CONTRIBUTING: Reorder sections
  * *: Move indentation settings to .editorconfig
  * make: Declare _make_target_extract_script like other functions
  * Travis: zopfli is AWOL?
  * *: Whitespace fixes
  * Minor edits to README.md (mostly formatting) (#110)
  * Fix bug in 'make' completion when using BSD sed (#108)
  * Add support for Include in ssh config (#70) (#80)
- adapt LVM-completion-bsc946875.patch</changelog>
  <changelog author="werner@suse.de" date="1499169600">- Update to version 2.7
  * Makefile: update default compatdir (#132)
  * Make user completion file configurable, disable in tests
  * test suite: Generalize xspec completion install check
  * pyflakes: Remove redundant xspec completion
  * test suite: Fix __expand_tilde_by_ref test expectation output
  * pdfunite: New *.pdf completion
  + bash-completion (2.6)
  * Add missing sidedoor to .gitignore (#114)
  * test suite: Mark expected centos6 CI _filedir failures as such
  * Expose version in BASH_COMPLETION_VERSINFO, use it in profile.d
    script
  * test suite: Skip an expected make test case failure in centos6 CI
  * test suite: Fix ifdown and ifup CI test skipping
  * test suite: Ignore env var pulled in by use of scp in tests
  * test suite: If colon trim doesn't do anything, trim as usual
  * tar: Comment spelling fixes
  * test suite: Mark dpkg -L test case untested if no packages
    installed
  * test suite: Cosmetic tweaks
  * dpkg: Fix dpkg -i home dir completion
  * test suite: Improve ls home dir test descriptions
  * python: Split module completion to separate helper
  * micropython: New completion, aliased from python
  * test suite: Add Python module completion test case
  * python: Fix traceback avoidance on module completion error
  * openssl: Parse available digests from dgst -h
  * openssl: Add sha2 commands
  * gm: New completion, commands only for now
  * (test suite): Test screen -T completions
  * (test suite): Set TERM to dumb, not dummy
  * Revert "(test suite): Fix alias and cd cursor position tests"
  * mplayer: Remove duplicate *.m4a and *.m4v associations
  * mplayer, xine, etc: Associate *.mp4a and *.mp4v
  * xine etc: Fix *.m4a association
  * bind: Add option and argument (non-)completions
  * _user_at_host: Set nospace only when completing username part
  * _user_at_host: Append @ suffix to username part completions
  * man: Don't check OSTYPE or GNU userland, just enable on all
    systems
  * (test suite): Set dcop result to untested if dcop server is not
    running
  * (test suite): Don't insist on loading all completions dynamically
  * _configured_interfaces: Parse from /etc/network/interfaces.d/* on
    Debian
  * py.test: New completion
  * oowriter: Associate with *.pdf
  * Don't define BASH_COMPLETION_COMPAT_DIR
  * ri: Add option and arg completions
  * (test suite): Add our own dummy ri test fixture
  * (test suite): Info test needs docs, don't exclude from CentOS
  * (test suite): Fix CentOS 6 tcllib setup
  * (test suite): Simplify renice test, fix with only one completion
  * (test suite): Don't assume configured interfaces in CI setups
  * Don't offer * as configured interface when there are none
  * (test suite): Add basic CentOS 6 container for bash 4.1 coverage
  * (test suite): Ignore runtime loaded env function changes
  * (test suite): Add mailman bin dir to PATH for arch test
  * arch: Parse options from --help
  * (test suite): Load tested completions dynamically
  * (test suite): Accept non-whitespace single word in
    assert_complete_any
  * (test suite): Avoid interference from user and system dirs (#87)
  * (test suite): Install some things N/A in ubuntu14 to fedoradev
  * (test suite): Add unrar to ubuntu14 container
  * (test suite): Fix alias and cd cursor position tests
  * (test suite): Add basic alpine test case
  * alpine: Parse opts from -h output, add some opt arg completions
  * (test suite): Install jshint globally in ubuntu14
  * (test suite): Add mailman bin dir to PATH for some mailman tools
  * (test suite): Install jshint to ubuntu14 container with npm
  * unshunt: Parse options from --help
  * (test suite): Test lsof on ubuntu14
  * (test suite): Add basic hping3 test case
  * (test suite): Add our ./configure to PATH to test it, test opts
  * (test suite): Add bunch of packages to ubuntu14 container
  * (test suite): Ensure /usr/(local/)games is in $PATH
  * (test suite): Fix perl -d* test cases with no Devel::* installed
  * (test suite): curl has lots of options, add more test prefix
  * (test suite): Fix tar test case for ones having --owner-map
  * (test suite): Unsupport various kill, renice cases if ps is N/A
  * (test suite): Make chkconfig test behave better in container
  * (test suite): Don't assume mounted filesystems in quota* tests
  * newlist: Parse options from --help, add some arg non-completions
  * (test suite): Delete trailing whitespace
  * (test suite): Don't assume lists set up in newlist test cases
  * (docker): Pull in missing fedoradev xvfb-run which dependency
  * mr: Avoid stderr trash and test suite failure if man is N/A
  * (test suite): Fix mmsitepass completion test
  * tshark -G: Avoid stderr noise when running as superuser
  * (docker): Run completion tests with xvfb-run, e.g. for gkrellm
  * ssh-keygen: Make option parsing work with OpenSSH &lt; 7
  * synclient, udevadm: Avoid use of posix char classes for awk
  * test suite: Add WIP Fedora dev config
  * Travis: Switch tests to docker, update to Ubuntu 14
  * xv: Associate with *.j2c, *.j2k, *.jp2, *.jpf, and *.jpg2 (Debian:
    [#859774])
  * eog: Associate with *.j2c and *.jpg2
  * Bump copyright years
  * xine etc: Associate uppercase *.WM[AV]
  * mplayer: Associate *.weba (#112)
  * xine etc: Associate *.webm and *.weba (#112)
- Modify patches
  * FOO-dir-completion-boo905348.patch
  * PS1-completion-boo903362.patch
  * backtick-completion-boo940835.patch
  * backticks-bsc963140.patch
  * bash-completion-2.4.patch
  * bash-completion.changes
  * bash-completion.spec
  * ls-completion-boo889319.patch
  * respect-variables-boo940837.patch
  * rm-completion-smart-boo958462.patch
  * sh-script-completion-boo977336.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1513598400">- Remove rfkill conflicting with util-linux-2.31.</changelog>
  <changelog author="werner@suse.de" date="1540209600">- Modify patch PS1-completion-boo903362.patch to make it work with
  mksh as well (boo#1104531)</changelog>
  <changelog author="werner@suse.de" date="1633348800">- Add patch boo1190929-9af4afd0.patch for boo#1190929
  modinfo completion fails to recognize .ko.xz</changelog>
  <changelog author="werner@suse.de" date="1653307200">- Add patch bsc1199724-modules.patch (bsc#1199724)
  * Enable upstream commit to list ko.zst modules as well</changelog>
  <changelog author="otto.hollmann@suse.com" date="1658836800">- Add patch fix-curl-help-completion-bsc1200791.patch (bsc#1200791)
  * List all options for `curl --&lt;TAB&gt;`</changelog>
</package>
<package pkgid="b324ca79cf631f9ae964a7d4efd8692a119b79b4a5f0dc5bb39a94f8da432c88" name="c-ares" arch="src">
  <version epoch="0" ver="1.19.0" rel="150000.3.20.1"/>
  <changelog author="jengelh@inai.de" date="1519128000">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
</package>
<package pkgid="a4316f4ebf0ccc2e54f50f0c9367ae138e2c30f16b3fc8c5cf62b040d9831bf9" name="ca-certificates-mozilla" arch="noarch">
  <version epoch="0" ver="2.60" rel="150200.27.1"/>
  <changelog author="meissner@suse.com" date="1485259200">- updated to 2.11 state of the Mozilla NSS Certificate store.
- removed CAs:
  - Buypass_Class_2_CA_1:2.1.1.crt
    serverAuth
  - EBG_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?:2.8.76.175.115.66.28.142.116.2.crt
    codeSigning emailProtection serverAuth
  - Equifax_Secure_CA:2.4.53.222.244.207.crt
    emailProtection
  - Equifax_Secure_eBusiness_CA_1:2.1.4.crt
    emailProtection
  - Equifax_Secure_Global_eBusiness_CA:2.1.1.crt
    emailProtection
  - IGC_A:2.5.57.17.69.16.148.crt
    codeSigning emailProtection serverAuth
  - Juur-SK:2.4.59.142.75.252.crt
    codeSigning serverAuth
  - Root_CA_Generalitat_Valenciana:2.4.59.69.229.104.crt
    codeSigning emailProtection serverAuth
  - RSA_Security_2048_v3:2.16.10.1.1.1.0.0.2.124.0.0.0.10.0.0.0.2.crt
    codeSigning emailProtection serverAuth
  - Sonera_Class_1_Root_CA:2.1.36.crt
    emailProtection
  - S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN:2.16.55.25.24.230.83.84.124.26.181.184.203.89.90.219.53.183.crt
    emailProtection
  - Verisign_Class_1_Public_Primary_Certification_Authority:2.16.63.105.30.129.156.240.154.74.243.115.255.185.72.162.228.221.crt
    emailProtection
  - Verisign_Class_2_Public_Primary_Certification_Authority_-_G2:2.17.0.185.47.96.204.136.159.161.122.70.9.184.91.112.108.138.175.crt
    emailProtection
  - Verisign_Class_3_Public_Primary_Certification_Authority:2.16.112.186.228.29.16.217.41.52.182.56.202.123.3.204.186.191.crt
    emailProtection
- added CAs:
  + AC_RAIZ_FNMT-RCM:2.15.93.147.141.48.103.54.200.6.29.26.199.84.132.105.7.crt
    serverAuth
  + Amazon_Root_CA_1:2.19.6.108.159.207.153.191.140.10.57.226.240.120.138.67.230.150.54.91.202.crt
    emailProtection serverAuth
  + Amazon_Root_CA_2:2.19.6.108.159.210.150.53.134.159.10.15.229.134.120.248.91.38.187.138.55.crt
    emailProtection serverAuth
  + Amazon_Root_CA_3:2.19.6.108.159.213.116.151.54.102.63.59.11.154.217.232.158.118.3.242.74.crt
    emailProtection serverAuth
  + Amazon_Root_CA_4:2.19.6.108.159.215.193.187.16.76.41.67.229.113.123.123.44.200.26.193.14.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G1:2.18.17.32.85.131.228.45.62.84.86.133.45.131.55.183.44.220.70.17.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G2:2.18.17.32.217.145.206.174.163.232.197.231.255.233.2.175.207.115.188.85.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + ISRG_Root_X1:2.17.0.130.16.207.176.210.64.227.89.68.99.224.187.99.130.139.0.crt (bsc#1010996)
    serverAuth
  + LuxTrust_Global_Root_2:2.20.10.126.166.223.75.68.158.218.106.36.133.158.230.184.21.211.22.127.187.177.crt
    serverAuth
  + OpenTrust_Root_CA_G1:2.18.17.32.179.144.85.57.125.127.54.109.100.194.167.159.107.99.142.103.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G2:2.18.17.32.161.105.27.191.189.185.189.82.150.143.35.232.72.191.38.17.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G3:2.18.17.32.230.248.76.252.36.176.190.5.64.172.218.131.27.52.96.63.crt
    emailProtection serverAuth
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G4:2.16.33.110.51.165.203.211.136.164.111.41.7.180.39.60.196.216.crt
    emailProtection
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G6:2.16.36.50.117.242.29.47.210.9.51.247.180.106.202.208.243.152.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G4:2.16.52.23.101.18.64.59.183.86.128.45.128.203.121.85.166.30.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G6:2.16.100.130.158.252.55.30.116.93.252.151.255.151.200.177.255.65.crt
    emailProtection
- diff-from-upstream-2.7.patch: removed as we should be able to do
  intermediate root chains now with openssl 1.0.2 and also gnutls 3.5
  is able to do so.</changelog>
  <changelog author="jmatejek@suse.com" date="1508932800">- convert processing script to Python 3
- ensure a stable conversion of UTF8 hex-encoded certificate names
- ensure a stable ordering of trust/distrust bits in headers</changelog>
  <changelog author="meissner@suse.com" date="1516881600">- Updated to 2.22 state of the Mozilla NSS Certificate store (bsc#1071152,
  bsc#1071390, bsc#1010996)
- Removed CAs:
  * ACEDICOM Root
  * AddTrust Public CA Root
  * AddTrust Qualified CA Root
  * ApplicationCA - Japanese Government
  * CA Disig Root R1
  * CA WoSign ECC Root
  * Certification Authority of WoSign G2
  * Certinomis - Autorité Racine
  * China Internet Network Information Center EV Certificates Root
  * CNNIC ROOT
  * Comodo Secure Certificate Services
  * Comodo Trusted Certificate Services
  * ComSign Secured CA
  * DST ACES CA X6
  * GeoTrust Global CA 2
  * StartCom Certification Authority
  * StartCom Certification Authority
  * StartCom Certification Authority G2
  * Swisscom Root CA 1
  * TÜB?TAK UEKAE Kök Sertifika Hizmet Sa?lay?c?s? - Sürüm 3
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s?
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  * UTN USERFirst Hardware Root CA
  * UTN USERFirst Object Root CA
  * VeriSign Class 3 Secure Server CA - G2
  * WellsSecure Public Root Certificate Authority
  * Certification Authority of WoSign
  * WoSign China
- Added CAs:
  * D-TRUST Root CA 3 2013
  * GDCA TrustAUTH R5 ROOT
  * SSL.com EV Root Certification Authority ECC
  * SSL.com EV Root Certification Authority RSA R2
  * SSL.com Root Certification Authority ECC
  * SSL.com Root Certification Authority RSA
  * TrustCor RootCert CA-1
  * TrustCor RootCert CA-2
  * TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1612872000">- Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994)
- Added new root CAs:
  - NAVER Global Root Certification Authority
- Removed old root CA:
  - GeoTrust Global CA
  - GeoTrust Primary Certification Authority
  - GeoTrust Primary Certification Authority - G3
  - GeoTrust Universal CA
  - GeoTrust Universal CA 2
  - thawte Primary Root CA
  - thawte Primary Root CA - G2
  - thawte Primary Root CA - G3
  - VeriSign Class 3 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G5</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
  <changelog author="meissner@suse.com" date="1633176000">- updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006)
- Added CAs:
  + HARICA Client ECC Root CA 2021
  + HARICA Client RSA Root CA 2021
  + HARICA TLS ECC Root CA 2021
  + HARICA TLS RSA Root CA 2021
  + TunTrust Root CA</changelog>
  <changelog author="meissner@suse.com" date="1651492800">- Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079)
  Added:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - D-TRUST BR Root CA 1 2020
  - D-TRUST EV Root CA 1 2020
  - GlobalSign ECC Root CA R4
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4
  - HiPKI Root CA - G1
  - ISRG Root X2
  - Telia Root CA v2
  - vTrus ECC Root CA
  - vTrus Root CA
  Removed:
  - Cybertrust Global Root
  - DST Root CA X3
  - DigiNotar PKIoverheid CA Organisatie - G2
  - GlobalSign ECC Root CA R4
  - GlobalSign Root CA R2
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4</changelog>
  <changelog author="meissner@suse.com" date="1661774400">- Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868)
  Added:
  - Certainly Root E1
  - Certainly Root R1
  - DigiCert SMIME ECC P384 Root G5
  - DigiCert SMIME RSA4096 Root G5
  - DigiCert TLS ECC P384 Root G5
  - DigiCert TLS RSA4096 Root G5
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  Removed:
  - Hellenic Academic and Research Institutions RootCA 2011</changelog>
  <changelog author="meissner@suse.com" date="1671710400">- Updated to 2.60 state of Mozilla SSL root CAs (bsc#1206622)
  Removed CAs:
  - Global Chambersign Root
  - EC-ACC
  - Network Solutions Certificate Authority
  - Staat der Nederlanden EV Root CA
  - SwissSign Platinum CA - G2
  Added CAs:
  - DIGITALSIGN GLOBAL ROOT ECDSA CA
  - DIGITALSIGN GLOBAL ROOT RSA CA
  - Security Communication ECC RootCA1
  - Security Communication RootCA3
  Changed trust:
  - TrustCor certificates only trusted up to Nov 30 (bsc#1206212)
- Removed CAs (bsc#1206212) as most code does not handle "valid before nov 30 2022"
  and it is not clear how many certs were issued for SSL middleware by TrustCor:
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - TrustCor ECA-1
  Patch: remove-trustcor.patch</changelog>
</package>
<package pkgid="e443545e1b737dfc61c141218e2b502ebcee3b14081e0449ecf61787a00ea01a" name="ca-certificates-mozilla" arch="src">
  <version epoch="0" ver="2.60" rel="150200.27.1"/>
  <changelog author="meissner@suse.com" date="1485259200">- updated to 2.11 state of the Mozilla NSS Certificate store.
- removed CAs:
  - Buypass_Class_2_CA_1:2.1.1.crt
    serverAuth
  - EBG_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?:2.8.76.175.115.66.28.142.116.2.crt
    codeSigning emailProtection serverAuth
  - Equifax_Secure_CA:2.4.53.222.244.207.crt
    emailProtection
  - Equifax_Secure_eBusiness_CA_1:2.1.4.crt
    emailProtection
  - Equifax_Secure_Global_eBusiness_CA:2.1.1.crt
    emailProtection
  - IGC_A:2.5.57.17.69.16.148.crt
    codeSigning emailProtection serverAuth
  - Juur-SK:2.4.59.142.75.252.crt
    codeSigning serverAuth
  - Root_CA_Generalitat_Valenciana:2.4.59.69.229.104.crt
    codeSigning emailProtection serverAuth
  - RSA_Security_2048_v3:2.16.10.1.1.1.0.0.2.124.0.0.0.10.0.0.0.2.crt
    codeSigning emailProtection serverAuth
  - Sonera_Class_1_Root_CA:2.1.36.crt
    emailProtection
  - S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN:2.16.55.25.24.230.83.84.124.26.181.184.203.89.90.219.53.183.crt
    emailProtection
  - Verisign_Class_1_Public_Primary_Certification_Authority:2.16.63.105.30.129.156.240.154.74.243.115.255.185.72.162.228.221.crt
    emailProtection
  - Verisign_Class_2_Public_Primary_Certification_Authority_-_G2:2.17.0.185.47.96.204.136.159.161.122.70.9.184.91.112.108.138.175.crt
    emailProtection
  - Verisign_Class_3_Public_Primary_Certification_Authority:2.16.112.186.228.29.16.217.41.52.182.56.202.123.3.204.186.191.crt
    emailProtection
- added CAs:
  + AC_RAIZ_FNMT-RCM:2.15.93.147.141.48.103.54.200.6.29.26.199.84.132.105.7.crt
    serverAuth
  + Amazon_Root_CA_1:2.19.6.108.159.207.153.191.140.10.57.226.240.120.138.67.230.150.54.91.202.crt
    emailProtection serverAuth
  + Amazon_Root_CA_2:2.19.6.108.159.210.150.53.134.159.10.15.229.134.120.248.91.38.187.138.55.crt
    emailProtection serverAuth
  + Amazon_Root_CA_3:2.19.6.108.159.213.116.151.54.102.63.59.11.154.217.232.158.118.3.242.74.crt
    emailProtection serverAuth
  + Amazon_Root_CA_4:2.19.6.108.159.215.193.187.16.76.41.67.229.113.123.123.44.200.26.193.14.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G1:2.18.17.32.85.131.228.45.62.84.86.133.45.131.55.183.44.220.70.17.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G2:2.18.17.32.217.145.206.174.163.232.197.231.255.233.2.175.207.115.188.85.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + ISRG_Root_X1:2.17.0.130.16.207.176.210.64.227.89.68.99.224.187.99.130.139.0.crt (bsc#1010996)
    serverAuth
  + LuxTrust_Global_Root_2:2.20.10.126.166.223.75.68.158.218.106.36.133.158.230.184.21.211.22.127.187.177.crt
    serverAuth
  + OpenTrust_Root_CA_G1:2.18.17.32.179.144.85.57.125.127.54.109.100.194.167.159.107.99.142.103.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G2:2.18.17.32.161.105.27.191.189.185.189.82.150.143.35.232.72.191.38.17.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G3:2.18.17.32.230.248.76.252.36.176.190.5.64.172.218.131.27.52.96.63.crt
    emailProtection serverAuth
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G4:2.16.33.110.51.165.203.211.136.164.111.41.7.180.39.60.196.216.crt
    emailProtection
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G6:2.16.36.50.117.242.29.47.210.9.51.247.180.106.202.208.243.152.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G4:2.16.52.23.101.18.64.59.183.86.128.45.128.203.121.85.166.30.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G6:2.16.100.130.158.252.55.30.116.93.252.151.255.151.200.177.255.65.crt
    emailProtection
- diff-from-upstream-2.7.patch: removed as we should be able to do
  intermediate root chains now with openssl 1.0.2 and also gnutls 3.5
  is able to do so.</changelog>
  <changelog author="jmatejek@suse.com" date="1508932800">- convert processing script to Python 3
- ensure a stable conversion of UTF8 hex-encoded certificate names
- ensure a stable ordering of trust/distrust bits in headers</changelog>
  <changelog author="meissner@suse.com" date="1516881600">- Updated to 2.22 state of the Mozilla NSS Certificate store (bsc#1071152,
  bsc#1071390, bsc#1010996)
- Removed CAs:
  * ACEDICOM Root
  * AddTrust Public CA Root
  * AddTrust Qualified CA Root
  * ApplicationCA - Japanese Government
  * CA Disig Root R1
  * CA WoSign ECC Root
  * Certification Authority of WoSign G2
  * Certinomis - Autorité Racine
  * China Internet Network Information Center EV Certificates Root
  * CNNIC ROOT
  * Comodo Secure Certificate Services
  * Comodo Trusted Certificate Services
  * ComSign Secured CA
  * DST ACES CA X6
  * GeoTrust Global CA 2
  * StartCom Certification Authority
  * StartCom Certification Authority
  * StartCom Certification Authority G2
  * Swisscom Root CA 1
  * TÜB?TAK UEKAE Kök Sertifika Hizmet Sa?lay?c?s? - Sürüm 3
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s?
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  * UTN USERFirst Hardware Root CA
  * UTN USERFirst Object Root CA
  * VeriSign Class 3 Secure Server CA - G2
  * WellsSecure Public Root Certificate Authority
  * Certification Authority of WoSign
  * WoSign China
- Added CAs:
  * D-TRUST Root CA 3 2013
  * GDCA TrustAUTH R5 ROOT
  * SSL.com EV Root Certification Authority ECC
  * SSL.com EV Root Certification Authority RSA R2
  * SSL.com Root Certification Authority ECC
  * SSL.com Root Certification Authority RSA
  * TrustCor RootCert CA-1
  * TrustCor RootCert CA-2
  * TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1612872000">- Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994)
- Added new root CAs:
  - NAVER Global Root Certification Authority
- Removed old root CA:
  - GeoTrust Global CA
  - GeoTrust Primary Certification Authority
  - GeoTrust Primary Certification Authority - G3
  - GeoTrust Universal CA
  - GeoTrust Universal CA 2
  - thawte Primary Root CA
  - thawte Primary Root CA - G2
  - thawte Primary Root CA - G3
  - VeriSign Class 3 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G5</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
  <changelog author="meissner@suse.com" date="1633176000">- updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006)
- Added CAs:
  + HARICA Client ECC Root CA 2021
  + HARICA Client RSA Root CA 2021
  + HARICA TLS ECC Root CA 2021
  + HARICA TLS RSA Root CA 2021
  + TunTrust Root CA</changelog>
  <changelog author="meissner@suse.com" date="1651492800">- Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079)
  Added:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - D-TRUST BR Root CA 1 2020
  - D-TRUST EV Root CA 1 2020
  - GlobalSign ECC Root CA R4
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4
  - HiPKI Root CA - G1
  - ISRG Root X2
  - Telia Root CA v2
  - vTrus ECC Root CA
  - vTrus Root CA
  Removed:
  - Cybertrust Global Root
  - DST Root CA X3
  - DigiNotar PKIoverheid CA Organisatie - G2
  - GlobalSign ECC Root CA R4
  - GlobalSign Root CA R2
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4</changelog>
  <changelog author="meissner@suse.com" date="1661774400">- Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868)
  Added:
  - Certainly Root E1
  - Certainly Root R1
  - DigiCert SMIME ECC P384 Root G5
  - DigiCert SMIME RSA4096 Root G5
  - DigiCert TLS ECC P384 Root G5
  - DigiCert TLS RSA4096 Root G5
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  Removed:
  - Hellenic Academic and Research Institutions RootCA 2011</changelog>
  <changelog author="meissner@suse.com" date="1671710400">- Updated to 2.60 state of Mozilla SSL root CAs (bsc#1206622)
  Removed CAs:
  - Global Chambersign Root
  - EC-ACC
  - Network Solutions Certificate Authority
  - Staat der Nederlanden EV Root CA
  - SwissSign Platinum CA - G2
  Added CAs:
  - DIGITALSIGN GLOBAL ROOT ECDSA CA
  - DIGITALSIGN GLOBAL ROOT RSA CA
  - Security Communication ECC RootCA1
  - Security Communication RootCA3
  Changed trust:
  - TrustCor certificates only trusted up to Nov 30 (bsc#1206212)
- Removed CAs (bsc#1206212) as most code does not handle "valid before nov 30 2022"
  and it is not clear how many certs were issued for SSL middleware by TrustCor:
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - TrustCor ECA-1
  Patch: remove-trustcor.patch</changelog>
</package>
<package pkgid="c7b63d6691edeff1dd175e6089ec209110771b1128e3b3faaad47dfc7106e30f" name="catatonit" arch="aarch64">
  <version epoch="0" ver="0.1.7" rel="150300.10.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
</package>
<package pkgid="6c4ffab7027536bd5200c9c8e2a8477dffc138b394d1b64c7005aa083b2b75e4" name="catatonit" arch="src">
  <version epoch="0" ver="0.1.7" rel="150300.10.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
</package>
<package pkgid="ab99ecde9e7f52964b286751593a567884a82014a5a5522b9a5690cffd1b4189" name="catatonit" arch="x86_64">
  <version epoch="0" ver="0.1.7" rel="150300.10.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
</package>
<package pkgid="38d675c4421a02c20e5e9a84831a8fa7e562572329aabbcb1901ac230a18d909" name="ceph" arch="src">
  <version epoch="0" ver="16.2.11.58+g38d6afd3b78" rel="150400.3.6.1"/>
  <changelog author="ncutler@suse.com" date="1636113600">- Update to 16.2.6-462-g5fefbbf8888:
  + rebased on top of upstream commit SHA1 dd7139c66c1d36da50475ec97d8d6b54b07d1dea
  * (bsc#1191751) rgw/tracing: unify SO version numbers within librgw2 package
  * spec: make selinux scriptlets respect CEPH_AUTO_RESTART_ON_UPGRADE</changelog>
  <changelog author="ncutler@suse.com" date="1636545600">- Preservation of Bugzilla, Jira and CVE citations from earlier incarnations of
  this changes file after double-checking that none of these fixes got lost in
  the pacific rebase:
  + bsc#1163764 (--container-init feature cherry-picked to octopus)
  + bsc#1170200 (mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically)
  + bsc#1172926 (mgr/orchestrator: Sort 'ceph orch device ls' by host)
  + bsc#1173079 (mgr/devicehealth: device_health_metrics pool gets created even without any OSDs in the cluster)
  + bsc#1174466 (mon: have 'mon stat' output json as well)
  + bsc#1174526 (mgr/dashboard: allow getting fresh inventory data from the orchestrator)
  + bsc#1174529 (rpm: on SUSE, podman is required for cephadm to work)
  + bsc#1174644 (cephadm: log to file)
  + bsc#1175120 (downstream branding)
  + bsc#1175161 (downstream branding)
  + bsc#1175169 (downstream branding)
  + bsc#1176390 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176451 (Drop patch "rpm: on SUSE, podman is required for cephadm to work")
  + bsc#1176489 (mgr/cephadm: lock multithreaded access to OSDRemovalQueue)
  + bsc#1176499 (mgr/cephadm: fix RemoveUtil.load_from_store())
  + bsc#1176638 (ceph-volume: batch: call the right prepare method)
  + bsc#1176679 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176828 (cephadm: command_unit: call systemctl with verbose=True)
  + bsc#1177078 (mgr/dashboard: Fix bugs in a unit test and i18n translation)
  + bsc#1177151 (python-common: do not skip unavailable devices)
  + bsc#1177319 (--container-init feature cherry-picked to octopus)
  + bsc#1177344 (mgr/dashboard: support Orchestrator and user-defined Ganesha cluster)
  + bsc#1177360 (cephadm: silence "Failed to evict container" log msg)
  + bsc#1177450 (ceph-volume: don't exit before empty report can be printed)
  + bsc#1177643 (Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse")
  + bsc#1177676 (cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files)
  + bsc#1177843 (CVE-2020-25660)
  + bsc#1177857 (mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails)
  + bsc#1177933 (cephadm: configure journald as the logdriver)
  + bsc#1178531 (cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph)
  + bsc#1178837 (rgw: cls/user: set from_index for reset stats calls)
  + bsc#1178860 (mgr/dashboard: Disable TLS 1.0 and 1.1)
  + bsc#1178905 (CVE-2020-25678)
  + bsc#1178932 (cephadm: reference the last local image by digest)
  + bsc#1179016 (rpm: require smartmontools on SUSE)
  + bsc#1179452 (mgr/insights: Test environment requires 'six')
  + bsc#1179526 (rgw: during GC defer, prevent new GC enqueue)
  + bsc#1179569 (cephadm: reference the last local image by digest)
  + bsc#1179802 (CVE-2020-27781)
  + bsc#1179997 (CVE-2020-27839)
  + bsc#1180107 (ceph-volume: pass --filter-for-batch from drive-group subcommand)
  + bsc#1180155 (CVE-2020-27781)
  + bsc#1181291 (mgr/cephadm: alias rgw-nfs -&gt; nfs)
  + bsc#1182766 (cephadm: fix 'inspect' and 'pull')
  + bsc#1183074 (CVE-2021-20288)
  + bsc#1183561 (mgr/cephadm: on ssh connection error, advice chmod 0600)
  + bsc#1183899 (bluestore: fix huge reads/writes at BlueFS)
  + bsc#1184231 (cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections)
  + bsc#1184517 (cls/rgw: look for plane entries in non-ascii plain namespace too)
  + bsc#1185246 (rgw: check object locks in multi-object delete)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1186020 (CVE-2021-3531)
  + bsc#1186021 (CVE-2021-3509)
  + bsc#1186348 (mgr/zabbix: adapt zabbix_sender default path)
  + bsc#1188979 ("mgr/cephadm: pass --container-init to "cephadm deploy" if specified" and "Revert "cephadm: default container_init to False")
  + bsc#1189173 (downstream branding)
  + jsc#SES-1071 (ceph-volume: major batch refactor - upstream PR#34740)
  + jsc#SES-185 (SES support with cache software)
  + jsc#SES-704 (mgr/snap_schedule)</changelog>
  <changelog author="ncutler@suse.com" date="1637582400">- Update to 16.2.6-463-g22e7612f9ad:
  + (bsc#1178073) mgr/dashboard: fix downstream NFS doc links</changelog>
  <changelog author="stefen.allen@suse.com" date="1641816000">- Update to 16.2.7-37-gb3be69440db:
  + (bsc#1194353) Downstream branding breaks dashboard npm build
  + (bsc#1188911) OSD marked down causes wrong backfill_toofull</changelog>
  <changelog author="stefen.allen@suse.com" date="1646395200">- Update to 16.2.7-577-g3e3603b5dd1
  + Update prometheus-server version</changelog>
  <changelog author="stefen.allen@suse.com" date="1646740800">- Update to 16.2.7-596-g7d574789716
  + Update Prometheus Container image paths (pr #459)
  + mgr/dashboard: Fix documentation URL (pr #456)
  + mgr/dashboard: Adapt downstream branded navigation page (pr #454)</changelog>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
</package>
<package pkgid="642bbf709f4fab9cd2d20a531d5d4ccb7a08f97c5ae6f2b36d52997ca9080e82" name="cloud-netconfig-azure" arch="noarch">
  <version epoch="0" ver="1.7" rel="150000.25.8.1"/>
  <changelog author="jgleissner@suse.com" date="1507636800">- Update to version 0.4:
  Do not touch VF interfaces in Azure (bsc#1055553)
- Prepare for SLE submission (FATE#323820, bsc#1027212)</changelog>
  <changelog author="rjschwei@suse.com" date="1507723200">- Update to version 0.5
  + New API version for Azure metadata server
  + Wait for the metadata server in EC2</changelog>
  <changelog author="jgleissner@suse.com" date="1507896000">- Update to version 0.6:
  + Use tested and supported metadata API versions</changelog>
  <changelog author="jgleissner@suse.com" date="1507896001">- Prepare for SLE11 submission (bsc#1063292)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1510228800">- Add missing Provides/Conflicts statements to spec file</changelog>
  <changelog author="jgleissner@suse.com" date="1515758400">- Remove dependency on udev-persistent-ifnames (bsc#1075484)</changelog>
  <changelog author="jgleissner@suse.com" date="1516190400">- Added dependency on curl
- Use otherproviders() only on SLES 11 builds</changelog>
  <changelog author="jgleissner@suse.com" date="1527854400">- Update to version 0.7:
  + no persistent interface names in Azure (bsc#1095485)</changelog>
  <changelog author="jgleissner@suse.com" date="1548936000">- Update to version 0.9:
  + run cloud-netconfig periodically (bsc#1118783 bsc#1122013)
  + do not treat eth0 special wrt routing policies (bsc#1123008)
  + reduce timeout on metadata read (bsc#1112822)</changelog>
  <changelog author="jgleissner@suse.com" date="1558008000">- Update to version 1.0:
  + pause and retry if API call throttling is detected in Azure
    (bsc#1135257 bsc#1135263)</changelog>
  <changelog author="jgleissner@suse.com" date="1574337600">- Update to version 1.1
  + fix use of GATEWAY variable (bsc#1157117, bsc#1157190)
  + remove secondary IPv4 address only when added by cloud-netconfig
    (bsc#1144282)
  + simplify routing setup for single NIC systems (partly fixes
    bsc#1135592)</changelog>
  <changelog author="jgleissner@suse.com" date="1574769600">- Update to version 1.2:
  + support AWS IMDSv2 token</changelog>
  <changelog author="jgleissner@suse.com" date="1574769601">- Update to version 1.3:
  + Fix IPv4 address handling on secondary NICs in Azure</changelog>
  <changelog author="jgleissner@suse.com" date="1574942400">- Removed obsolete Group tag from spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="jgleissner@suse.com" date="1580817600">- Update to version 1.4:
  + copy routes from default routing table (bsc#1162705, bsc#1162707)
  + make CLOUD_NETCONFIG_MANAGE default configurable</changelog>
  <changelog author="jgleissner@suse.com" date="1604577600">- Update to version 1.5:
  + Add support for GCE (bsc#1159460, bsc#1178486)
  + Improve default gateway determination</changelog>
  <changelog author="jgleissner@suse.com" date="1630065600">- Update to version 1.6:
  + Ignore proxy when accessing metadata (bsc#1187939)
  + Print warning in case metadata is not accessible
  + Documentation update</changelog>
  <changelog author="suse-beta@cboltz.de" date="1663502400">- /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in
  Tumbleweed, update path (poo#116221)</changelog>
  <changelog author="jgleissner@suse.com" date="1671192000">- Update to version 1.7:
  + Overhaul policy routing setup (issue #19)
  + Support alias IPv4 ranges (issue #14)
  + Add support for NetworkManager (bsc#1204549)
  + Remove dependency on netconfig
  + Install into libexec directory
  + Clear stale ifcfg files for accelerated NICs (bsc#1199853)
  + More debug messages
  + Documentation update</changelog>
</package>
<package pkgid="2e5776465308c22866c8dfff728f40cd7e3765c8f010e5ec4e56318bbf49d29a" name="cloud-netconfig-azure" arch="src">
  <version epoch="0" ver="1.7" rel="150000.25.8.1"/>
  <changelog author="jgleissner@suse.com" date="1507636800">- Update to version 0.4:
  Do not touch VF interfaces in Azure (bsc#1055553)
- Prepare for SLE submission (FATE#323820, bsc#1027212)</changelog>
  <changelog author="rjschwei@suse.com" date="1507723200">- Update to version 0.5
  + New API version for Azure metadata server
  + Wait for the metadata server in EC2</changelog>
  <changelog author="jgleissner@suse.com" date="1507896000">- Update to version 0.6:
  + Use tested and supported metadata API versions</changelog>
  <changelog author="jgleissner@suse.com" date="1507896001">- Prepare for SLE11 submission (bsc#1063292)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1510228800">- Add missing Provides/Conflicts statements to spec file</changelog>
  <changelog author="jgleissner@suse.com" date="1515758400">- Remove dependency on udev-persistent-ifnames (bsc#1075484)</changelog>
  <changelog author="jgleissner@suse.com" date="1516190400">- Added dependency on curl
- Use otherproviders() only on SLES 11 builds</changelog>
  <changelog author="jgleissner@suse.com" date="1527854400">- Update to version 0.7:
  + no persistent interface names in Azure (bsc#1095485)</changelog>
  <changelog author="jgleissner@suse.com" date="1548936000">- Update to version 0.9:
  + run cloud-netconfig periodically (bsc#1118783 bsc#1122013)
  + do not treat eth0 special wrt routing policies (bsc#1123008)
  + reduce timeout on metadata read (bsc#1112822)</changelog>
  <changelog author="jgleissner@suse.com" date="1558008000">- Update to version 1.0:
  + pause and retry if API call throttling is detected in Azure
    (bsc#1135257 bsc#1135263)</changelog>
  <changelog author="jgleissner@suse.com" date="1574337600">- Update to version 1.1
  + fix use of GATEWAY variable (bsc#1157117, bsc#1157190)
  + remove secondary IPv4 address only when added by cloud-netconfig
    (bsc#1144282)
  + simplify routing setup for single NIC systems (partly fixes
    bsc#1135592)</changelog>
  <changelog author="jgleissner@suse.com" date="1574769600">- Update to version 1.2:
  + support AWS IMDSv2 token</changelog>
  <changelog author="jgleissner@suse.com" date="1574769601">- Update to version 1.3:
  + Fix IPv4 address handling on secondary NICs in Azure</changelog>
  <changelog author="jgleissner@suse.com" date="1574942400">- Removed obsolete Group tag from spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="jgleissner@suse.com" date="1580817600">- Update to version 1.4:
  + copy routes from default routing table (bsc#1162705, bsc#1162707)
  + make CLOUD_NETCONFIG_MANAGE default configurable</changelog>
  <changelog author="jgleissner@suse.com" date="1604577600">- Update to version 1.5:
  + Add support for GCE (bsc#1159460, bsc#1178486)
  + Improve default gateway determination</changelog>
  <changelog author="jgleissner@suse.com" date="1630065600">- Update to version 1.6:
  + Ignore proxy when accessing metadata (bsc#1187939)
  + Print warning in case metadata is not accessible
  + Documentation update</changelog>
  <changelog author="suse-beta@cboltz.de" date="1663502400">- /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in
  Tumbleweed, update path (poo#116221)</changelog>
  <changelog author="jgleissner@suse.com" date="1671192000">- Update to version 1.7:
  + Overhaul policy routing setup (issue #19)
  + Support alias IPv4 ranges (issue #14)
  + Add support for NetworkManager (bsc#1204549)
  + Remove dependency on netconfig
  + Install into libexec directory
  + Clear stale ifcfg files for accelerated NICs (bsc#1199853)
  + More debug messages
  + Documentation update</changelog>
</package>
<package pkgid="3b6614955ba1a3ff5bac523d175db8e87e0c5ddf86f734aa007d17c9a93ffa31" name="cloud-netconfig-ec2" arch="noarch">
  <version epoch="0" ver="1.7" rel="150000.25.8.1"/>
  <changelog author="jgleissner@suse.com" date="1507636800">- Update to version 0.4:
  Do not touch VF interfaces in Azure (bsc#1055553)
- Prepare for SLE submission (FATE#323820, bsc#1027212)</changelog>
  <changelog author="rjschwei@suse.com" date="1507723200">- Update to version 0.5
  + New API version for Azure metadata server
  + Wait for the metadata server in EC2</changelog>
  <changelog author="jgleissner@suse.com" date="1507896000">- Update to version 0.6:
  + Use tested and supported metadata API versions</changelog>
  <changelog author="jgleissner@suse.com" date="1507896001">- Prepare for SLE11 submission (bsc#1063292)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1510228800">- Add missing Provides/Conflicts statements to spec file</changelog>
  <changelog author="jgleissner@suse.com" date="1515758400">- Remove dependency on udev-persistent-ifnames (bsc#1075484)</changelog>
  <changelog author="jgleissner@suse.com" date="1516190400">- Added dependency on curl
- Use otherproviders() only on SLES 11 builds</changelog>
  <changelog author="jgleissner@suse.com" date="1527854400">- Update to version 0.7:
  + no persistent interface names in Azure (bsc#1095485)</changelog>
  <changelog author="jgleissner@suse.com" date="1548936000">- Update to version 0.9:
  + run cloud-netconfig periodically (bsc#1118783 bsc#1122013)
  + do not treat eth0 special wrt routing policies (bsc#1123008)
  + reduce timeout on metadata read (bsc#1112822)</changelog>
  <changelog author="jgleissner@suse.com" date="1558008000">- Update to version 1.0:
  + pause and retry if API call throttling is detected in Azure
    (bsc#1135257 bsc#1135263)</changelog>
  <changelog author="jgleissner@suse.com" date="1574337600">- Update to version 1.1
  + fix use of GATEWAY variable (bsc#1157117, bsc#1157190)
  + remove secondary IPv4 address only when added by cloud-netconfig
    (bsc#1144282)
  + simplify routing setup for single NIC systems (partly fixes
    bsc#1135592)</changelog>
  <changelog author="jgleissner@suse.com" date="1574769600">- Update to version 1.2:
  + support AWS IMDSv2 token</changelog>
  <changelog author="jgleissner@suse.com" date="1574769601">- Update to version 1.3:
  + Fix IPv4 address handling on secondary NICs in Azure</changelog>
  <changelog author="jgleissner@suse.com" date="1574942400">- Removed obsolete Group tag from spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="jgleissner@suse.com" date="1580817600">- Update to version 1.4:
  + copy routes from default routing table (bsc#1162705, bsc#1162707)
  + make CLOUD_NETCONFIG_MANAGE default configurable</changelog>
  <changelog author="jgleissner@suse.com" date="1604577600">- Update to version 1.5:
  + Add support for GCE (bsc#1159460, bsc#1178486)
  + Improve default gateway determination</changelog>
  <changelog author="jgleissner@suse.com" date="1630065600">- Update to version 1.6:
  + Ignore proxy when accessing metadata (bsc#1187939)
  + Print warning in case metadata is not accessible
  + Documentation update</changelog>
  <changelog author="suse-beta@cboltz.de" date="1663502400">- /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in
  Tumbleweed, update path (poo#116221)</changelog>
  <changelog author="jgleissner@suse.com" date="1671192000">- Update to version 1.7:
  + Overhaul policy routing setup (issue #19)
  + Support alias IPv4 ranges (issue #14)
  + Add support for NetworkManager (bsc#1204549)
  + Remove dependency on netconfig
  + Install into libexec directory
  + Clear stale ifcfg files for accelerated NICs (bsc#1199853)
  + More debug messages
  + Documentation update</changelog>
</package>
<package pkgid="9da208928adb8feb399e9306f12693f036df98d8549fb7b54bdf412e47f4851e" name="cloud-netconfig-ec2" arch="src">
  <version epoch="0" ver="1.7" rel="150000.25.8.1"/>
  <changelog author="jgleissner@suse.com" date="1507636800">- Update to version 0.4:
  Do not touch VF interfaces in Azure (bsc#1055553)
- Prepare for SLE submission (FATE#323820, bsc#1027212)</changelog>
  <changelog author="rjschwei@suse.com" date="1507723200">- Update to version 0.5
  + New API version for Azure metadata server
  + Wait for the metadata server in EC2</changelog>
  <changelog author="jgleissner@suse.com" date="1507896000">- Update to version 0.6:
  + Use tested and supported metadata API versions</changelog>
  <changelog author="jgleissner@suse.com" date="1507896001">- Prepare for SLE11 submission (bsc#1063292)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1510228800">- Add missing Provides/Conflicts statements to spec file</changelog>
  <changelog author="jgleissner@suse.com" date="1515758400">- Remove dependency on udev-persistent-ifnames (bsc#1075484)</changelog>
  <changelog author="jgleissner@suse.com" date="1516190400">- Added dependency on curl
- Use otherproviders() only on SLES 11 builds</changelog>
  <changelog author="jgleissner@suse.com" date="1527854400">- Update to version 0.7:
  + no persistent interface names in Azure (bsc#1095485)</changelog>
  <changelog author="jgleissner@suse.com" date="1548936000">- Update to version 0.9:
  + run cloud-netconfig periodically (bsc#1118783 bsc#1122013)
  + do not treat eth0 special wrt routing policies (bsc#1123008)
  + reduce timeout on metadata read (bsc#1112822)</changelog>
  <changelog author="jgleissner@suse.com" date="1558008000">- Update to version 1.0:
  + pause and retry if API call throttling is detected in Azure
    (bsc#1135257 bsc#1135263)</changelog>
  <changelog author="jgleissner@suse.com" date="1574337600">- Update to version 1.1
  + fix use of GATEWAY variable (bsc#1157117, bsc#1157190)
  + remove secondary IPv4 address only when added by cloud-netconfig
    (bsc#1144282)
  + simplify routing setup for single NIC systems (partly fixes
    bsc#1135592)</changelog>
  <changelog author="jgleissner@suse.com" date="1574769600">- Update to version 1.2:
  + support AWS IMDSv2 token</changelog>
  <changelog author="jgleissner@suse.com" date="1574769601">- Update to version 1.3:
  + Fix IPv4 address handling on secondary NICs in Azure</changelog>
  <changelog author="jgleissner@suse.com" date="1574942400">- Removed obsolete Group tag from spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="jgleissner@suse.com" date="1580817600">- Update to version 1.4:
  + copy routes from default routing table (bsc#1162705, bsc#1162707)
  + make CLOUD_NETCONFIG_MANAGE default configurable</changelog>
  <changelog author="jgleissner@suse.com" date="1604577600">- Update to version 1.5:
  + Add support for GCE (bsc#1159460, bsc#1178486)
  + Improve default gateway determination</changelog>
  <changelog author="jgleissner@suse.com" date="1630065600">- Update to version 1.6:
  + Ignore proxy when accessing metadata (bsc#1187939)
  + Print warning in case metadata is not accessible
  + Documentation update</changelog>
  <changelog author="suse-beta@cboltz.de" date="1663502400">- /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in
  Tumbleweed, update path (poo#116221)</changelog>
  <changelog author="jgleissner@suse.com" date="1671192000">- Update to version 1.7:
  + Overhaul policy routing setup (issue #19)
  + Support alias IPv4 ranges (issue #14)
  + Add support for NetworkManager (bsc#1204549)
  + Remove dependency on netconfig
  + Install into libexec directory
  + Clear stale ifcfg files for accelerated NICs (bsc#1199853)
  + More debug messages
  + Documentation update</changelog>
</package>
<package pkgid="0da5948d2c61c55e5da62261227ba62bec64153352e27a25ddc4ae6c46157368" name="cloud-netconfig-gce" arch="noarch">
  <version epoch="0" ver="1.7" rel="150000.25.8.1"/>
  <changelog author="jgleissner@suse.com" date="1507636800">- Update to version 0.4:
  Do not touch VF interfaces in Azure (bsc#1055553)
- Prepare for SLE submission (FATE#323820, bsc#1027212)</changelog>
  <changelog author="rjschwei@suse.com" date="1507723200">- Update to version 0.5
  + New API version for Azure metadata server
  + Wait for the metadata server in EC2</changelog>
  <changelog author="jgleissner@suse.com" date="1507896000">- Update to version 0.6:
  + Use tested and supported metadata API versions</changelog>
  <changelog author="jgleissner@suse.com" date="1507896001">- Prepare for SLE11 submission (bsc#1063292)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1510228800">- Add missing Provides/Conflicts statements to spec file</changelog>
  <changelog author="jgleissner@suse.com" date="1515758400">- Remove dependency on udev-persistent-ifnames (bsc#1075484)</changelog>
  <changelog author="jgleissner@suse.com" date="1516190400">- Added dependency on curl
- Use otherproviders() only on SLES 11 builds</changelog>
  <changelog author="jgleissner@suse.com" date="1527854400">- Update to version 0.7:
  + no persistent interface names in Azure (bsc#1095485)</changelog>
  <changelog author="jgleissner@suse.com" date="1548936000">- Update to version 0.9:
  + run cloud-netconfig periodically (bsc#1118783 bsc#1122013)
  + do not treat eth0 special wrt routing policies (bsc#1123008)
  + reduce timeout on metadata read (bsc#1112822)</changelog>
  <changelog author="jgleissner@suse.com" date="1558008000">- Update to version 1.0:
  + pause and retry if API call throttling is detected in Azure
    (bsc#1135257 bsc#1135263)</changelog>
  <changelog author="jgleissner@suse.com" date="1574337600">- Update to version 1.1
  + fix use of GATEWAY variable (bsc#1157117, bsc#1157190)
  + remove secondary IPv4 address only when added by cloud-netconfig
    (bsc#1144282)
  + simplify routing setup for single NIC systems (partly fixes
    bsc#1135592)</changelog>
  <changelog author="jgleissner@suse.com" date="1574769600">- Update to version 1.2:
  + support AWS IMDSv2 token</changelog>
  <changelog author="jgleissner@suse.com" date="1574769601">- Update to version 1.3:
  + Fix IPv4 address handling on secondary NICs in Azure</changelog>
  <changelog author="jgleissner@suse.com" date="1574942400">- Removed obsolete Group tag from spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="jgleissner@suse.com" date="1580817600">- Update to version 1.4:
  + copy routes from default routing table (bsc#1162705, bsc#1162707)
  + make CLOUD_NETCONFIG_MANAGE default configurable</changelog>
  <changelog author="jgleissner@suse.com" date="1604577600">- Update to version 1.5:
  + Add support for GCE (bsc#1159460, bsc#1178486)
  + Improve default gateway determination</changelog>
  <changelog author="jgleissner@suse.com" date="1630065600">- Update to version 1.6:
  + Ignore proxy when accessing metadata (bsc#1187939)
  + Print warning in case metadata is not accessible
  + Documentation update</changelog>
  <changelog author="suse-beta@cboltz.de" date="1663502400">- /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in
  Tumbleweed, update path (poo#116221)</changelog>
  <changelog author="jgleissner@suse.com" date="1671192000">- Update to version 1.7:
  + Overhaul policy routing setup (issue #19)
  + Support alias IPv4 ranges (issue #14)
  + Add support for NetworkManager (bsc#1204549)
  + Remove dependency on netconfig
  + Install into libexec directory
  + Clear stale ifcfg files for accelerated NICs (bsc#1199853)
  + More debug messages
  + Documentation update</changelog>
</package>
<package pkgid="684b414ee3eecc09331c2eb97925f3d412c95f8184b06dd2b3b75dbd9463b3a3" name="cloud-netconfig-gce" arch="src">
  <version epoch="0" ver="1.7" rel="150000.25.8.1"/>
  <changelog author="jgleissner@suse.com" date="1507636800">- Update to version 0.4:
  Do not touch VF interfaces in Azure (bsc#1055553)
- Prepare for SLE submission (FATE#323820, bsc#1027212)</changelog>
  <changelog author="rjschwei@suse.com" date="1507723200">- Update to version 0.5
  + New API version for Azure metadata server
  + Wait for the metadata server in EC2</changelog>
  <changelog author="jgleissner@suse.com" date="1507896000">- Update to version 0.6:
  + Use tested and supported metadata API versions</changelog>
  <changelog author="jgleissner@suse.com" date="1507896001">- Prepare for SLE11 submission (bsc#1063292)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1510228800">- Add missing Provides/Conflicts statements to spec file</changelog>
  <changelog author="jgleissner@suse.com" date="1515758400">- Remove dependency on udev-persistent-ifnames (bsc#1075484)</changelog>
  <changelog author="jgleissner@suse.com" date="1516190400">- Added dependency on curl
- Use otherproviders() only on SLES 11 builds</changelog>
  <changelog author="jgleissner@suse.com" date="1527854400">- Update to version 0.7:
  + no persistent interface names in Azure (bsc#1095485)</changelog>
  <changelog author="jgleissner@suse.com" date="1548936000">- Update to version 0.9:
  + run cloud-netconfig periodically (bsc#1118783 bsc#1122013)
  + do not treat eth0 special wrt routing policies (bsc#1123008)
  + reduce timeout on metadata read (bsc#1112822)</changelog>
  <changelog author="jgleissner@suse.com" date="1558008000">- Update to version 1.0:
  + pause and retry if API call throttling is detected in Azure
    (bsc#1135257 bsc#1135263)</changelog>
  <changelog author="jgleissner@suse.com" date="1574337600">- Update to version 1.1
  + fix use of GATEWAY variable (bsc#1157117, bsc#1157190)
  + remove secondary IPv4 address only when added by cloud-netconfig
    (bsc#1144282)
  + simplify routing setup for single NIC systems (partly fixes
    bsc#1135592)</changelog>
  <changelog author="jgleissner@suse.com" date="1574769600">- Update to version 1.2:
  + support AWS IMDSv2 token</changelog>
  <changelog author="jgleissner@suse.com" date="1574769601">- Update to version 1.3:
  + Fix IPv4 address handling on secondary NICs in Azure</changelog>
  <changelog author="jgleissner@suse.com" date="1574942400">- Removed obsolete Group tag from spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="jgleissner@suse.com" date="1580817600">- Update to version 1.4:
  + copy routes from default routing table (bsc#1162705, bsc#1162707)
  + make CLOUD_NETCONFIG_MANAGE default configurable</changelog>
  <changelog author="jgleissner@suse.com" date="1604577600">- Update to version 1.5:
  + Add support for GCE (bsc#1159460, bsc#1178486)
  + Improve default gateway determination</changelog>
  <changelog author="jgleissner@suse.com" date="1630065600">- Update to version 1.6:
  + Ignore proxy when accessing metadata (bsc#1187939)
  + Print warning in case metadata is not accessible
  + Documentation update</changelog>
  <changelog author="suse-beta@cboltz.de" date="1663502400">- /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in
  Tumbleweed, update path (poo#116221)</changelog>
  <changelog author="jgleissner@suse.com" date="1671192000">- Update to version 1.7:
  + Overhaul policy routing setup (issue #19)
  + Support alias IPv4 ranges (issue #14)
  + Add support for NetworkManager (bsc#1204549)
  + Remove dependency on netconfig
  + Install into libexec directory
  + Clear stale ifcfg files for accelerated NICs (bsc#1199853)
  + More debug messages
  + Documentation update</changelog>
</package>
<package pkgid="3611f30c4ff67205365a0e442e3dc48d35f3cc79abbb3303126ca41104694152" name="cloud-regionsrv-client" arch="noarch">
  <version epoch="0" ver="10.0.7" rel="150000.6.83.2"/>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
</package>
<package pkgid="aa8e824f53e81f76f5661fb475696fff25a3d61284eef6bc227101e299aab242" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="10.0.7" rel="150000.6.83.2"/>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
</package>
<package pkgid="f6c8b6f8a222947d51b30216e578a769f04816847e7d5ef671874143b9db144f" name="cloud-regionsrv-client" arch="noarch">
  <version epoch="0" ver="10.0.8" rel="150000.6.86.1"/>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
</package>
<package pkgid="10af239fad2936f76b29ca3b2740fa2639eb83fead92bc74fa8dd3bd0dd37759" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="10.0.8" rel="150000.6.86.1"/>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
</package>
<package pkgid="fb347f2b3dc68c213e654d8ceb2509f9ab6b901bc53b66d012c9c422edaad719" name="cloud-regionsrv-client-addon-azure" arch="noarch">
  <version epoch="0" ver="1.0.5" rel="150000.6.83.2"/>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
</package>
<package pkgid="80a8b9bd26e0cb606d7980c5e68ce37f4b2650175ac76eeea8a6cb0301d50d2c" name="cloud-regionsrv-client-addon-azure" arch="noarch">
  <version epoch="0" ver="1.0.5" rel="150000.6.86.1"/>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
</package>
<package pkgid="a418635c8735d668362c1add632d7fc19da12d2daa93946dd940e992d10f5091" name="cloud-regionsrv-client-generic-config" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150000.6.83.2"/>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
</package>
<package pkgid="1535b45691a180df1b2f840527ea1e2009051c6ff8d63973a1d311d93538e22a" name="cloud-regionsrv-client-generic-config" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150000.6.86.1"/>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
</package>
<package pkgid="d11c5bcd0117ed245f2666fddbcaf565222468a50761808f392e4256538028f6" name="cloud-regionsrv-client-plugin-azure" arch="noarch">
  <version epoch="0" ver="2.0.0" rel="150000.6.83.2"/>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
</package>
<package pkgid="e57c751b8b4a50bbc57a322e7046b7e6bb59b40162fd471d38a6d59629444e22" name="cloud-regionsrv-client-plugin-azure" arch="noarch">
  <version epoch="0" ver="2.0.0" rel="150000.6.86.1"/>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
</package>
<package pkgid="474bfccba2ddb72e57f7e1bb494b0d2a4e441c7ad6351f622ff24f0d1c824fc2" name="cloud-regionsrv-client-plugin-ec2" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150000.6.83.2"/>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
</package>
<package pkgid="3028840de86477a94af2cb26f22381b80b367760f4833ea0e4d54f36937f6430" name="cloud-regionsrv-client-plugin-ec2" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150000.6.86.1"/>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
</package>
<package pkgid="26e0a114e9c37b1015499649c35ae8e87cf9c05d03ddb8ce166c581785e208db" name="cloud-regionsrv-client-plugin-gce" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150000.6.83.2"/>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
</package>
<package pkgid="3065d2bcf6f8063422d3fd2e4e82b692ad30052760b05a894990b44c69d5172e" name="cloud-regionsrv-client-plugin-gce" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150000.6.86.1"/>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
</package>
<package pkgid="53f0e622e7042491c07b856c2615c39967b3a18ae80ddcdbc1145244e7e42d43" name="cni" arch="aarch64">
  <version epoch="0" ver="0.7.1" rel="150100.3.8.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1487851200">- Initial version</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1488369600">- Update to version 0.4.0:
  * plugins/noop: return a helpful message for test authors
  * host-local: trim whitespace from container IDs and disk file contents
  * travis: roll forward the versions of Go that we test
  * MAINTAINERS: hi CaseyC!
  * ipam/host-local: Move allocator and config to backend
  * ipam/host-local: add ResolvConf argument for DNS configuration
  * spec: notice of version</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1490184000">- Update to version 0.5.0:
  * Documentation: Add conventions doc
  * noop: allow specifying debug file in config JSON
  * Spec/Conventions: Update to include plugin config
  * spec: add network configuration list specification
  * api,libcni: add network config list-based plugin chaining
  * Update CONVENTIONS.md
  * skel: adds PluginMainWithError which returns a *types.Error
  * testutils: pass netConf in for version operations; pass raw result out for tests
  * types: make Result an interface and move existing Result to separate package
  * macvlan/ipvlan: use common RenameLink method
  * plugins/flannel: organize test JSON alphabetically
  * pkg/ipam: add testcases
  * spec/plugins: return interface details and multiple IP addresses to runtime
  * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH
  * pkg/utils/sysctl/sysctl_linux.go: fix build tag.
  * pkg/utils/sysctl/sysctl_linux.go: fix typo.
  * invoke: Enable plugin file names with extensions
  * CONVENTIONS.md: Update details on port-mappings
  * Update with feedback
  * More markups
  * spec: Remove `routes` from Network Configuration
  * docs: consolidate host-local documentation
  * pkg/ns: refactored so that builds succeed on non-linux platforms
  * Fix grammar
  * plugins/main/ptp: set the Sandbox property on the response
  * README: List multus as 3rd party plugin
  * Replace Michael Bridgen with Bryan Boreham
  * pkg/ns, pkg/types: refactored non linux build fix code to
  * pkg/ip: refactored so that builds succeed on non-linux platforms
  * vendor: Update vishvanana/netlink dependency
  * libcni: up-convert a Config to a ConfigList when no other configs are found.
  * docs: CNI versioning for 0.3.0 upgrade
  * docs: Edits to v0.3.0 upgrade guidance
  * docs: minor improvements to 0.3.0 upgrade guidance
  * docs: add small upgrade instructions
  * docs: minor improvements to spec-upgrades
  * docs: fill-out and correct version conversion table
  * docs: table formatting is hard
  * pkg/testutils: return errors after restoring stdout
  * pkg/types: misc current types testcase cleanups
  * Minor rewording about default config version
  * spec,libcni: add support for injecting runtimeConfig into plugin stdin data
  * Check n.IPAM before use it in LoadIPAMConfig function
  * do not error if last_reserved_ip is missing for host local ipam
  * add test for ensuring initial subnet creation does not contain an error
  * fix unrelated failing tests</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1490270400">- Update to version 0.5.1:
  * readme.md: Add link to community sync
  * pkg/ip: do not leak types from vendored netlink package
  * pkg/ip: SetupVeth returns net.Interface
  * pkg/ip: improve docstring for SetupVeth
  * Added Romana to list of CNI providers...
  * plugins/meta/flannel: If net config is missing do not return err on DEL
  * plugins/*: Don't error if the device doesn't exist</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1491825600">- Update to version 0.5.2:
  * Rename build script to avoid conflict with bazel
  * Enable s390x build
  * Update community sync detail
  * Added entry for CNI-Genie
  * travis: shift forward to Go 1.8 and 1.7
  * spec/plugins: fix 'ip'-&gt;'ips' in the spec, bump to 0.3.1
  * libcni: Improved error messages.
  * libcni: Fixed tests that were checking error strings.
  * Documentation: Added documentation for `cnitool`.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1503921600">- Update to version 0.6.0:
  * Conventions: add convention around chaining interfaces
  * pkg/types: safer typecasting for TextUnmarshaler when loading args
  * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected
  * Update note about next Community Sync, 2017-06-21
  * types: fix marshalling of omitted "interfaces" key in IPConfig JSON
  * Update and document release process
  * scripts/release.sh: Add in s390x architecture
  * cnitool: add support for CNI_ARGS
  * README plugins list: add Linen CNI plugin</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Remove the dependency with the cni-plugins
- Recommend the cni-plugins</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1516017600">- Make /var/lib/cni writable</changelog>
  <changelog author="kmacinnes@suse.com" date="1516276800">- Add snapper as a requirement, to provide mksubvolume</changelog>
  <changelog author="kmacinnes@suse.com" date="1517227200">- Use full/absolute path for mksubvolume
- Change snapper Requires to a Requires(post)</changelog>
  <changelog author="jmassaguerpla@suse.com" date="1522843200">- Remove creating subvolumes. This should be in another package (kubernetes-kubelet)</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558094400">- Update to version 0.7.0:
  * Spec changes:
    + Use more RFC2119 style language in specification (must, should...)
    + add notes about ADD/DEL ordering
    + Make the container ID required and unique.
    + remove the version parameter from ADD and DEL commands.
    + Network interface name matters
    + be explicit about optional and required structure members
    + add CHECK method
    + Add a well-known error for "try again"
    + SPEC.md: clarify meaning of 'routes'
  * Library changes:
    + pkg/types: Makes IPAM concrete type
    + libcni: return error if Type is empty
    + skel: VERSION shouldn't block on stdin
    + non-pointer instances of types.Route now correctly marshal to JSON
    + libcni: add ValidateNetwork and ValidateNetworkList functions
    + pkg/skel: return error if JSON config has no network name
    + skel: add support for plugin version string
    + libcni: make exec handling an interface for better downstream testing
    + libcni: api now takes a Context to allow operations to be timed out or cancelled
    + types/version: add helper to parse PrevResult
    + skel: only print about message, not errors
    + skel,invoke,libcni: implementation of CHECK method
    + cnitool: Honor interface name supplied via CNI_IFNAME environment variable.
    + cnitool: validate correct number of args
    + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0
    + add PrintTo method to Result interface
    + Return a better error when the plugin returns none
- Install sleep binary into CNI plugin directory
- Restore build.sh script which was removed upstream</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1563278400">- Update to version 0.7.1 (bsc#1160460):
  * Library changes:
    + invoke : ensure custom envs of CNIArgs are prepended to process envs
    + add GetNetworkListCachedResult to CNI interface
    + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance
  * Documentation &amp; Convention changes:
    + Update cnitool documentation for spec v0.4.0
    + Add cni-route-override to CNI plugin list
  * Build and test changes:
    + Release: bump go to v1.12</changelog>
  <changelog author="sgrunert@suse.com" date="1578916800">- Set correct CNI version for 99-loopback.conf</changelog>
  <changelog author="dcermak@suse.com" date="1668686400">- Add patch to fix bsc#1181961 aka CVE-2021-20206
  added 0001-tighten-up-plugin-finding-logic.patch
- disable usage of go modules to fix build failures with go 1.19</changelog>
</package>
<package pkgid="15f3d60315c836738b693d58199b3248b64604e3d082887bcdc6c6b86fd68a63" name="cni" arch="src">
  <version epoch="0" ver="0.7.1" rel="150100.3.8.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1487851200">- Initial version</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1488369600">- Update to version 0.4.0:
  * plugins/noop: return a helpful message for test authors
  * host-local: trim whitespace from container IDs and disk file contents
  * travis: roll forward the versions of Go that we test
  * MAINTAINERS: hi CaseyC!
  * ipam/host-local: Move allocator and config to backend
  * ipam/host-local: add ResolvConf argument for DNS configuration
  * spec: notice of version</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1490184000">- Update to version 0.5.0:
  * Documentation: Add conventions doc
  * noop: allow specifying debug file in config JSON
  * Spec/Conventions: Update to include plugin config
  * spec: add network configuration list specification
  * api,libcni: add network config list-based plugin chaining
  * Update CONVENTIONS.md
  * skel: adds PluginMainWithError which returns a *types.Error
  * testutils: pass netConf in for version operations; pass raw result out for tests
  * types: make Result an interface and move existing Result to separate package
  * macvlan/ipvlan: use common RenameLink method
  * plugins/flannel: organize test JSON alphabetically
  * pkg/ipam: add testcases
  * spec/plugins: return interface details and multiple IP addresses to runtime
  * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH
  * pkg/utils/sysctl/sysctl_linux.go: fix build tag.
  * pkg/utils/sysctl/sysctl_linux.go: fix typo.
  * invoke: Enable plugin file names with extensions
  * CONVENTIONS.md: Update details on port-mappings
  * Update with feedback
  * More markups
  * spec: Remove `routes` from Network Configuration
  * docs: consolidate host-local documentation
  * pkg/ns: refactored so that builds succeed on non-linux platforms
  * Fix grammar
  * plugins/main/ptp: set the Sandbox property on the response
  * README: List multus as 3rd party plugin
  * Replace Michael Bridgen with Bryan Boreham
  * pkg/ns, pkg/types: refactored non linux build fix code to
  * pkg/ip: refactored so that builds succeed on non-linux platforms
  * vendor: Update vishvanana/netlink dependency
  * libcni: up-convert a Config to a ConfigList when no other configs are found.
  * docs: CNI versioning for 0.3.0 upgrade
  * docs: Edits to v0.3.0 upgrade guidance
  * docs: minor improvements to 0.3.0 upgrade guidance
  * docs: add small upgrade instructions
  * docs: minor improvements to spec-upgrades
  * docs: fill-out and correct version conversion table
  * docs: table formatting is hard
  * pkg/testutils: return errors after restoring stdout
  * pkg/types: misc current types testcase cleanups
  * Minor rewording about default config version
  * spec,libcni: add support for injecting runtimeConfig into plugin stdin data
  * Check n.IPAM before use it in LoadIPAMConfig function
  * do not error if last_reserved_ip is missing for host local ipam
  * add test for ensuring initial subnet creation does not contain an error
  * fix unrelated failing tests</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1490270400">- Update to version 0.5.1:
  * readme.md: Add link to community sync
  * pkg/ip: do not leak types from vendored netlink package
  * pkg/ip: SetupVeth returns net.Interface
  * pkg/ip: improve docstring for SetupVeth
  * Added Romana to list of CNI providers...
  * plugins/meta/flannel: If net config is missing do not return err on DEL
  * plugins/*: Don't error if the device doesn't exist</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1491825600">- Update to version 0.5.2:
  * Rename build script to avoid conflict with bazel
  * Enable s390x build
  * Update community sync detail
  * Added entry for CNI-Genie
  * travis: shift forward to Go 1.8 and 1.7
  * spec/plugins: fix 'ip'-&gt;'ips' in the spec, bump to 0.3.1
  * libcni: Improved error messages.
  * libcni: Fixed tests that were checking error strings.
  * Documentation: Added documentation for `cnitool`.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1503921600">- Update to version 0.6.0:
  * Conventions: add convention around chaining interfaces
  * pkg/types: safer typecasting for TextUnmarshaler when loading args
  * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected
  * Update note about next Community Sync, 2017-06-21
  * types: fix marshalling of omitted "interfaces" key in IPConfig JSON
  * Update and document release process
  * scripts/release.sh: Add in s390x architecture
  * cnitool: add support for CNI_ARGS
  * README plugins list: add Linen CNI plugin</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Remove the dependency with the cni-plugins
- Recommend the cni-plugins</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1516017600">- Make /var/lib/cni writable</changelog>
  <changelog author="kmacinnes@suse.com" date="1516276800">- Add snapper as a requirement, to provide mksubvolume</changelog>
  <changelog author="kmacinnes@suse.com" date="1517227200">- Use full/absolute path for mksubvolume
- Change snapper Requires to a Requires(post)</changelog>
  <changelog author="jmassaguerpla@suse.com" date="1522843200">- Remove creating subvolumes. This should be in another package (kubernetes-kubelet)</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558094400">- Update to version 0.7.0:
  * Spec changes:
    + Use more RFC2119 style language in specification (must, should...)
    + add notes about ADD/DEL ordering
    + Make the container ID required and unique.
    + remove the version parameter from ADD and DEL commands.
    + Network interface name matters
    + be explicit about optional and required structure members
    + add CHECK method
    + Add a well-known error for "try again"
    + SPEC.md: clarify meaning of 'routes'
  * Library changes:
    + pkg/types: Makes IPAM concrete type
    + libcni: return error if Type is empty
    + skel: VERSION shouldn't block on stdin
    + non-pointer instances of types.Route now correctly marshal to JSON
    + libcni: add ValidateNetwork and ValidateNetworkList functions
    + pkg/skel: return error if JSON config has no network name
    + skel: add support for plugin version string
    + libcni: make exec handling an interface for better downstream testing
    + libcni: api now takes a Context to allow operations to be timed out or cancelled
    + types/version: add helper to parse PrevResult
    + skel: only print about message, not errors
    + skel,invoke,libcni: implementation of CHECK method
    + cnitool: Honor interface name supplied via CNI_IFNAME environment variable.
    + cnitool: validate correct number of args
    + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0
    + add PrintTo method to Result interface
    + Return a better error when the plugin returns none
- Install sleep binary into CNI plugin directory
- Restore build.sh script which was removed upstream</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1563278400">- Update to version 0.7.1 (bsc#1160460):
  * Library changes:
    + invoke : ensure custom envs of CNIArgs are prepended to process envs
    + add GetNetworkListCachedResult to CNI interface
    + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance
  * Documentation &amp; Convention changes:
    + Update cnitool documentation for spec v0.4.0
    + Add cni-route-override to CNI plugin list
  * Build and test changes:
    + Release: bump go to v1.12</changelog>
  <changelog author="sgrunert@suse.com" date="1578916800">- Set correct CNI version for 99-loopback.conf</changelog>
  <changelog author="dcermak@suse.com" date="1668686400">- Add patch to fix bsc#1181961 aka CVE-2021-20206
  added 0001-tighten-up-plugin-finding-logic.patch
- disable usage of go modules to fix build failures with go 1.19</changelog>
</package>
<package pkgid="6ba3458feabc0788a9ae642fdbd43f651a65a5ddf3669ad4b9ddb2a05ae3d654" name="cni" arch="x86_64">
  <version epoch="0" ver="0.7.1" rel="150100.3.8.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1487851200">- Initial version</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1488369600">- Update to version 0.4.0:
  * plugins/noop: return a helpful message for test authors
  * host-local: trim whitespace from container IDs and disk file contents
  * travis: roll forward the versions of Go that we test
  * MAINTAINERS: hi CaseyC!
  * ipam/host-local: Move allocator and config to backend
  * ipam/host-local: add ResolvConf argument for DNS configuration
  * spec: notice of version</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1490184000">- Update to version 0.5.0:
  * Documentation: Add conventions doc
  * noop: allow specifying debug file in config JSON
  * Spec/Conventions: Update to include plugin config
  * spec: add network configuration list specification
  * api,libcni: add network config list-based plugin chaining
  * Update CONVENTIONS.md
  * skel: adds PluginMainWithError which returns a *types.Error
  * testutils: pass netConf in for version operations; pass raw result out for tests
  * types: make Result an interface and move existing Result to separate package
  * macvlan/ipvlan: use common RenameLink method
  * plugins/flannel: organize test JSON alphabetically
  * pkg/ipam: add testcases
  * spec/plugins: return interface details and multiple IP addresses to runtime
  * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH
  * pkg/utils/sysctl/sysctl_linux.go: fix build tag.
  * pkg/utils/sysctl/sysctl_linux.go: fix typo.
  * invoke: Enable plugin file names with extensions
  * CONVENTIONS.md: Update details on port-mappings
  * Update with feedback
  * More markups
  * spec: Remove `routes` from Network Configuration
  * docs: consolidate host-local documentation
  * pkg/ns: refactored so that builds succeed on non-linux platforms
  * Fix grammar
  * plugins/main/ptp: set the Sandbox property on the response
  * README: List multus as 3rd party plugin
  * Replace Michael Bridgen with Bryan Boreham
  * pkg/ns, pkg/types: refactored non linux build fix code to
  * pkg/ip: refactored so that builds succeed on non-linux platforms
  * vendor: Update vishvanana/netlink dependency
  * libcni: up-convert a Config to a ConfigList when no other configs are found.
  * docs: CNI versioning for 0.3.0 upgrade
  * docs: Edits to v0.3.0 upgrade guidance
  * docs: minor improvements to 0.3.0 upgrade guidance
  * docs: add small upgrade instructions
  * docs: minor improvements to spec-upgrades
  * docs: fill-out and correct version conversion table
  * docs: table formatting is hard
  * pkg/testutils: return errors after restoring stdout
  * pkg/types: misc current types testcase cleanups
  * Minor rewording about default config version
  * spec,libcni: add support for injecting runtimeConfig into plugin stdin data
  * Check n.IPAM before use it in LoadIPAMConfig function
  * do not error if last_reserved_ip is missing for host local ipam
  * add test for ensuring initial subnet creation does not contain an error
  * fix unrelated failing tests</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1490270400">- Update to version 0.5.1:
  * readme.md: Add link to community sync
  * pkg/ip: do not leak types from vendored netlink package
  * pkg/ip: SetupVeth returns net.Interface
  * pkg/ip: improve docstring for SetupVeth
  * Added Romana to list of CNI providers...
  * plugins/meta/flannel: If net config is missing do not return err on DEL
  * plugins/*: Don't error if the device doesn't exist</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1491825600">- Update to version 0.5.2:
  * Rename build script to avoid conflict with bazel
  * Enable s390x build
  * Update community sync detail
  * Added entry for CNI-Genie
  * travis: shift forward to Go 1.8 and 1.7
  * spec/plugins: fix 'ip'-&gt;'ips' in the spec, bump to 0.3.1
  * libcni: Improved error messages.
  * libcni: Fixed tests that were checking error strings.
  * Documentation: Added documentation for `cnitool`.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1503921600">- Update to version 0.6.0:
  * Conventions: add convention around chaining interfaces
  * pkg/types: safer typecasting for TextUnmarshaler when loading args
  * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected
  * Update note about next Community Sync, 2017-06-21
  * types: fix marshalling of omitted "interfaces" key in IPConfig JSON
  * Update and document release process
  * scripts/release.sh: Add in s390x architecture
  * cnitool: add support for CNI_ARGS
  * README plugins list: add Linen CNI plugin</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Remove the dependency with the cni-plugins
- Recommend the cni-plugins</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1516017600">- Make /var/lib/cni writable</changelog>
  <changelog author="kmacinnes@suse.com" date="1516276800">- Add snapper as a requirement, to provide mksubvolume</changelog>
  <changelog author="kmacinnes@suse.com" date="1517227200">- Use full/absolute path for mksubvolume
- Change snapper Requires to a Requires(post)</changelog>
  <changelog author="jmassaguerpla@suse.com" date="1522843200">- Remove creating subvolumes. This should be in another package (kubernetes-kubelet)</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558094400">- Update to version 0.7.0:
  * Spec changes:
    + Use more RFC2119 style language in specification (must, should...)
    + add notes about ADD/DEL ordering
    + Make the container ID required and unique.
    + remove the version parameter from ADD and DEL commands.
    + Network interface name matters
    + be explicit about optional and required structure members
    + add CHECK method
    + Add a well-known error for "try again"
    + SPEC.md: clarify meaning of 'routes'
  * Library changes:
    + pkg/types: Makes IPAM concrete type
    + libcni: return error if Type is empty
    + skel: VERSION shouldn't block on stdin
    + non-pointer instances of types.Route now correctly marshal to JSON
    + libcni: add ValidateNetwork and ValidateNetworkList functions
    + pkg/skel: return error if JSON config has no network name
    + skel: add support for plugin version string
    + libcni: make exec handling an interface for better downstream testing
    + libcni: api now takes a Context to allow operations to be timed out or cancelled
    + types/version: add helper to parse PrevResult
    + skel: only print about message, not errors
    + skel,invoke,libcni: implementation of CHECK method
    + cnitool: Honor interface name supplied via CNI_IFNAME environment variable.
    + cnitool: validate correct number of args
    + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0
    + add PrintTo method to Result interface
    + Return a better error when the plugin returns none
- Install sleep binary into CNI plugin directory
- Restore build.sh script which was removed upstream</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1563278400">- Update to version 0.7.1 (bsc#1160460):
  * Library changes:
    + invoke : ensure custom envs of CNIArgs are prepended to process envs
    + add GetNetworkListCachedResult to CNI interface
    + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance
  * Documentation &amp; Convention changes:
    + Update cnitool documentation for spec v0.4.0
    + Add cni-route-override to CNI plugin list
  * Build and test changes:
    + Release: bump go to v1.12</changelog>
  <changelog author="sgrunert@suse.com" date="1578916800">- Set correct CNI version for 99-loopback.conf</changelog>
  <changelog author="dcermak@suse.com" date="1668686400">- Add patch to fix bsc#1181961 aka CVE-2021-20206
  added 0001-tighten-up-plugin-finding-logic.patch
- disable usage of go modules to fix build failures with go 1.19</changelog>
</package>
<package pkgid="39aac73101fbb53ec9ee105d566fe25f6dad02db5a175b74b27ff374afa58d2c" name="cni-plugins" arch="aarch64">
  <version epoch="0" ver="0.8.6" rel="150100.3.11.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1503921600">- Initial version from CNI plugins v0.6.0</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1503921601">- Install docs in the cni-plugins dir</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Require cni</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1544616000">- Updated to a supported version of Go (due to security reasons)</changelog>
  <changelog author="sgrunert@suse.com" date="1548417600">- Updated plugins to v0.7.4:
  - Add host-device plugin, which simply moves a device from the
    host network namespace
  - Portmap now uses a more efficient rule structure
  - host-local can receive ranges as a RuntimeArgument
  - DHCP daemon can be containerized
  - DHCP now correctly parses routes
  - Various Windows build fixes
  - Waiting for DAD is skipped when possible
  - Bridge now uses a stable mac
  - Fix a regression where the interface's MAC address was no
    longer populated in the return type.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558353600">- Updated plugins to v0.8.0:
  + New plugins:
  * bandwidth - limit incoming and outgoing bandwidth
  * firewall - add containers to firewall rules
  * sbr - convert container routes to source-based routes
  * static - assign a fixed IP address
  * win-bridge, win-overlay: Windows plugins
  + Plugin features / changelog:
  * CHECK Support
  * macvlan:
  - Allow to configure empty ipam for macvlan
  - Make master config optional
  * bridge:
  - Add vlan tag to the bridge cni plugin
  - Allow the user to assign VLAN tag
  - L2 bridge Implementation.
  * dhcp:
  - Include Subnet Mask option parameter in DHCPREQUEST
  - Add systemd unit file to activate socket with systemd
  - Add container ifName to the dhcp clientID, making the
    clientID value
  * flannel:
  - Pass through runtimeConfig to delegate
  * host-local:
  - host-local: add ifname to file tracking IP address used
  * host-device:
  - Support the IPAM in the host-device
  - Handle empty netns in DEL for loopback and host-device
  * tuning:
  - adds 'ip link' command related feature into tuning
  + Bug fixes &amp; minor changes
  * Correctly DEL on ipam failure for all plugins
  * Fix bug on ip revert if cmdAdd fails on macvlan and host-device
  * host-device: Ensure device is down before rename
  * Fix -hostprefix option
  * some DHCP servers expect to request for explicit router options
  * bridge: release IP in case of error
  * change source of ipmasq rule from ipn to ip
  + Build fixes:
  * test: add coveralls support
  * plugins: correctly output build version, cosmetic cleanups
  * Move Windows tests to Travis
- from version v0.7.5:
  + This release takes a minor change to the portmap plugin:
  * Portmap: append, rather than prepend, entry rules
  + This fixes a potential issue where firewall rules may
    be bypassed by port mapping
- Include patch to fix the build on i586:
  + 0001_use_Go_facilities_to_get_a_socket.patch
- Use new build_linux.sh script instead of removed build.sh</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559822400">- Updated plugins to v0.8.1:
  + Bugs:
  * bridge: fix ipMasq setup to use correct source address
  * fix compilation error on 386
  * bandwidth: get bandwidth interface in host ns through
    container interface
  + Improvements:
  * Release: bump go to v1.12
  * host-device: add pciBusID property
- Drop patches merged upstream:
  + 0001_use_Go_facilities_to_get_a_socket.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1565956800">- Update plugins to v0.8.2
  + New features:
  * Support "args" in static and tuning
  * Add Loopback DSR support, allow l2tunnel networks
    to be used with the l2bridge plugin
  * host-local: return error if same ADD request is seen twice
  * bandwidth: fix collisions
  * Support ips capability in static and mac capability in tuning
  * pkg/veth: Make host-side veth name configurable
  + Bug fixes:
  * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists
  * host-device: revert name setting to make retries idempotent (#357).
  * Vendor update go-iptables. Vendor update go-iptables to
    obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10
  * Update go.mod &amp; go.sub
  * Remove link Down/Up in MAC address change to prevent route flush (#364).
  * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall
    error message is "invalid argument" not "file exists"
  * bump containernetworking/cni to v0.7.1</changelog>
  <changelog author="sgrunert@suse.com" date="1573473600">- Update to version 0.8.3:
  * Enhancements:
  * static: prioritize the input sources for IPs (#400).
  * tuning: send gratuitous ARP in case of MAC address update (#403).
  * bandwidth: use uint64 for Bandwidth value (#389).
  * ptp: only override DNS conf if DNS settings provided (#388).
  * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383).
  * loopback support CNI CHECK and result cache (#374).
  * Better input validation:
  * vlan: add MTU validation to loadNetConf (#405).
  * macvlan: add MTU validation to loadNetConf (#404).
  * bridge: check vlan id when loading net conf (#394).
  * Bugfixes:
  * bugfix: defer after err check, or it may panic (#391).
  * portmap: Fix dual-stack support (#379).
  * firewall: don't return error in DEL if prevResult is not found (#390).
  * bump up libcni back to v0.7.1 (#377).
  * Tests:
  * integration: fix ip address collision in integration tests (#409).
  * testutils: newNS() works in a rootless user namespace (#401).
  * Bump Go version (#386).
  * Cleanup netns after test suite (#375).
  * Docs:
  * contributing doc: revise test script name to run (#396).
  * contributing doc: describe cnitool installation (#397).</changelog>
  <changelog author="sgrunert@suse.com" date="1578571200">- Update to version 0.8.4 (bsc#1160460):
  * add support for mips64le
  * Add missing cniVersion in README example
  * bump go-iptables module to v0.4.5
  * iptables: add idempotent functions
  * portmap doesn't fail if chain doesn't exist
  * fix portmap port forward flakiness
  * Add Bruce Ma and Piotr Skarmuk as owners</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- Update to version 0.8.6 (bsc#1172410 CVE-2020-10749)
  * New features
  * Support device id in host device plugin (#471).
  * win-bridge: add support for portMappings capability (#475).
  * Make host-device to work with virtio net device (#453).
  * Small improvements
  * ptp, bridge: disable accept_ra on the host-side interface (#484).
  * modify the error url of windowscontainer (#460).
  * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin
    rule only allow the * container itself to access the ports it is exposing thru
    the host IP. Other containers in the same subnet might also want to access this
    service via the host IP, so apply this rule to the whole subnet instead of just
    for the container.
  * Unlock OS thread after netns is restored (#455).
  * Bugfixes
  * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used
    which routed an entire cidr based on source, not only the bound address.
  * check bridge's port state (#468). fix #463
  * Reset the route flag before moving the rule (#472).
  * replace juju/errors because of CNCF license scan (#458). ref to #457
  * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin.
    The IPv6 address check loops over IPv4 addresses.
- from version 0.8.5
  * Bugfixes
  * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING
    (#434) fixes #370.
  * vlan: Fix vlan plugin returning error when device is already removed (#438).
  * Improvements
  * sysctl: Improve support of sysctl name separators (#437).</changelog>
  <changelog author="dcermak@suse.com" date="1668686400">- Add patch to fix bsc#1181961 aka CVE-2021-20206
  added 0001-tighten-up-plugin-finding-logic.patch</changelog>
</package>
<package pkgid="0496aee6fe90b5ad1ccaf521ad524ef5d881605a6a2426a1b609fd2270acdc77" name="cni-plugins" arch="src">
  <version epoch="0" ver="0.8.6" rel="150100.3.11.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1503921600">- Initial version from CNI plugins v0.6.0</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1503921601">- Install docs in the cni-plugins dir</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Require cni</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1544616000">- Updated to a supported version of Go (due to security reasons)</changelog>
  <changelog author="sgrunert@suse.com" date="1548417600">- Updated plugins to v0.7.4:
  - Add host-device plugin, which simply moves a device from the
    host network namespace
  - Portmap now uses a more efficient rule structure
  - host-local can receive ranges as a RuntimeArgument
  - DHCP daemon can be containerized
  - DHCP now correctly parses routes
  - Various Windows build fixes
  - Waiting for DAD is skipped when possible
  - Bridge now uses a stable mac
  - Fix a regression where the interface's MAC address was no
    longer populated in the return type.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558353600">- Updated plugins to v0.8.0:
  + New plugins:
  * bandwidth - limit incoming and outgoing bandwidth
  * firewall - add containers to firewall rules
  * sbr - convert container routes to source-based routes
  * static - assign a fixed IP address
  * win-bridge, win-overlay: Windows plugins
  + Plugin features / changelog:
  * CHECK Support
  * macvlan:
  - Allow to configure empty ipam for macvlan
  - Make master config optional
  * bridge:
  - Add vlan tag to the bridge cni plugin
  - Allow the user to assign VLAN tag
  - L2 bridge Implementation.
  * dhcp:
  - Include Subnet Mask option parameter in DHCPREQUEST
  - Add systemd unit file to activate socket with systemd
  - Add container ifName to the dhcp clientID, making the
    clientID value
  * flannel:
  - Pass through runtimeConfig to delegate
  * host-local:
  - host-local: add ifname to file tracking IP address used
  * host-device:
  - Support the IPAM in the host-device
  - Handle empty netns in DEL for loopback and host-device
  * tuning:
  - adds 'ip link' command related feature into tuning
  + Bug fixes &amp; minor changes
  * Correctly DEL on ipam failure for all plugins
  * Fix bug on ip revert if cmdAdd fails on macvlan and host-device
  * host-device: Ensure device is down before rename
  * Fix -hostprefix option
  * some DHCP servers expect to request for explicit router options
  * bridge: release IP in case of error
  * change source of ipmasq rule from ipn to ip
  + Build fixes:
  * test: add coveralls support
  * plugins: correctly output build version, cosmetic cleanups
  * Move Windows tests to Travis
- from version v0.7.5:
  + This release takes a minor change to the portmap plugin:
  * Portmap: append, rather than prepend, entry rules
  + This fixes a potential issue where firewall rules may
    be bypassed by port mapping
- Include patch to fix the build on i586:
  + 0001_use_Go_facilities_to_get_a_socket.patch
- Use new build_linux.sh script instead of removed build.sh</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559822400">- Updated plugins to v0.8.1:
  + Bugs:
  * bridge: fix ipMasq setup to use correct source address
  * fix compilation error on 386
  * bandwidth: get bandwidth interface in host ns through
    container interface
  + Improvements:
  * Release: bump go to v1.12
  * host-device: add pciBusID property
- Drop patches merged upstream:
  + 0001_use_Go_facilities_to_get_a_socket.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1565956800">- Update plugins to v0.8.2
  + New features:
  * Support "args" in static and tuning
  * Add Loopback DSR support, allow l2tunnel networks
    to be used with the l2bridge plugin
  * host-local: return error if same ADD request is seen twice
  * bandwidth: fix collisions
  * Support ips capability in static and mac capability in tuning
  * pkg/veth: Make host-side veth name configurable
  + Bug fixes:
  * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists
  * host-device: revert name setting to make retries idempotent (#357).
  * Vendor update go-iptables. Vendor update go-iptables to
    obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10
  * Update go.mod &amp; go.sub
  * Remove link Down/Up in MAC address change to prevent route flush (#364).
  * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall
    error message is "invalid argument" not "file exists"
  * bump containernetworking/cni to v0.7.1</changelog>
  <changelog author="sgrunert@suse.com" date="1573473600">- Update to version 0.8.3:
  * Enhancements:
  * static: prioritize the input sources for IPs (#400).
  * tuning: send gratuitous ARP in case of MAC address update (#403).
  * bandwidth: use uint64 for Bandwidth value (#389).
  * ptp: only override DNS conf if DNS settings provided (#388).
  * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383).
  * loopback support CNI CHECK and result cache (#374).
  * Better input validation:
  * vlan: add MTU validation to loadNetConf (#405).
  * macvlan: add MTU validation to loadNetConf (#404).
  * bridge: check vlan id when loading net conf (#394).
  * Bugfixes:
  * bugfix: defer after err check, or it may panic (#391).
  * portmap: Fix dual-stack support (#379).
  * firewall: don't return error in DEL if prevResult is not found (#390).
  * bump up libcni back to v0.7.1 (#377).
  * Tests:
  * integration: fix ip address collision in integration tests (#409).
  * testutils: newNS() works in a rootless user namespace (#401).
  * Bump Go version (#386).
  * Cleanup netns after test suite (#375).
  * Docs:
  * contributing doc: revise test script name to run (#396).
  * contributing doc: describe cnitool installation (#397).</changelog>
  <changelog author="sgrunert@suse.com" date="1578571200">- Update to version 0.8.4 (bsc#1160460):
  * add support for mips64le
  * Add missing cniVersion in README example
  * bump go-iptables module to v0.4.5
  * iptables: add idempotent functions
  * portmap doesn't fail if chain doesn't exist
  * fix portmap port forward flakiness
  * Add Bruce Ma and Piotr Skarmuk as owners</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- Update to version 0.8.6 (bsc#1172410 CVE-2020-10749)
  * New features
  * Support device id in host device plugin (#471).
  * win-bridge: add support for portMappings capability (#475).
  * Make host-device to work with virtio net device (#453).
  * Small improvements
  * ptp, bridge: disable accept_ra on the host-side interface (#484).
  * modify the error url of windowscontainer (#460).
  * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin
    rule only allow the * container itself to access the ports it is exposing thru
    the host IP. Other containers in the same subnet might also want to access this
    service via the host IP, so apply this rule to the whole subnet instead of just
    for the container.
  * Unlock OS thread after netns is restored (#455).
  * Bugfixes
  * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used
    which routed an entire cidr based on source, not only the bound address.
  * check bridge's port state (#468). fix #463
  * Reset the route flag before moving the rule (#472).
  * replace juju/errors because of CNCF license scan (#458). ref to #457
  * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin.
    The IPv6 address check loops over IPv4 addresses.
- from version 0.8.5
  * Bugfixes
  * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING
    (#434) fixes #370.
  * vlan: Fix vlan plugin returning error when device is already removed (#438).
  * Improvements
  * sysctl: Improve support of sysctl name separators (#437).</changelog>
  <changelog author="dcermak@suse.com" date="1668686400">- Add patch to fix bsc#1181961 aka CVE-2021-20206
  added 0001-tighten-up-plugin-finding-logic.patch</changelog>
</package>
<package pkgid="dc9164408fad9aadd5887ae8a10cb99dd3248f27d913c57fe9682b9bc42a69a2" name="cni-plugins" arch="x86_64">
  <version epoch="0" ver="0.8.6" rel="150100.3.11.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1503921600">- Initial version from CNI plugins v0.6.0</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1503921601">- Install docs in the cni-plugins dir</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Require cni</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1544616000">- Updated to a supported version of Go (due to security reasons)</changelog>
  <changelog author="sgrunert@suse.com" date="1548417600">- Updated plugins to v0.7.4:
  - Add host-device plugin, which simply moves a device from the
    host network namespace
  - Portmap now uses a more efficient rule structure
  - host-local can receive ranges as a RuntimeArgument
  - DHCP daemon can be containerized
  - DHCP now correctly parses routes
  - Various Windows build fixes
  - Waiting for DAD is skipped when possible
  - Bridge now uses a stable mac
  - Fix a regression where the interface's MAC address was no
    longer populated in the return type.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558353600">- Updated plugins to v0.8.0:
  + New plugins:
  * bandwidth - limit incoming and outgoing bandwidth
  * firewall - add containers to firewall rules
  * sbr - convert container routes to source-based routes
  * static - assign a fixed IP address
  * win-bridge, win-overlay: Windows plugins
  + Plugin features / changelog:
  * CHECK Support
  * macvlan:
  - Allow to configure empty ipam for macvlan
  - Make master config optional
  * bridge:
  - Add vlan tag to the bridge cni plugin
  - Allow the user to assign VLAN tag
  - L2 bridge Implementation.
  * dhcp:
  - Include Subnet Mask option parameter in DHCPREQUEST
  - Add systemd unit file to activate socket with systemd
  - Add container ifName to the dhcp clientID, making the
    clientID value
  * flannel:
  - Pass through runtimeConfig to delegate
  * host-local:
  - host-local: add ifname to file tracking IP address used
  * host-device:
  - Support the IPAM in the host-device
  - Handle empty netns in DEL for loopback and host-device
  * tuning:
  - adds 'ip link' command related feature into tuning
  + Bug fixes &amp; minor changes
  * Correctly DEL on ipam failure for all plugins
  * Fix bug on ip revert if cmdAdd fails on macvlan and host-device
  * host-device: Ensure device is down before rename
  * Fix -hostprefix option
  * some DHCP servers expect to request for explicit router options
  * bridge: release IP in case of error
  * change source of ipmasq rule from ipn to ip
  + Build fixes:
  * test: add coveralls support
  * plugins: correctly output build version, cosmetic cleanups
  * Move Windows tests to Travis
- from version v0.7.5:
  + This release takes a minor change to the portmap plugin:
  * Portmap: append, rather than prepend, entry rules
  + This fixes a potential issue where firewall rules may
    be bypassed by port mapping
- Include patch to fix the build on i586:
  + 0001_use_Go_facilities_to_get_a_socket.patch
- Use new build_linux.sh script instead of removed build.sh</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559822400">- Updated plugins to v0.8.1:
  + Bugs:
  * bridge: fix ipMasq setup to use correct source address
  * fix compilation error on 386
  * bandwidth: get bandwidth interface in host ns through
    container interface
  + Improvements:
  * Release: bump go to v1.12
  * host-device: add pciBusID property
- Drop patches merged upstream:
  + 0001_use_Go_facilities_to_get_a_socket.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1565956800">- Update plugins to v0.8.2
  + New features:
  * Support "args" in static and tuning
  * Add Loopback DSR support, allow l2tunnel networks
    to be used with the l2bridge plugin
  * host-local: return error if same ADD request is seen twice
  * bandwidth: fix collisions
  * Support ips capability in static and mac capability in tuning
  * pkg/veth: Make host-side veth name configurable
  + Bug fixes:
  * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists
  * host-device: revert name setting to make retries idempotent (#357).
  * Vendor update go-iptables. Vendor update go-iptables to
    obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10
  * Update go.mod &amp; go.sub
  * Remove link Down/Up in MAC address change to prevent route flush (#364).
  * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall
    error message is "invalid argument" not "file exists"
  * bump containernetworking/cni to v0.7.1</changelog>
  <changelog author="sgrunert@suse.com" date="1573473600">- Update to version 0.8.3:
  * Enhancements:
  * static: prioritize the input sources for IPs (#400).
  * tuning: send gratuitous ARP in case of MAC address update (#403).
  * bandwidth: use uint64 for Bandwidth value (#389).
  * ptp: only override DNS conf if DNS settings provided (#388).
  * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383).
  * loopback support CNI CHECK and result cache (#374).
  * Better input validation:
  * vlan: add MTU validation to loadNetConf (#405).
  * macvlan: add MTU validation to loadNetConf (#404).
  * bridge: check vlan id when loading net conf (#394).
  * Bugfixes:
  * bugfix: defer after err check, or it may panic (#391).
  * portmap: Fix dual-stack support (#379).
  * firewall: don't return error in DEL if prevResult is not found (#390).
  * bump up libcni back to v0.7.1 (#377).
  * Tests:
  * integration: fix ip address collision in integration tests (#409).
  * testutils: newNS() works in a rootless user namespace (#401).
  * Bump Go version (#386).
  * Cleanup netns after test suite (#375).
  * Docs:
  * contributing doc: revise test script name to run (#396).
  * contributing doc: describe cnitool installation (#397).</changelog>
  <changelog author="sgrunert@suse.com" date="1578571200">- Update to version 0.8.4 (bsc#1160460):
  * add support for mips64le
  * Add missing cniVersion in README example
  * bump go-iptables module to v0.4.5
  * iptables: add idempotent functions
  * portmap doesn't fail if chain doesn't exist
  * fix portmap port forward flakiness
  * Add Bruce Ma and Piotr Skarmuk as owners</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- Update to version 0.8.6 (bsc#1172410 CVE-2020-10749)
  * New features
  * Support device id in host device plugin (#471).
  * win-bridge: add support for portMappings capability (#475).
  * Make host-device to work with virtio net device (#453).
  * Small improvements
  * ptp, bridge: disable accept_ra on the host-side interface (#484).
  * modify the error url of windowscontainer (#460).
  * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin
    rule only allow the * container itself to access the ports it is exposing thru
    the host IP. Other containers in the same subnet might also want to access this
    service via the host IP, so apply this rule to the whole subnet instead of just
    for the container.
  * Unlock OS thread after netns is restored (#455).
  * Bugfixes
  * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used
    which routed an entire cidr based on source, not only the bound address.
  * check bridge's port state (#468). fix #463
  * Reset the route flag before moving the rule (#472).
  * replace juju/errors because of CNCF license scan (#458). ref to #457
  * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin.
    The IPv6 address check loops over IPv4 addresses.
- from version 0.8.5
  * Bugfixes
  * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING
    (#434) fixes #370.
  * vlan: Fix vlan plugin returning error when device is already removed (#438).
  * Improvements
  * sysctl: Improve support of sysctl name separators (#437).</changelog>
  <changelog author="dcermak@suse.com" date="1668686400">- Add patch to fix bsc#1181961 aka CVE-2021-20206
  added 0001-tighten-up-plugin-finding-logic.patch</changelog>
</package>
<package pkgid="a5dccf6f702277dbe2603384f4f693d6d28659a04867db4765a3e02ab8c34f94" name="conmon" arch="aarch64">
  <version epoch="0" ver="2.1.5" rel="150400.3.3.1"/>
  <changelog author="rhafer@suse.com" date="1582286400">- Update to v2.0.10 (bsc#1160460, bsc#1164390, jsc#ECO-1048,
  jsc#SLE-11485, jsc#SLE-11331):
  - journal logging: write to /dev/null instead of -1</changelog>
  <changelog author="sgrunert@suse.com" date="1583409600">- Update to v2.0.11
  - log: reject --log-tag with k8s-file
  - chmod std files pipes
  - adjust score to -1000 to prevent conmon from ever being OOM
    killed
  - container OOM: verify cgroup hasn't been cleaned up before
    reporting OOM</changelog>
  <changelog author="rhafer@suse.com" date="1584446400">- Update to v2.0.12
  - oom: fix potential race between verification steps</changelog>
  <changelog author="sgrunert@suse.com" date="1585137600">- Update to v2.0.14
  - drop usage of splice(2)
  - avoid hanging on stdin
  - stdio: sometimes quit main loop after io is done
  - ignore sigpipe</changelog>
  <changelog author="sgrunert@suse.com" date="1585915200">- Update to v2.0.15
  - store status while waiting for pid</changelog>
  <changelog author="rhafer@suse.com" date="1585915201">- Enable support for journald logging (bsc#1162432)</changelog>
  <changelog author="sgrunert@suse.com" date="1589803200">- Update to v2.0.16
  - tty: flush pending data when fd is ready</changelog>
  <changelog author="sgrunert@suse.com" date="1590580800">- Update to v2.0.17
  - Add option to delay execution of exit command</changelog>
  <changelog author="sgrunert@suse.com" date="1596024000">- Update to v2.0.20 (bsc#1175821)
  - journald: fix logging container name
  - container logging: Implement none driver - "off", "null" or
    "none" all work.
  - ctrl: warn if we fail to unlink
  - Drop fsync calls
  - Reap PIDs before running exit command
  - Fix log path parsing
  - Add --sync option to prevent conmon from double forking
  - Add --no-sync-log option to instruct conmon to not sync the
    logs of the containers upon shutting down. This feature fixes a
    regression where we unconditionally dropped the log sync. It is
    possible the container logs could be corrupted on a sudden
    power-off. If you need container logs to remain in consistent
    state after a sudden shutdown, please update from v2.0.19 to
    v2.0.20</changelog>
  <changelog author="dmueller@suse.com" date="1600689600">- Update to version 2.0.21:
  * bump to v2.0.21
  * protect against kill(-1)
  * Makefile: enable debuginfo generation
  * Remove go.sum file and add go.mod
  * Fail if conmon config could not be written
  * nix: remove double definition for e2fsprogs
  * Speedup static build by utilizing CI cache on `/nix` folder
  * Fix nix build for failing e2fsprogs tests
  * test: fix CI
  * Use Podman for building</changelog>
  <changelog author="sgrunert@suse.com" date="1610452800">- Update to version 2.0.22:
  * added man page
  * attach: always chdir
  * conn_sock: Explicitly free a heap-allocated string
  * refactor I/O and add SD_NOTIFY proxy support</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1614254400">- Update to version 2.0.26:
  * conn_sock: do not fail on EAGAIN
  * fix segfault from a double freed pointer
  * Fix a bug where conmon could never spawn a container, because
    a disagreement between the caller and itself on where the attach
    socket was.
  * improve --full-attach to ignore the socket-dir directly. that
    means callers don't need to specify a socket dir at all (and
    can remove it)
  * add full-attach option to allow callers to not truncate a very
    long path for the attach socket
  * close only opened FDs
  * set locale to inherit environment</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1617105600">- Update to version 2.0.27:
  * bump to v2.0.27
  * Add CRI-O integration test GitHub action
  * exec: don't fail on EBADFD
  * close_fds: fix close of external fds
  * Add arm64 static build binary
  * bump to v2.0.27-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1627041600">- Update to version 2.0.29:
  * Reset OOM score back to 0 for container runtime
  * call functions registered with atexit on SIGTERM
  * conn_sock: fix potential segfault</changelog>
  <changelog author="info@paolostivanin.com" date="1632484800">- Update to version 2.0.30:
  * Remove unreachable code path
  * exit: report if the exit command was killed
  * exit: fix race zombie reaper
  * conn_sock: allow watchdog messages through the notify socket proxy
  * seccomp: add support for seccomp notify</changelog>
  <changelog author="rpm@fthiessen.de" date="1651752000">- Update to version 2.1.0
  * logging: buffer partial messages to journald
  * exit: close all fds &gt;= 3
  * fix: cgroup: Free memory_cgroup_file_path if open fails.
    Call g_free instead of free.
- Update to version 2.0.32
  * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
  * exit_command: Fix: unset subreaper attribute before running exit command
- Update to version 2.0.31
  * logging: new mode -l passthrough
  * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
  * conmon: Fix: free userdata files before exec cleanup</changelog>
  <changelog author="idesmi@protonmail.com" date="1656504000">- Update to version 2.1.2:
  * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285)
  * journald: print tag and name if both are specified
  * drop some logs to debug level</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- update to 2.1.3:
  * Port conmon to FreeBSD
  * Stop using g_unix_signal_add() to avoid threads
  * Rename CLI optionlog-size-global-max to log-global-size-max</changelog>
  <changelog author="fvogt@suse.com" date="1667563200">- Add patch to fix build with make &gt;= 4.4:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch</changelog>
  <changelog author="dcermak@suse.com" date="1669204800">- Update to version 2.1.5:
  * don't leak syslog_identifier
  * logging: do not read more that the buf size
  * logging: fix error handling
  * Makefile: Fix install for FreeBSD
  * signal: Track changes to get_signal_descriptor in the FreeBSD version
  * Packit: initial enablement
- Update to version 2.1.4:
  * Fix a bug where conmon crashed when it got a SIGCHLD</changelog>
</package>
<package pkgid="be472152617f5bfb5dbd91f802bda7553b56ac6d82891eda34a357ab9b5c24f4" name="conmon" arch="src">
  <version epoch="0" ver="2.1.5" rel="150400.3.3.1"/>
  <changelog author="rhafer@suse.com" date="1582286400">- Update to v2.0.10 (bsc#1160460, bsc#1164390, jsc#ECO-1048,
  jsc#SLE-11485, jsc#SLE-11331):
  - journal logging: write to /dev/null instead of -1</changelog>
  <changelog author="sgrunert@suse.com" date="1583409600">- Update to v2.0.11
  - log: reject --log-tag with k8s-file
  - chmod std files pipes
  - adjust score to -1000 to prevent conmon from ever being OOM
    killed
  - container OOM: verify cgroup hasn't been cleaned up before
    reporting OOM</changelog>
  <changelog author="rhafer@suse.com" date="1584446400">- Update to v2.0.12
  - oom: fix potential race between verification steps</changelog>
  <changelog author="sgrunert@suse.com" date="1585137600">- Update to v2.0.14
  - drop usage of splice(2)
  - avoid hanging on stdin
  - stdio: sometimes quit main loop after io is done
  - ignore sigpipe</changelog>
  <changelog author="sgrunert@suse.com" date="1585915200">- Update to v2.0.15
  - store status while waiting for pid</changelog>
  <changelog author="rhafer@suse.com" date="1585915201">- Enable support for journald logging (bsc#1162432)</changelog>
  <changelog author="sgrunert@suse.com" date="1589803200">- Update to v2.0.16
  - tty: flush pending data when fd is ready</changelog>
  <changelog author="sgrunert@suse.com" date="1590580800">- Update to v2.0.17
  - Add option to delay execution of exit command</changelog>
  <changelog author="sgrunert@suse.com" date="1596024000">- Update to v2.0.20 (bsc#1175821)
  - journald: fix logging container name
  - container logging: Implement none driver - "off", "null" or
    "none" all work.
  - ctrl: warn if we fail to unlink
  - Drop fsync calls
  - Reap PIDs before running exit command
  - Fix log path parsing
  - Add --sync option to prevent conmon from double forking
  - Add --no-sync-log option to instruct conmon to not sync the
    logs of the containers upon shutting down. This feature fixes a
    regression where we unconditionally dropped the log sync. It is
    possible the container logs could be corrupted on a sudden
    power-off. If you need container logs to remain in consistent
    state after a sudden shutdown, please update from v2.0.19 to
    v2.0.20</changelog>
  <changelog author="dmueller@suse.com" date="1600689600">- Update to version 2.0.21:
  * bump to v2.0.21
  * protect against kill(-1)
  * Makefile: enable debuginfo generation
  * Remove go.sum file and add go.mod
  * Fail if conmon config could not be written
  * nix: remove double definition for e2fsprogs
  * Speedup static build by utilizing CI cache on `/nix` folder
  * Fix nix build for failing e2fsprogs tests
  * test: fix CI
  * Use Podman for building</changelog>
  <changelog author="sgrunert@suse.com" date="1610452800">- Update to version 2.0.22:
  * added man page
  * attach: always chdir
  * conn_sock: Explicitly free a heap-allocated string
  * refactor I/O and add SD_NOTIFY proxy support</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1614254400">- Update to version 2.0.26:
  * conn_sock: do not fail on EAGAIN
  * fix segfault from a double freed pointer
  * Fix a bug where conmon could never spawn a container, because
    a disagreement between the caller and itself on where the attach
    socket was.
  * improve --full-attach to ignore the socket-dir directly. that
    means callers don't need to specify a socket dir at all (and
    can remove it)
  * add full-attach option to allow callers to not truncate a very
    long path for the attach socket
  * close only opened FDs
  * set locale to inherit environment</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1617105600">- Update to version 2.0.27:
  * bump to v2.0.27
  * Add CRI-O integration test GitHub action
  * exec: don't fail on EBADFD
  * close_fds: fix close of external fds
  * Add arm64 static build binary
  * bump to v2.0.27-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1627041600">- Update to version 2.0.29:
  * Reset OOM score back to 0 for container runtime
  * call functions registered with atexit on SIGTERM
  * conn_sock: fix potential segfault</changelog>
  <changelog author="info@paolostivanin.com" date="1632484800">- Update to version 2.0.30:
  * Remove unreachable code path
  * exit: report if the exit command was killed
  * exit: fix race zombie reaper
  * conn_sock: allow watchdog messages through the notify socket proxy
  * seccomp: add support for seccomp notify</changelog>
  <changelog author="rpm@fthiessen.de" date="1651752000">- Update to version 2.1.0
  * logging: buffer partial messages to journald
  * exit: close all fds &gt;= 3
  * fix: cgroup: Free memory_cgroup_file_path if open fails.
    Call g_free instead of free.
- Update to version 2.0.32
  * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
  * exit_command: Fix: unset subreaper attribute before running exit command
- Update to version 2.0.31
  * logging: new mode -l passthrough
  * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
  * conmon: Fix: free userdata files before exec cleanup</changelog>
  <changelog author="idesmi@protonmail.com" date="1656504000">- Update to version 2.1.2:
  * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285)
  * journald: print tag and name if both are specified
  * drop some logs to debug level</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- update to 2.1.3:
  * Port conmon to FreeBSD
  * Stop using g_unix_signal_add() to avoid threads
  * Rename CLI optionlog-size-global-max to log-global-size-max</changelog>
  <changelog author="fvogt@suse.com" date="1667563200">- Add patch to fix build with make &gt;= 4.4:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch</changelog>
  <changelog author="dcermak@suse.com" date="1669204800">- Update to version 2.1.5:
  * don't leak syslog_identifier
  * logging: do not read more that the buf size
  * logging: fix error handling
  * Makefile: Fix install for FreeBSD
  * signal: Track changes to get_signal_descriptor in the FreeBSD version
  * Packit: initial enablement
- Update to version 2.1.4:
  * Fix a bug where conmon crashed when it got a SIGCHLD</changelog>
</package>
<package pkgid="a47ad2a635b073a82b1f857f599c203060353950f9d18ee20b50be8f0f218405" name="conmon" arch="x86_64">
  <version epoch="0" ver="2.1.5" rel="150400.3.3.1"/>
  <changelog author="rhafer@suse.com" date="1582286400">- Update to v2.0.10 (bsc#1160460, bsc#1164390, jsc#ECO-1048,
  jsc#SLE-11485, jsc#SLE-11331):
  - journal logging: write to /dev/null instead of -1</changelog>
  <changelog author="sgrunert@suse.com" date="1583409600">- Update to v2.0.11
  - log: reject --log-tag with k8s-file
  - chmod std files pipes
  - adjust score to -1000 to prevent conmon from ever being OOM
    killed
  - container OOM: verify cgroup hasn't been cleaned up before
    reporting OOM</changelog>
  <changelog author="rhafer@suse.com" date="1584446400">- Update to v2.0.12
  - oom: fix potential race between verification steps</changelog>
  <changelog author="sgrunert@suse.com" date="1585137600">- Update to v2.0.14
  - drop usage of splice(2)
  - avoid hanging on stdin
  - stdio: sometimes quit main loop after io is done
  - ignore sigpipe</changelog>
  <changelog author="sgrunert@suse.com" date="1585915200">- Update to v2.0.15
  - store status while waiting for pid</changelog>
  <changelog author="rhafer@suse.com" date="1585915201">- Enable support for journald logging (bsc#1162432)</changelog>
  <changelog author="sgrunert@suse.com" date="1589803200">- Update to v2.0.16
  - tty: flush pending data when fd is ready</changelog>
  <changelog author="sgrunert@suse.com" date="1590580800">- Update to v2.0.17
  - Add option to delay execution of exit command</changelog>
  <changelog author="sgrunert@suse.com" date="1596024000">- Update to v2.0.20 (bsc#1175821)
  - journald: fix logging container name
  - container logging: Implement none driver - "off", "null" or
    "none" all work.
  - ctrl: warn if we fail to unlink
  - Drop fsync calls
  - Reap PIDs before running exit command
  - Fix log path parsing
  - Add --sync option to prevent conmon from double forking
  - Add --no-sync-log option to instruct conmon to not sync the
    logs of the containers upon shutting down. This feature fixes a
    regression where we unconditionally dropped the log sync. It is
    possible the container logs could be corrupted on a sudden
    power-off. If you need container logs to remain in consistent
    state after a sudden shutdown, please update from v2.0.19 to
    v2.0.20</changelog>
  <changelog author="dmueller@suse.com" date="1600689600">- Update to version 2.0.21:
  * bump to v2.0.21
  * protect against kill(-1)
  * Makefile: enable debuginfo generation
  * Remove go.sum file and add go.mod
  * Fail if conmon config could not be written
  * nix: remove double definition for e2fsprogs
  * Speedup static build by utilizing CI cache on `/nix` folder
  * Fix nix build for failing e2fsprogs tests
  * test: fix CI
  * Use Podman for building</changelog>
  <changelog author="sgrunert@suse.com" date="1610452800">- Update to version 2.0.22:
  * added man page
  * attach: always chdir
  * conn_sock: Explicitly free a heap-allocated string
  * refactor I/O and add SD_NOTIFY proxy support</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1614254400">- Update to version 2.0.26:
  * conn_sock: do not fail on EAGAIN
  * fix segfault from a double freed pointer
  * Fix a bug where conmon could never spawn a container, because
    a disagreement between the caller and itself on where the attach
    socket was.
  * improve --full-attach to ignore the socket-dir directly. that
    means callers don't need to specify a socket dir at all (and
    can remove it)
  * add full-attach option to allow callers to not truncate a very
    long path for the attach socket
  * close only opened FDs
  * set locale to inherit environment</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1617105600">- Update to version 2.0.27:
  * bump to v2.0.27
  * Add CRI-O integration test GitHub action
  * exec: don't fail on EBADFD
  * close_fds: fix close of external fds
  * Add arm64 static build binary
  * bump to v2.0.27-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1627041600">- Update to version 2.0.29:
  * Reset OOM score back to 0 for container runtime
  * call functions registered with atexit on SIGTERM
  * conn_sock: fix potential segfault</changelog>
  <changelog author="info@paolostivanin.com" date="1632484800">- Update to version 2.0.30:
  * Remove unreachable code path
  * exit: report if the exit command was killed
  * exit: fix race zombie reaper
  * conn_sock: allow watchdog messages through the notify socket proxy
  * seccomp: add support for seccomp notify</changelog>
  <changelog author="rpm@fthiessen.de" date="1651752000">- Update to version 2.1.0
  * logging: buffer partial messages to journald
  * exit: close all fds &gt;= 3
  * fix: cgroup: Free memory_cgroup_file_path if open fails.
    Call g_free instead of free.
- Update to version 2.0.32
  * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
  * exit_command: Fix: unset subreaper attribute before running exit command
- Update to version 2.0.31
  * logging: new mode -l passthrough
  * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
  * conmon: Fix: free userdata files before exec cleanup</changelog>
  <changelog author="idesmi@protonmail.com" date="1656504000">- Update to version 2.1.2:
  * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285)
  * journald: print tag and name if both are specified
  * drop some logs to debug level</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- update to 2.1.3:
  * Port conmon to FreeBSD
  * Stop using g_unix_signal_add() to avoid threads
  * Rename CLI optionlog-size-global-max to log-global-size-max</changelog>
  <changelog author="fvogt@suse.com" date="1667563200">- Add patch to fix build with make &gt;= 4.4:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch</changelog>
  <changelog author="dcermak@suse.com" date="1669204800">- Update to version 2.1.5:
  * don't leak syslog_identifier
  * logging: do not read more that the buf size
  * logging: fix error handling
  * Makefile: Fix install for FreeBSD
  * signal: Track changes to get_signal_descriptor in the FreeBSD version
  * Packit: initial enablement
- Update to version 2.1.4:
  * Fix a bug where conmon crashed when it got a SIGCHLD</changelog>
</package>
<package pkgid="0043c851d2a625f952dd15920ade8a694926d9a118e8180178c831f551f7b956" name="containerd" arch="aarch64">
  <version epoch="0" ver="1.6.12" rel="150000.79.1"/>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
</package>
<package pkgid="30e2f29abfa80815a178eb4510a6318ec37235f5c79b455059260e758d614d93" name="containerd" arch="src">
  <version epoch="0" ver="1.6.12" rel="150000.79.1"/>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
</package>
<package pkgid="7cbe67a37afc579c15f55b08d688a00167875eb2a11647680b49ee03c06c5aa8" name="containerd" arch="x86_64">
  <version epoch="0" ver="1.6.12" rel="150000.79.1"/>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
</package>
<package pkgid="18ef605341e1d27610a759af14657d87c3074a2e2f585ae6b805334ff171aab2" name="containerd" arch="aarch64">
  <version epoch="0" ver="1.6.16" rel="150000.82.2"/>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.0-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
</package>
<package pkgid="5c11792a490efb6d2f452a490dcf37102153c8d15a921bf8bf5d760f4dd9db95" name="containerd" arch="src">
  <version epoch="0" ver="1.6.16" rel="150000.82.2"/>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.0-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
</package>
<package pkgid="7a2567097a71041622e6648a63187adfdc23f9e2edb2cf6feefe50c2e6b503ab" name="containerd" arch="x86_64">
  <version epoch="0" ver="1.6.16" rel="150000.82.2"/>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.0-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
</package>
<package pkgid="bd4773bca2fa3208e9dea93dd92e07c14f347f9825872523341c64ba25029953" name="containerized-data-importer" arch="src">
  <version epoch="0" ver="1.51.0" rel="150400.4.10.4"/>
  <changelog author="vasily.ulyanov@suse.com" date="1618488000">- Drop csv-generator</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1619006400">- Preparation for submission to SLE15 SP2
  jsc#SLE-11089 jsc#ECO-3633</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1619697600">- Set default reg_path='registry.opensuse.org/kubevirt'
- Add _constraints file with disk requirements
- Drop CDI_VERSION env var since its not used during the build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1619697601">- Include release number into docker tag
- Add cdi_containers_meta build service</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621512000">- Disable changelog generation via tar_scm service (too verbose)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621512001">- Update to version 1.34.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.34.0</changelog>
  <changelog author="fvogt@suse.com" date="1622808000">- Add REGISTRY variable</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1623672000">- Use registry.suse.com as the default fallback for sle
- Rename macro registry_path to kubevirt_registry_path
- Update to version 1.35.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1625054400">- Generate meta info for containers during rpm build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1666008000">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
</package>
<package pkgid="995b37704ad69bbdcb115d945363c72585dc4ee17247461aa0e7de1f0088ff06" name="containerized-data-importer" arch="src">
  <version epoch="0" ver="1.51.0" rel="150400.4.7.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1617796800">- Update registry path</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1618488000">- Drop csv-generator</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1619006400">- Preparation for submission to SLE15 SP2
  jsc#SLE-11089 jsc#ECO-3633</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1619697600">- Set default reg_path='registry.opensuse.org/kubevirt'
- Add _constraints file with disk requirements
- Drop CDI_VERSION env var since its not used during the build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1619697601">- Include release number into docker tag
- Add cdi_containers_meta build service</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621512000">- Disable changelog generation via tar_scm service (too verbose)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621512001">- Update to version 1.34.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.34.0</changelog>
  <changelog author="fvogt@suse.com" date="1622808000">- Add REGISTRY variable</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1623672000">- Use registry.suse.com as the default fallback for sle
- Rename macro registry_path to kubevirt_registry_path
- Update to version 1.35.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1625054400">- Generate meta info for containers during rpm build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
</package>
<package pkgid="0155ba6f06b4fd7b3791608a9bd2566d37cc80d41d837c581043fb365b4fccaf" name="containerized-data-importer-manifests" arch="x86_64">
  <version epoch="0" ver="1.51.0" rel="150400.4.10.4"/>
  <changelog author="vasily.ulyanov@suse.com" date="1618488000">- Drop csv-generator</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1619006400">- Preparation for submission to SLE15 SP2
  jsc#SLE-11089 jsc#ECO-3633</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1619697600">- Set default reg_path='registry.opensuse.org/kubevirt'
- Add _constraints file with disk requirements
- Drop CDI_VERSION env var since its not used during the build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1619697601">- Include release number into docker tag
- Add cdi_containers_meta build service</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621512000">- Disable changelog generation via tar_scm service (too verbose)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621512001">- Update to version 1.34.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.34.0</changelog>
  <changelog author="fvogt@suse.com" date="1622808000">- Add REGISTRY variable</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1623672000">- Use registry.suse.com as the default fallback for sle
- Rename macro registry_path to kubevirt_registry_path
- Update to version 1.35.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1625054400">- Generate meta info for containers during rpm build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1666008000">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
</package>
<package pkgid="b1ce8dadac76af5e2134b276b434ef051ea93cc89e4be7fdf4c338f604735c6f" name="containerized-data-importer-manifests" arch="x86_64">
  <version epoch="0" ver="1.51.0" rel="150400.4.7.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1617796800">- Update registry path</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1618488000">- Drop csv-generator</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1619006400">- Preparation for submission to SLE15 SP2
  jsc#SLE-11089 jsc#ECO-3633</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1619697600">- Set default reg_path='registry.opensuse.org/kubevirt'
- Add _constraints file with disk requirements
- Drop CDI_VERSION env var since its not used during the build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1619697601">- Include release number into docker tag
- Add cdi_containers_meta build service</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621512000">- Disable changelog generation via tar_scm service (too verbose)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621512001">- Update to version 1.34.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.34.0</changelog>
  <changelog author="fvogt@suse.com" date="1622808000">- Add REGISTRY variable</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1623672000">- Use registry.suse.com as the default fallback for sle
- Rename macro registry_path to kubevirt_registry_path
- Update to version 1.35.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1625054400">- Generate meta info for containers during rpm build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
</package>
<package pkgid="23357d93beff51818e7a687b244dd7c2140b788139c41aed300f81d020bd718f" name="curl" arch="aarch64">
  <version epoch="0" ver="7.79.1" rel="150400.5.12.1"/>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622030400">- Update to 7.77.0: [bsc#1186114, CVE-2021-22898]
  [bsc#1186115, bsc#1185579, CVE-2021-22901]
  * Security fixes:
  - CVE-2021-22297: schannel cipher selection surprise
  - CVE-2021-22298: TELNET stack contents disclosure
  - CVE-2021-22901: TLS session caching disaster
  * Changes:
  - configure: make the TLS library choice(s) explicit
  - curl: ignore options asking for SSLv2 or SSLv3
  - hsts: enable by default
  - SSL: support in-memory CA certs for some backends
  - vtls: refuse setting any SSL version
  * Bugfixes:
  - configure: provide --with-openssl, deprecate --with-ssl
  - cookie: CURLOPT_COOKIEFILE set to NULL switches off cookies
  - curl: include libmetalink version in --version output
  - data_pending: check only SECONDARY socket for FTP(S) transfers
  - gnutls: don't allow TLS 1.3 for versions that don't support it
  - gnutls: make setting only the MAX TLS allowed version work
  - http2: fix resource leaks in set_transfer_url() and push_promise()
  - http: limit the initial send amount to used upload buffer size
  - rustls: only return CURLE_AGAIN when TLS session is fully drained
  - rustls: use ALPN
  - schannel: Disable auto credentials; add an option to enable it
  - schannel: Support strong crypto option
  - sectransp: allow cipher name to be specified
  - sockfilt: avoid getting stuck waiting for writable socket</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
</package>
<package pkgid="5bcde0ba5871cce947864c2ebac879d1243e0a544294f20a669502d00f44103a" name="curl" arch="src">
  <version epoch="0" ver="7.79.1" rel="150400.5.12.1"/>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622030400">- Update to 7.77.0: [bsc#1186114, CVE-2021-22898]
  [bsc#1186115, bsc#1185579, CVE-2021-22901]
  * Security fixes:
  - CVE-2021-22297: schannel cipher selection surprise
  - CVE-2021-22298: TELNET stack contents disclosure
  - CVE-2021-22901: TLS session caching disaster
  * Changes:
  - configure: make the TLS library choice(s) explicit
  - curl: ignore options asking for SSLv2 or SSLv3
  - hsts: enable by default
  - SSL: support in-memory CA certs for some backends
  - vtls: refuse setting any SSL version
  * Bugfixes:
  - configure: provide --with-openssl, deprecate --with-ssl
  - cookie: CURLOPT_COOKIEFILE set to NULL switches off cookies
  - curl: include libmetalink version in --version output
  - data_pending: check only SECONDARY socket for FTP(S) transfers
  - gnutls: don't allow TLS 1.3 for versions that don't support it
  - gnutls: make setting only the MAX TLS allowed version work
  - http2: fix resource leaks in set_transfer_url() and push_promise()
  - http: limit the initial send amount to used upload buffer size
  - rustls: only return CURLE_AGAIN when TLS session is fully drained
  - rustls: use ALPN
  - schannel: Disable auto credentials; add an option to enable it
  - schannel: Support strong crypto option
  - sectransp: allow cipher name to be specified
  - sockfilt: avoid getting stuck waiting for writable socket</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
</package>
<package pkgid="faef2fbf64d5a24eca65f60b47fa1a91bf5ddb2d3b4e33f1f984e4f8ff244c2b" name="curl" arch="x86_64">
  <version epoch="0" ver="7.79.1" rel="150400.5.12.1"/>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622030400">- Update to 7.77.0: [bsc#1186114, CVE-2021-22898]
  [bsc#1186115, bsc#1185579, CVE-2021-22901]
  * Security fixes:
  - CVE-2021-22297: schannel cipher selection surprise
  - CVE-2021-22298: TELNET stack contents disclosure
  - CVE-2021-22901: TLS session caching disaster
  * Changes:
  - configure: make the TLS library choice(s) explicit
  - curl: ignore options asking for SSLv2 or SSLv3
  - hsts: enable by default
  - SSL: support in-memory CA certs for some backends
  - vtls: refuse setting any SSL version
  * Bugfixes:
  - configure: provide --with-openssl, deprecate --with-ssl
  - cookie: CURLOPT_COOKIEFILE set to NULL switches off cookies
  - curl: include libmetalink version in --version output
  - data_pending: check only SECONDARY socket for FTP(S) transfers
  - gnutls: don't allow TLS 1.3 for versions that don't support it
  - gnutls: make setting only the MAX TLS allowed version work
  - http2: fix resource leaks in set_transfer_url() and push_promise()
  - http: limit the initial send amount to used upload buffer size
  - rustls: only return CURLE_AGAIN when TLS session is fully drained
  - rustls: use ALPN
  - schannel: Disable auto credentials; add an option to enable it
  - schannel: Support strong crypto option
  - sectransp: allow cipher name to be specified
  - sockfilt: avoid getting stuck waiting for writable socket</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
</package>
<package pkgid="4b725e25f9e3c8c2349107b597f202ccc1c0e638c5bfd35f7eb37d4b7fea6518" name="curl" arch="aarch64">
  <version epoch="0" ver="7.79.1" rel="150400.5.15.1"/>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
</package>
<package pkgid="ed2e441c6f0369e24bf78de598ce4d63fb5975a21612c736a9c9dfc508c82741" name="curl" arch="src">
  <version epoch="0" ver="7.79.1" rel="150400.5.15.1"/>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
</package>
<package pkgid="062d3fd30362198775f131c6aa5f053cbfbf28c7ba5f169bf1957f89e04f67e3" name="curl" arch="x86_64">
  <version epoch="0" ver="7.79.1" rel="150400.5.15.1"/>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
</package>
<package pkgid="754243d7d3aaa61e721d3a5f5fb64932a387b85090bc55b5c43427ff3f3f9581" name="curl" arch="aarch64">
  <version epoch="0" ver="7.79.1" rel="150400.5.18.1"/>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678708800">- Security fixes:
  * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection
    Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch
  * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy
    Add curl-CVE-2023-27534.patch
  * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse
    Add curl-CVE-2023-27535.patch
  * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use
    Add curl-CVE-2023-27536.patch
  * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still
    Add curl-CVE-2023-27538.patch</changelog>
</package>
<package pkgid="04a9c6ad0b29f6fe5ec1fa7a4428c9c305b9b71de2aaec75bf9a7b0d974d63e4" name="curl" arch="src">
  <version epoch="0" ver="7.79.1" rel="150400.5.18.1"/>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678708800">- Security fixes:
  * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection
    Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch
  * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy
    Add curl-CVE-2023-27534.patch
  * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse
    Add curl-CVE-2023-27535.patch
  * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use
    Add curl-CVE-2023-27536.patch
  * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still
    Add curl-CVE-2023-27538.patch</changelog>
</package>
<package pkgid="e5ff12b5fc97cfdc2a895799af9ec6c78019d5216d024c601549352d6769ecee" name="curl" arch="x86_64">
  <version epoch="0" ver="7.79.1" rel="150400.5.18.1"/>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678708800">- Security fixes:
  * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection
    Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch
  * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy
    Add curl-CVE-2023-27534.patch
  * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse
    Add curl-CVE-2023-27535.patch
  * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use
    Add curl-CVE-2023-27536.patch
  * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still
    Add curl-CVE-2023-27538.patch</changelog>
</package>
<package pkgid="7240b970819d6e6a2495834e671478ad8e2d9eb980c495abceefb5fe96c241af" name="db48-utils" arch="aarch64">
  <version epoch="0" ver="4.8.30" rel="150000.7.6.1"/>
  <changelog author="coolo@suse.com" date="1374580800">- readd the provides of db-*, we're not going to switch to db 6.0
  too eagerly: http://lwn.net/Articles/557487/</changelog>
  <changelog author="jengelh@inai.de" date="1381233600">- Add update-alternatives rules to db48-utils (bnc#840738)</changelog>
  <changelog author="coolo@suse.com" date="1382356800">- fix update-alternatives usage</changelog>
  <changelog author="schwab@suse.de" date="1399896000">- remove generation of unused tarball
- remove setting of unused variable</changelog>
  <changelog author="tchvatal@suse.com" date="1459425600">- Use upstream tarball
- Cleanup a bit with spec-cleaner
- remove unused script check-build.sh</changelog>
  <changelog author="rguenther@suse.com" date="1520942400">- Add libdb-fix-atomic.patch to fix __atomic_compare_exchange clash
  with GCCs builtin.  Fixes build with GCC8 which now rejects this.</changelog>
  <changelog author="tchvatal@suse.com" date="1545307200">- Fix the license to match up really what is in there</changelog>
  <changelog author="tchvatal@suse.com" date="1566216000">- Remove the getpatches as it does not work at all, oracle
  removed the pages
- Use spec-cleaner
- Fix stripped debuginfo to make sure we can debug with libdb</changelog>
  <changelog author="william.brown@suse.com" date="1566907200">- Add opd deadlock patch as found and documented by Red Hat.
  (bsc#1148244)
  * 0001-OPD-deadlock-RH-BZ-1349779.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668513600">- Security fix: [bsc#1174414, CVE-2019-2708]
  * libdb: Data store execution leads to partial DoS
  * Backport the upsteam commits:
  - Fixed several possible crashes when running db_verify
    on a corrupted database. [#27864]
  - Fixed several possible hangs when running db_verify
    on a corrupted database. [#27864]
  - Added a warning message when attempting to verify a queue
    database which has many extent files. Verification will take
    a long time if there are many extent files. [#27864]
  * Add libdb-4_8-CVE-2019-2708.patch</changelog>
</package>
<package pkgid="bf090c90906276585b37e4b83099001e2af1c589e89e2ae708f848292f69c312" name="db48-utils" arch="x86_64">
  <version epoch="0" ver="4.8.30" rel="150000.7.6.1"/>
  <changelog author="coolo@suse.com" date="1374580800">- readd the provides of db-*, we're not going to switch to db 6.0
  too eagerly: http://lwn.net/Articles/557487/</changelog>
  <changelog author="jengelh@inai.de" date="1381233600">- Add update-alternatives rules to db48-utils (bnc#840738)</changelog>
  <changelog author="coolo@suse.com" date="1382356800">- fix update-alternatives usage</changelog>
  <changelog author="schwab@suse.de" date="1399896000">- remove generation of unused tarball
- remove setting of unused variable</changelog>
  <changelog author="tchvatal@suse.com" date="1459425600">- Use upstream tarball
- Cleanup a bit with spec-cleaner
- remove unused script check-build.sh</changelog>
  <changelog author="rguenther@suse.com" date="1520942400">- Add libdb-fix-atomic.patch to fix __atomic_compare_exchange clash
  with GCCs builtin.  Fixes build with GCC8 which now rejects this.</changelog>
  <changelog author="tchvatal@suse.com" date="1545307200">- Fix the license to match up really what is in there</changelog>
  <changelog author="tchvatal@suse.com" date="1566216000">- Remove the getpatches as it does not work at all, oracle
  removed the pages
- Use spec-cleaner
- Fix stripped debuginfo to make sure we can debug with libdb</changelog>
  <changelog author="william.brown@suse.com" date="1566907200">- Add opd deadlock patch as found and documented by Red Hat.
  (bsc#1148244)
  * 0001-OPD-deadlock-RH-BZ-1349779.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668513600">- Security fix: [bsc#1174414, CVE-2019-2708]
  * libdb: Data store execution leads to partial DoS
  * Backport the upsteam commits:
  - Fixed several possible crashes when running db_verify
    on a corrupted database. [#27864]
  - Fixed several possible hangs when running db_verify
    on a corrupted database. [#27864]
  - Added a warning message when attempting to verify a queue
    database which has many extent files. Verification will take
    a long time if there are many extent files. [#27864]
  * Add libdb-4_8-CVE-2019-2708.patch</changelog>
</package>
<package pkgid="ad3c89860ab75732dffe327ecc1edbeee5a387cda3aee2ffbbb6c5ad91def825" name="device-mapper" arch="aarch64">
  <version epoch="0" ver="2.03.05_1.02.163" rel="150400.185.1"/>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1647172800">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  + change lvm.conf item external_device_info_source from none to udev
  + bug-1179691_config-set-external_device_info_source-none.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1659528000">- lvm reports udev database has incomplete information on devices (bsc#1202011)
  + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1664193600">- lvmlockd is not supporting sanlock (bsc#1203482)
  - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="dfb05849eac11a9818726b5519d6d9e2f9e291c6fcfa89fab3f68d5b7147e1b6" name="device-mapper" arch="x86_64">
  <version epoch="0" ver="2.03.05_1.02.163" rel="150400.185.1"/>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1647172800">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  + change lvm.conf item external_device_info_source from none to udev
  + bug-1179691_config-set-external_device_info_source-none.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1659528000">- lvm reports udev database has incomplete information on devices (bsc#1202011)
  + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1664193600">- lvmlockd is not supporting sanlock (bsc#1203482)
  - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="f4c350424211a3f43714ff0c4157e6fb645e81a937bfc1a224858aa1ca15b5f6" name="docker" arch="aarch64">
  <version epoch="0" ver="20.10.23_ce" rel="150000.175.1"/>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20105&gt;. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20106&gt;. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20109&gt;. bsc#1191355
  CVE-2021-41089 bsc#1191015 CVE-2021-41091 bsc#1191434
  CVE-2021-41092 bsc#1191334 CVE-2021-41103 bsc#1191121
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637236800">- Update to Docker 20.10.11-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201011&gt;. bsc#1192814
  bsc#1193273 CVE-2021-41190
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
- Remove upstreamed patches:
  - 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to Docker 20.10.12-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201012&gt;.
- Remove CHANGELOG.md. It hasn't been maintained since 2017, and all of the
  changelogs are currently only available online.</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to Docker 20.10.14-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201014&gt;. bsc#1197517
  CVE-2022-24769</changelog>
  <changelog author="asarai@suse.com" date="1651233600">- Add patch to update golang.org/x/crypto for CVE-2021-43565 and CVE-2022-27191.
  bsc#1193930 bsc#1197284
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to Docker 20.10.17-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201017&gt;. bsc#1200145
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch</changelog>
  <changelog author="asarai@suse.com" date="1656504000">- Backport &lt;https://github.com/containerd/fifo/pull/32&gt; to fix a crash-on-start
  issue with dockerd. bsc#1200022
  + 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1658059200">- Change to using systemd-sysusers</changelog>
  <changelog author="fcrozat@suse.com" date="1659009600">- Allow to install container-selinux instead of apparmor-parser.</changelog>
  <changelog author="fvogt@suse.com" date="1664452800">- Fix syntax of boolean dependency</changelog>
  <changelog author="asarai@suse.com" date="1664452801">- Add apparmor-parser as a Recommends to make sure that most users will end up
  with it installed even if they are primarily running SELinux.</changelog>
  <changelog author="dcermak@suse.com" date="1666612800">- Fix wrong After: in docker.service, fixes bsc#1188447</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to Docker 20.10.21-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201021&gt;. bsc#1206065
  bsc#1205375 CVE-2022-36109
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- The PRIVATE-REGISTRY patch will now output a warning if it is being used (in
  preparation for removing the feature). This feature was never meant to be
  used by users directly (and is only available in the -kubic/CaaSP version of
  the package anyway) and thus should not affect any users.</changelog>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
</package>
<package pkgid="ca05523d844fd47448e5c0b7c8fb3464e59ad2c1830cd1183202b480968dd6c6" name="docker" arch="src">
  <version epoch="0" ver="20.10.23_ce" rel="150000.175.1"/>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20105&gt;. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20106&gt;. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20109&gt;. bsc#1191355
  CVE-2021-41089 bsc#1191015 CVE-2021-41091 bsc#1191434
  CVE-2021-41092 bsc#1191334 CVE-2021-41103 bsc#1191121
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637236800">- Update to Docker 20.10.11-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201011&gt;. bsc#1192814
  bsc#1193273 CVE-2021-41190
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
- Remove upstreamed patches:
  - 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to Docker 20.10.12-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201012&gt;.
- Remove CHANGELOG.md. It hasn't been maintained since 2017, and all of the
  changelogs are currently only available online.</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to Docker 20.10.14-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201014&gt;. bsc#1197517
  CVE-2022-24769</changelog>
  <changelog author="asarai@suse.com" date="1651233600">- Add patch to update golang.org/x/crypto for CVE-2021-43565 and CVE-2022-27191.
  bsc#1193930 bsc#1197284
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to Docker 20.10.17-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201017&gt;. bsc#1200145
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch</changelog>
  <changelog author="asarai@suse.com" date="1656504000">- Backport &lt;https://github.com/containerd/fifo/pull/32&gt; to fix a crash-on-start
  issue with dockerd. bsc#1200022
  + 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1658059200">- Change to using systemd-sysusers</changelog>
  <changelog author="fcrozat@suse.com" date="1659009600">- Allow to install container-selinux instead of apparmor-parser.</changelog>
  <changelog author="fvogt@suse.com" date="1664452800">- Fix syntax of boolean dependency</changelog>
  <changelog author="asarai@suse.com" date="1664452801">- Add apparmor-parser as a Recommends to make sure that most users will end up
  with it installed even if they are primarily running SELinux.</changelog>
  <changelog author="dcermak@suse.com" date="1666612800">- Fix wrong After: in docker.service, fixes bsc#1188447</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to Docker 20.10.21-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201021&gt;. bsc#1206065
  bsc#1205375 CVE-2022-36109
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- The PRIVATE-REGISTRY patch will now output a warning if it is being used (in
  preparation for removing the feature). This feature was never meant to be
  used by users directly (and is only available in the -kubic/CaaSP version of
  the package anyway) and thus should not affect any users.</changelog>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
</package>
<package pkgid="980f4a5c1b6e58a388199575d1041fa5953b9480cdc564e06bcf46f0e4bdbdcc" name="docker" arch="x86_64">
  <version epoch="0" ver="20.10.23_ce" rel="150000.175.1"/>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20105&gt;. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20106&gt;. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20109&gt;. bsc#1191355
  CVE-2021-41089 bsc#1191015 CVE-2021-41091 bsc#1191434
  CVE-2021-41092 bsc#1191334 CVE-2021-41103 bsc#1191121
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637236800">- Update to Docker 20.10.11-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201011&gt;. bsc#1192814
  bsc#1193273 CVE-2021-41190
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
- Remove upstreamed patches:
  - 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to Docker 20.10.12-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201012&gt;.
- Remove CHANGELOG.md. It hasn't been maintained since 2017, and all of the
  changelogs are currently only available online.</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to Docker 20.10.14-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201014&gt;. bsc#1197517
  CVE-2022-24769</changelog>
  <changelog author="asarai@suse.com" date="1651233600">- Add patch to update golang.org/x/crypto for CVE-2021-43565 and CVE-2022-27191.
  bsc#1193930 bsc#1197284
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to Docker 20.10.17-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201017&gt;. bsc#1200145
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch</changelog>
  <changelog author="asarai@suse.com" date="1656504000">- Backport &lt;https://github.com/containerd/fifo/pull/32&gt; to fix a crash-on-start
  issue with dockerd. bsc#1200022
  + 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1658059200">- Change to using systemd-sysusers</changelog>
  <changelog author="fcrozat@suse.com" date="1659009600">- Allow to install container-selinux instead of apparmor-parser.</changelog>
  <changelog author="fvogt@suse.com" date="1664452800">- Fix syntax of boolean dependency</changelog>
  <changelog author="asarai@suse.com" date="1664452801">- Add apparmor-parser as a Recommends to make sure that most users will end up
  with it installed even if they are primarily running SELinux.</changelog>
  <changelog author="dcermak@suse.com" date="1666612800">- Fix wrong After: in docker.service, fixes bsc#1188447</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to Docker 20.10.21-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201021&gt;. bsc#1206065
  bsc#1205375 CVE-2022-36109
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- The PRIVATE-REGISTRY patch will now output a warning if it is being used (in
  preparation for removing the feature). This feature was never meant to be
  used by users directly (and is only available in the -kubic/CaaSP version of
  the package anyway) and thus should not affect any users.</changelog>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
</package>
<package pkgid="0db64bfa46b702d6e49d8b3ae082d1b1a7b7aae35e072aec36a08a0099bc2f44" name="dracut" arch="aarch64">
  <version epoch="0" ver="055+suse.331.g05b9ccb7" rel="150400.3.16.1"/>
  <changelog author="thomas.blume@suse.com" date="1637582400">- Update to version 055+suse.148.g65e8258f:
  * fix(dracut.spec): update dependency for suse-module-tools</changelog>
  <changelog author="thomas.blume@suse.com" date="1639051200">- Update to version 055+suse.179.g3cf989c2:
  * fix(cpio): write zeros instead of seek for padding and alignment (bsc#1190982)
  * fix(dracut.sh): check kernel zstd support early
  * fix(dracut.sh): check availability of configured compression
  * fix(dracut.sh): inform user about auto-selected compression method
  * fix(dracut.sh): drop pointless check for module compression method
  * chore(suse): add dracut-cpio archiver (jsc#SLE-16157)
  * ci(TEST-63-DRACUT-CPIO): kernel extraction tests for dracut-cpio
  * feat(dracut.sh): add "--enhanced-cpio" option for calling dracut-cpio
  * feat(Makefile): cargo wrapper for dracut-cpio build
  * feat(cpio): add newc archive creation utility
  * feat(cpio): add rust argument parsing library from crosvm
  * ci(TEST-62-SKIPCPIO): add simple skipcpio test
  * ci(test): export basedir and testdir as absolute paths
  * ci(TEST-60-BONDBRIDGEVLANIFCFG): use toplevel Makefile
  * fix(dracut.spec): check for non-usrmerged environments
  * fix(zfcp_rules): add quotes around rule installation argument
  * fix(zipl): correct argument for uuid to device conversion
  * fix(fips): missing value of _vmname variable (bsc#1193267)
  * chore(suse): add fido2 module (jsc#SLE-21070)
  * feat(crypt): check if fido2 module is needed in hostonly mode (jsc#SLE-21070)
  * feat(fido2): introducing the fido2 module (jsc#SLE-21070)
  * feat(crypt): check if tpm2-tss module is needed in hostonly mode (jsc#SLE-21070)
  * fix(dracut-functions.sh): get block device driver if in a virtual subsystem (bsc#1189776)
  * fix(mdraid): allow UUID comparison for more than one UUID (bsc#1192665)</changelog>
  <changelog author="thomas.blume@suse.com" date="1639137600">- Update to version 055+suse.183.g7d569585:
  * fix(dracut.spec): update usrmerged mkinitrd dir
  * fix(url-lib): improve ca-bundle detection (bsc#1175892)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420800">- Update to version 055+suse.191.g67eb4ea8:
  * fix(dracut-initramfs-restore.sh): add test for SUSE initrd name (bsc#1194570)
  * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
  * fix(network-wicked): multiple path corrections
  * fix(drm): add privacy screen modules to the initrd (bsc#1193590)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420801">- Update to version 055+suse.194.gdd41932a:
  * fix(network-legacy): add wicked as an alternative to arping (bsc#1193670)
  * fix(network): add wicked as an alternative to arping (bsc#1193670)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1643371200">- Update to version 055+suse.226.g44139dde:
  * fix(zfcp_rules): remove collect based udev rule creators
  * fix(dasd_rules): remove collect based udev rule creators
  * fix(kernel-modules-extra): handle zstd module extension
  * fix(ifcfg): add SUSE specific write-ifcfg file (bsc#1193518)
  * fix(dracut-functions): skip iSCSI sessions without initiatorname (bsc#1195011)
  * fix(dracut-functions.sh): ip route parsing (bsc#1195011)
  * fix(fips): missing sourcing of dracut-lib
  * fix(fips): wrong error message
  * fix(network-legacy): install only existing SUSE specific files (bsc#1194879)
  * fix(network-legacy): set dhclient as optional (bsc#1194879)
  * fix(40network): consistent use of "$gw" for gateway (bsc#1192685)
  * fix(multipathd-configure.service): drop unneeded dependencies
  * fix(multipath): check if mpathconf is available
  * fix(multipathd.service): drop dependencies on iscsi and iscsid
  * fix(multipathd.service): adapt to upstream multipath-tools unit file
  * fix(multipathd.service): remove dependency on systemd-udev-settle
  * fix(fips): avoid shellcheck warnings
  * fix(fips): get _vmname value only if it is needed
  * fix(fips.sh): respect rd.fips.skipkernel
  * fix(fips): alignment with the upstream format</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665403200">- Update to version 055+suse.302.gc7aee2dc:
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1666699200">- Update to version 055+suse.323.gca0e74f0:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(network-legacy): misleading duplicate address detection using wicked
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.331.g05b9ccb7:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
</package>
<package pkgid="da0365936ac340cf4fad53082b26ad83628803a25b86bed9f8d25fbf1969ab1d" name="dracut" arch="src">
  <version epoch="0" ver="055+suse.331.g05b9ccb7" rel="150400.3.16.1"/>
  <changelog author="thomas.blume@suse.com" date="1637582400">- Update to version 055+suse.148.g65e8258f:
  * fix(dracut.spec): update dependency for suse-module-tools</changelog>
  <changelog author="thomas.blume@suse.com" date="1639051200">- Update to version 055+suse.179.g3cf989c2:
  * fix(cpio): write zeros instead of seek for padding and alignment (bsc#1190982)
  * fix(dracut.sh): check kernel zstd support early
  * fix(dracut.sh): check availability of configured compression
  * fix(dracut.sh): inform user about auto-selected compression method
  * fix(dracut.sh): drop pointless check for module compression method
  * chore(suse): add dracut-cpio archiver (jsc#SLE-16157)
  * ci(TEST-63-DRACUT-CPIO): kernel extraction tests for dracut-cpio
  * feat(dracut.sh): add "--enhanced-cpio" option for calling dracut-cpio
  * feat(Makefile): cargo wrapper for dracut-cpio build
  * feat(cpio): add newc archive creation utility
  * feat(cpio): add rust argument parsing library from crosvm
  * ci(TEST-62-SKIPCPIO): add simple skipcpio test
  * ci(test): export basedir and testdir as absolute paths
  * ci(TEST-60-BONDBRIDGEVLANIFCFG): use toplevel Makefile
  * fix(dracut.spec): check for non-usrmerged environments
  * fix(zfcp_rules): add quotes around rule installation argument
  * fix(zipl): correct argument for uuid to device conversion
  * fix(fips): missing value of _vmname variable (bsc#1193267)
  * chore(suse): add fido2 module (jsc#SLE-21070)
  * feat(crypt): check if fido2 module is needed in hostonly mode (jsc#SLE-21070)
  * feat(fido2): introducing the fido2 module (jsc#SLE-21070)
  * feat(crypt): check if tpm2-tss module is needed in hostonly mode (jsc#SLE-21070)
  * fix(dracut-functions.sh): get block device driver if in a virtual subsystem (bsc#1189776)
  * fix(mdraid): allow UUID comparison for more than one UUID (bsc#1192665)</changelog>
  <changelog author="thomas.blume@suse.com" date="1639137600">- Update to version 055+suse.183.g7d569585:
  * fix(dracut.spec): update usrmerged mkinitrd dir
  * fix(url-lib): improve ca-bundle detection (bsc#1175892)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420800">- Update to version 055+suse.191.g67eb4ea8:
  * fix(dracut-initramfs-restore.sh): add test for SUSE initrd name (bsc#1194570)
  * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
  * fix(network-wicked): multiple path corrections
  * fix(drm): add privacy screen modules to the initrd (bsc#1193590)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420801">- Update to version 055+suse.194.gdd41932a:
  * fix(network-legacy): add wicked as an alternative to arping (bsc#1193670)
  * fix(network): add wicked as an alternative to arping (bsc#1193670)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1643371200">- Update to version 055+suse.226.g44139dde:
  * fix(zfcp_rules): remove collect based udev rule creators
  * fix(dasd_rules): remove collect based udev rule creators
  * fix(kernel-modules-extra): handle zstd module extension
  * fix(ifcfg): add SUSE specific write-ifcfg file (bsc#1193518)
  * fix(dracut-functions): skip iSCSI sessions without initiatorname (bsc#1195011)
  * fix(dracut-functions.sh): ip route parsing (bsc#1195011)
  * fix(fips): missing sourcing of dracut-lib
  * fix(fips): wrong error message
  * fix(network-legacy): install only existing SUSE specific files (bsc#1194879)
  * fix(network-legacy): set dhclient as optional (bsc#1194879)
  * fix(40network): consistent use of "$gw" for gateway (bsc#1192685)
  * fix(multipathd-configure.service): drop unneeded dependencies
  * fix(multipath): check if mpathconf is available
  * fix(multipathd.service): drop dependencies on iscsi and iscsid
  * fix(multipathd.service): adapt to upstream multipath-tools unit file
  * fix(multipathd.service): remove dependency on systemd-udev-settle
  * fix(fips): avoid shellcheck warnings
  * fix(fips): get _vmname value only if it is needed
  * fix(fips.sh): respect rd.fips.skipkernel
  * fix(fips): alignment with the upstream format</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665403200">- Update to version 055+suse.302.gc7aee2dc:
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1666699200">- Update to version 055+suse.323.gca0e74f0:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(network-legacy): misleading duplicate address detection using wicked
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.331.g05b9ccb7:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
</package>
<package pkgid="074e04d960cb942409854fe5f422554d6f2f3ae3241aaa26f1deda19e839b2bd" name="dracut" arch="x86_64">
  <version epoch="0" ver="055+suse.331.g05b9ccb7" rel="150400.3.16.1"/>
  <changelog author="thomas.blume@suse.com" date="1637582400">- Update to version 055+suse.148.g65e8258f:
  * fix(dracut.spec): update dependency for suse-module-tools</changelog>
  <changelog author="thomas.blume@suse.com" date="1639051200">- Update to version 055+suse.179.g3cf989c2:
  * fix(cpio): write zeros instead of seek for padding and alignment (bsc#1190982)
  * fix(dracut.sh): check kernel zstd support early
  * fix(dracut.sh): check availability of configured compression
  * fix(dracut.sh): inform user about auto-selected compression method
  * fix(dracut.sh): drop pointless check for module compression method
  * chore(suse): add dracut-cpio archiver (jsc#SLE-16157)
  * ci(TEST-63-DRACUT-CPIO): kernel extraction tests for dracut-cpio
  * feat(dracut.sh): add "--enhanced-cpio" option for calling dracut-cpio
  * feat(Makefile): cargo wrapper for dracut-cpio build
  * feat(cpio): add newc archive creation utility
  * feat(cpio): add rust argument parsing library from crosvm
  * ci(TEST-62-SKIPCPIO): add simple skipcpio test
  * ci(test): export basedir and testdir as absolute paths
  * ci(TEST-60-BONDBRIDGEVLANIFCFG): use toplevel Makefile
  * fix(dracut.spec): check for non-usrmerged environments
  * fix(zfcp_rules): add quotes around rule installation argument
  * fix(zipl): correct argument for uuid to device conversion
  * fix(fips): missing value of _vmname variable (bsc#1193267)
  * chore(suse): add fido2 module (jsc#SLE-21070)
  * feat(crypt): check if fido2 module is needed in hostonly mode (jsc#SLE-21070)
  * feat(fido2): introducing the fido2 module (jsc#SLE-21070)
  * feat(crypt): check if tpm2-tss module is needed in hostonly mode (jsc#SLE-21070)
  * fix(dracut-functions.sh): get block device driver if in a virtual subsystem (bsc#1189776)
  * fix(mdraid): allow UUID comparison for more than one UUID (bsc#1192665)</changelog>
  <changelog author="thomas.blume@suse.com" date="1639137600">- Update to version 055+suse.183.g7d569585:
  * fix(dracut.spec): update usrmerged mkinitrd dir
  * fix(url-lib): improve ca-bundle detection (bsc#1175892)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420800">- Update to version 055+suse.191.g67eb4ea8:
  * fix(dracut-initramfs-restore.sh): add test for SUSE initrd name (bsc#1194570)
  * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
  * fix(network-wicked): multiple path corrections
  * fix(drm): add privacy screen modules to the initrd (bsc#1193590)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420801">- Update to version 055+suse.194.gdd41932a:
  * fix(network-legacy): add wicked as an alternative to arping (bsc#1193670)
  * fix(network): add wicked as an alternative to arping (bsc#1193670)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1643371200">- Update to version 055+suse.226.g44139dde:
  * fix(zfcp_rules): remove collect based udev rule creators
  * fix(dasd_rules): remove collect based udev rule creators
  * fix(kernel-modules-extra): handle zstd module extension
  * fix(ifcfg): add SUSE specific write-ifcfg file (bsc#1193518)
  * fix(dracut-functions): skip iSCSI sessions without initiatorname (bsc#1195011)
  * fix(dracut-functions.sh): ip route parsing (bsc#1195011)
  * fix(fips): missing sourcing of dracut-lib
  * fix(fips): wrong error message
  * fix(network-legacy): install only existing SUSE specific files (bsc#1194879)
  * fix(network-legacy): set dhclient as optional (bsc#1194879)
  * fix(40network): consistent use of "$gw" for gateway (bsc#1192685)
  * fix(multipathd-configure.service): drop unneeded dependencies
  * fix(multipath): check if mpathconf is available
  * fix(multipathd.service): drop dependencies on iscsi and iscsid
  * fix(multipathd.service): adapt to upstream multipath-tools unit file
  * fix(multipathd.service): remove dependency on systemd-udev-settle
  * fix(fips): avoid shellcheck warnings
  * fix(fips): get _vmname value only if it is needed
  * fix(fips.sh): respect rd.fips.skipkernel
  * fix(fips): alignment with the upstream format</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665403200">- Update to version 055+suse.302.gc7aee2dc:
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1666699200">- Update to version 055+suse.323.gca0e74f0:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(network-legacy): misleading duplicate address detection using wicked
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.331.g05b9ccb7:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
</package>
<package pkgid="502b4c43e4ad0c4c527f491e3b826da6142c5f85d457fe88fefce57b0d2fc550" name="dracut-fips" arch="aarch64">
  <version epoch="0" ver="055+suse.331.g05b9ccb7" rel="150400.3.16.1"/>
  <changelog author="thomas.blume@suse.com" date="1637582400">- Update to version 055+suse.148.g65e8258f:
  * fix(dracut.spec): update dependency for suse-module-tools</changelog>
  <changelog author="thomas.blume@suse.com" date="1639051200">- Update to version 055+suse.179.g3cf989c2:
  * fix(cpio): write zeros instead of seek for padding and alignment (bsc#1190982)
  * fix(dracut.sh): check kernel zstd support early
  * fix(dracut.sh): check availability of configured compression
  * fix(dracut.sh): inform user about auto-selected compression method
  * fix(dracut.sh): drop pointless check for module compression method
  * chore(suse): add dracut-cpio archiver (jsc#SLE-16157)
  * ci(TEST-63-DRACUT-CPIO): kernel extraction tests for dracut-cpio
  * feat(dracut.sh): add "--enhanced-cpio" option for calling dracut-cpio
  * feat(Makefile): cargo wrapper for dracut-cpio build
  * feat(cpio): add newc archive creation utility
  * feat(cpio): add rust argument parsing library from crosvm
  * ci(TEST-62-SKIPCPIO): add simple skipcpio test
  * ci(test): export basedir and testdir as absolute paths
  * ci(TEST-60-BONDBRIDGEVLANIFCFG): use toplevel Makefile
  * fix(dracut.spec): check for non-usrmerged environments
  * fix(zfcp_rules): add quotes around rule installation argument
  * fix(zipl): correct argument for uuid to device conversion
  * fix(fips): missing value of _vmname variable (bsc#1193267)
  * chore(suse): add fido2 module (jsc#SLE-21070)
  * feat(crypt): check if fido2 module is needed in hostonly mode (jsc#SLE-21070)
  * feat(fido2): introducing the fido2 module (jsc#SLE-21070)
  * feat(crypt): check if tpm2-tss module is needed in hostonly mode (jsc#SLE-21070)
  * fix(dracut-functions.sh): get block device driver if in a virtual subsystem (bsc#1189776)
  * fix(mdraid): allow UUID comparison for more than one UUID (bsc#1192665)</changelog>
  <changelog author="thomas.blume@suse.com" date="1639137600">- Update to version 055+suse.183.g7d569585:
  * fix(dracut.spec): update usrmerged mkinitrd dir
  * fix(url-lib): improve ca-bundle detection (bsc#1175892)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420800">- Update to version 055+suse.191.g67eb4ea8:
  * fix(dracut-initramfs-restore.sh): add test for SUSE initrd name (bsc#1194570)
  * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
  * fix(network-wicked): multiple path corrections
  * fix(drm): add privacy screen modules to the initrd (bsc#1193590)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420801">- Update to version 055+suse.194.gdd41932a:
  * fix(network-legacy): add wicked as an alternative to arping (bsc#1193670)
  * fix(network): add wicked as an alternative to arping (bsc#1193670)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1643371200">- Update to version 055+suse.226.g44139dde:
  * fix(zfcp_rules): remove collect based udev rule creators
  * fix(dasd_rules): remove collect based udev rule creators
  * fix(kernel-modules-extra): handle zstd module extension
  * fix(ifcfg): add SUSE specific write-ifcfg file (bsc#1193518)
  * fix(dracut-functions): skip iSCSI sessions without initiatorname (bsc#1195011)
  * fix(dracut-functions.sh): ip route parsing (bsc#1195011)
  * fix(fips): missing sourcing of dracut-lib
  * fix(fips): wrong error message
  * fix(network-legacy): install only existing SUSE specific files (bsc#1194879)
  * fix(network-legacy): set dhclient as optional (bsc#1194879)
  * fix(40network): consistent use of "$gw" for gateway (bsc#1192685)
  * fix(multipathd-configure.service): drop unneeded dependencies
  * fix(multipath): check if mpathconf is available
  * fix(multipathd.service): drop dependencies on iscsi and iscsid
  * fix(multipathd.service): adapt to upstream multipath-tools unit file
  * fix(multipathd.service): remove dependency on systemd-udev-settle
  * fix(fips): avoid shellcheck warnings
  * fix(fips): get _vmname value only if it is needed
  * fix(fips.sh): respect rd.fips.skipkernel
  * fix(fips): alignment with the upstream format</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665403200">- Update to version 055+suse.302.gc7aee2dc:
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1666699200">- Update to version 055+suse.323.gca0e74f0:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(network-legacy): misleading duplicate address detection using wicked
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.331.g05b9ccb7:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
</package>
<package pkgid="5c2f612ebbd3db2faec09116135f559df32d11ae013cc05e1390565f0002aaa9" name="dracut-fips" arch="x86_64">
  <version epoch="0" ver="055+suse.331.g05b9ccb7" rel="150400.3.16.1"/>
  <changelog author="thomas.blume@suse.com" date="1637582400">- Update to version 055+suse.148.g65e8258f:
  * fix(dracut.spec): update dependency for suse-module-tools</changelog>
  <changelog author="thomas.blume@suse.com" date="1639051200">- Update to version 055+suse.179.g3cf989c2:
  * fix(cpio): write zeros instead of seek for padding and alignment (bsc#1190982)
  * fix(dracut.sh): check kernel zstd support early
  * fix(dracut.sh): check availability of configured compression
  * fix(dracut.sh): inform user about auto-selected compression method
  * fix(dracut.sh): drop pointless check for module compression method
  * chore(suse): add dracut-cpio archiver (jsc#SLE-16157)
  * ci(TEST-63-DRACUT-CPIO): kernel extraction tests for dracut-cpio
  * feat(dracut.sh): add "--enhanced-cpio" option for calling dracut-cpio
  * feat(Makefile): cargo wrapper for dracut-cpio build
  * feat(cpio): add newc archive creation utility
  * feat(cpio): add rust argument parsing library from crosvm
  * ci(TEST-62-SKIPCPIO): add simple skipcpio test
  * ci(test): export basedir and testdir as absolute paths
  * ci(TEST-60-BONDBRIDGEVLANIFCFG): use toplevel Makefile
  * fix(dracut.spec): check for non-usrmerged environments
  * fix(zfcp_rules): add quotes around rule installation argument
  * fix(zipl): correct argument for uuid to device conversion
  * fix(fips): missing value of _vmname variable (bsc#1193267)
  * chore(suse): add fido2 module (jsc#SLE-21070)
  * feat(crypt): check if fido2 module is needed in hostonly mode (jsc#SLE-21070)
  * feat(fido2): introducing the fido2 module (jsc#SLE-21070)
  * feat(crypt): check if tpm2-tss module is needed in hostonly mode (jsc#SLE-21070)
  * fix(dracut-functions.sh): get block device driver if in a virtual subsystem (bsc#1189776)
  * fix(mdraid): allow UUID comparison for more than one UUID (bsc#1192665)</changelog>
  <changelog author="thomas.blume@suse.com" date="1639137600">- Update to version 055+suse.183.g7d569585:
  * fix(dracut.spec): update usrmerged mkinitrd dir
  * fix(url-lib): improve ca-bundle detection (bsc#1175892)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420800">- Update to version 055+suse.191.g67eb4ea8:
  * fix(dracut-initramfs-restore.sh): add test for SUSE initrd name (bsc#1194570)
  * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
  * fix(network-wicked): multiple path corrections
  * fix(drm): add privacy screen modules to the initrd (bsc#1193590)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420801">- Update to version 055+suse.194.gdd41932a:
  * fix(network-legacy): add wicked as an alternative to arping (bsc#1193670)
  * fix(network): add wicked as an alternative to arping (bsc#1193670)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1643371200">- Update to version 055+suse.226.g44139dde:
  * fix(zfcp_rules): remove collect based udev rule creators
  * fix(dasd_rules): remove collect based udev rule creators
  * fix(kernel-modules-extra): handle zstd module extension
  * fix(ifcfg): add SUSE specific write-ifcfg file (bsc#1193518)
  * fix(dracut-functions): skip iSCSI sessions without initiatorname (bsc#1195011)
  * fix(dracut-functions.sh): ip route parsing (bsc#1195011)
  * fix(fips): missing sourcing of dracut-lib
  * fix(fips): wrong error message
  * fix(network-legacy): install only existing SUSE specific files (bsc#1194879)
  * fix(network-legacy): set dhclient as optional (bsc#1194879)
  * fix(40network): consistent use of "$gw" for gateway (bsc#1192685)
  * fix(multipathd-configure.service): drop unneeded dependencies
  * fix(multipath): check if mpathconf is available
  * fix(multipathd.service): drop dependencies on iscsi and iscsid
  * fix(multipathd.service): adapt to upstream multipath-tools unit file
  * fix(multipathd.service): remove dependency on systemd-udev-settle
  * fix(fips): avoid shellcheck warnings
  * fix(fips): get _vmname value only if it is needed
  * fix(fips.sh): respect rd.fips.skipkernel
  * fix(fips): alignment with the upstream format</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665403200">- Update to version 055+suse.302.gc7aee2dc:
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1666699200">- Update to version 055+suse.323.gca0e74f0:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(network-legacy): misleading duplicate address detection using wicked
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.331.g05b9ccb7:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
</package>
<package pkgid="8727427f3ee72426cebd0f309e86a3cb904d86a4cd89b5870508993a011552ac" name="dracut-kiwi-lib" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="34b3c729c3af5c483151ff3bb6bf8493790f0367c5a18b99d1646cab47eef43d" name="dracut-kiwi-lib" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="c02513e37a9327def791fec532b87b2a0fd7aa1ea596ef16f6f3c01445927610" name="dracut-kiwi-oem-dump" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="fb8913ec09da781c655350b427dfb683f1c1b84e90058ae2e9d959b9ce27ea5c" name="dracut-kiwi-oem-dump" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="e81b7ae9e4218a7f69b3f943e59b35c6feaaacc81082edca6df3ed9763a05033" name="dracut-kiwi-oem-repart" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="f9657925f6e7fc1f97ec6a285d45dfb37b4c8d66f8dbc3bbc091d802116b819c" name="dracut-kiwi-oem-repart" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="607991abadd3d273d454ec01e43e0df18798beb2e089bfe2b1ea33b0d01063b8" name="dracut-mkinitrd-deprecated" arch="aarch64">
  <version epoch="0" ver="055+suse.331.g05b9ccb7" rel="150400.3.16.1"/>
  <changelog author="thomas.blume@suse.com" date="1637582400">- Update to version 055+suse.148.g65e8258f:
  * fix(dracut.spec): update dependency for suse-module-tools</changelog>
  <changelog author="thomas.blume@suse.com" date="1639051200">- Update to version 055+suse.179.g3cf989c2:
  * fix(cpio): write zeros instead of seek for padding and alignment (bsc#1190982)
  * fix(dracut.sh): check kernel zstd support early
  * fix(dracut.sh): check availability of configured compression
  * fix(dracut.sh): inform user about auto-selected compression method
  * fix(dracut.sh): drop pointless check for module compression method
  * chore(suse): add dracut-cpio archiver (jsc#SLE-16157)
  * ci(TEST-63-DRACUT-CPIO): kernel extraction tests for dracut-cpio
  * feat(dracut.sh): add "--enhanced-cpio" option for calling dracut-cpio
  * feat(Makefile): cargo wrapper for dracut-cpio build
  * feat(cpio): add newc archive creation utility
  * feat(cpio): add rust argument parsing library from crosvm
  * ci(TEST-62-SKIPCPIO): add simple skipcpio test
  * ci(test): export basedir and testdir as absolute paths
  * ci(TEST-60-BONDBRIDGEVLANIFCFG): use toplevel Makefile
  * fix(dracut.spec): check for non-usrmerged environments
  * fix(zfcp_rules): add quotes around rule installation argument
  * fix(zipl): correct argument for uuid to device conversion
  * fix(fips): missing value of _vmname variable (bsc#1193267)
  * chore(suse): add fido2 module (jsc#SLE-21070)
  * feat(crypt): check if fido2 module is needed in hostonly mode (jsc#SLE-21070)
  * feat(fido2): introducing the fido2 module (jsc#SLE-21070)
  * feat(crypt): check if tpm2-tss module is needed in hostonly mode (jsc#SLE-21070)
  * fix(dracut-functions.sh): get block device driver if in a virtual subsystem (bsc#1189776)
  * fix(mdraid): allow UUID comparison for more than one UUID (bsc#1192665)</changelog>
  <changelog author="thomas.blume@suse.com" date="1639137600">- Update to version 055+suse.183.g7d569585:
  * fix(dracut.spec): update usrmerged mkinitrd dir
  * fix(url-lib): improve ca-bundle detection (bsc#1175892)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420800">- Update to version 055+suse.191.g67eb4ea8:
  * fix(dracut-initramfs-restore.sh): add test for SUSE initrd name (bsc#1194570)
  * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
  * fix(network-wicked): multiple path corrections
  * fix(drm): add privacy screen modules to the initrd (bsc#1193590)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420801">- Update to version 055+suse.194.gdd41932a:
  * fix(network-legacy): add wicked as an alternative to arping (bsc#1193670)
  * fix(network): add wicked as an alternative to arping (bsc#1193670)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1643371200">- Update to version 055+suse.226.g44139dde:
  * fix(zfcp_rules): remove collect based udev rule creators
  * fix(dasd_rules): remove collect based udev rule creators
  * fix(kernel-modules-extra): handle zstd module extension
  * fix(ifcfg): add SUSE specific write-ifcfg file (bsc#1193518)
  * fix(dracut-functions): skip iSCSI sessions without initiatorname (bsc#1195011)
  * fix(dracut-functions.sh): ip route parsing (bsc#1195011)
  * fix(fips): missing sourcing of dracut-lib
  * fix(fips): wrong error message
  * fix(network-legacy): install only existing SUSE specific files (bsc#1194879)
  * fix(network-legacy): set dhclient as optional (bsc#1194879)
  * fix(40network): consistent use of "$gw" for gateway (bsc#1192685)
  * fix(multipathd-configure.service): drop unneeded dependencies
  * fix(multipath): check if mpathconf is available
  * fix(multipathd.service): drop dependencies on iscsi and iscsid
  * fix(multipathd.service): adapt to upstream multipath-tools unit file
  * fix(multipathd.service): remove dependency on systemd-udev-settle
  * fix(fips): avoid shellcheck warnings
  * fix(fips): get _vmname value only if it is needed
  * fix(fips.sh): respect rd.fips.skipkernel
  * fix(fips): alignment with the upstream format</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665403200">- Update to version 055+suse.302.gc7aee2dc:
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1666699200">- Update to version 055+suse.323.gca0e74f0:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(network-legacy): misleading duplicate address detection using wicked
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.331.g05b9ccb7:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
</package>
<package pkgid="1968c2262f62e065c508e9c896e1bc81c33a8ffda8718249abee06638744d76f" name="dracut-mkinitrd-deprecated" arch="x86_64">
  <version epoch="0" ver="055+suse.331.g05b9ccb7" rel="150400.3.16.1"/>
  <changelog author="thomas.blume@suse.com" date="1637582400">- Update to version 055+suse.148.g65e8258f:
  * fix(dracut.spec): update dependency for suse-module-tools</changelog>
  <changelog author="thomas.blume@suse.com" date="1639051200">- Update to version 055+suse.179.g3cf989c2:
  * fix(cpio): write zeros instead of seek for padding and alignment (bsc#1190982)
  * fix(dracut.sh): check kernel zstd support early
  * fix(dracut.sh): check availability of configured compression
  * fix(dracut.sh): inform user about auto-selected compression method
  * fix(dracut.sh): drop pointless check for module compression method
  * chore(suse): add dracut-cpio archiver (jsc#SLE-16157)
  * ci(TEST-63-DRACUT-CPIO): kernel extraction tests for dracut-cpio
  * feat(dracut.sh): add "--enhanced-cpio" option for calling dracut-cpio
  * feat(Makefile): cargo wrapper for dracut-cpio build
  * feat(cpio): add newc archive creation utility
  * feat(cpio): add rust argument parsing library from crosvm
  * ci(TEST-62-SKIPCPIO): add simple skipcpio test
  * ci(test): export basedir and testdir as absolute paths
  * ci(TEST-60-BONDBRIDGEVLANIFCFG): use toplevel Makefile
  * fix(dracut.spec): check for non-usrmerged environments
  * fix(zfcp_rules): add quotes around rule installation argument
  * fix(zipl): correct argument for uuid to device conversion
  * fix(fips): missing value of _vmname variable (bsc#1193267)
  * chore(suse): add fido2 module (jsc#SLE-21070)
  * feat(crypt): check if fido2 module is needed in hostonly mode (jsc#SLE-21070)
  * feat(fido2): introducing the fido2 module (jsc#SLE-21070)
  * feat(crypt): check if tpm2-tss module is needed in hostonly mode (jsc#SLE-21070)
  * fix(dracut-functions.sh): get block device driver if in a virtual subsystem (bsc#1189776)
  * fix(mdraid): allow UUID comparison for more than one UUID (bsc#1192665)</changelog>
  <changelog author="thomas.blume@suse.com" date="1639137600">- Update to version 055+suse.183.g7d569585:
  * fix(dracut.spec): update usrmerged mkinitrd dir
  * fix(url-lib): improve ca-bundle detection (bsc#1175892)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420800">- Update to version 055+suse.191.g67eb4ea8:
  * fix(dracut-initramfs-restore.sh): add test for SUSE initrd name (bsc#1194570)
  * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
  * fix(network-wicked): multiple path corrections
  * fix(drm): add privacy screen modules to the initrd (bsc#1193590)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642420801">- Update to version 055+suse.194.gdd41932a:
  * fix(network-legacy): add wicked as an alternative to arping (bsc#1193670)
  * fix(network): add wicked as an alternative to arping (bsc#1193670)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1643371200">- Update to version 055+suse.226.g44139dde:
  * fix(zfcp_rules): remove collect based udev rule creators
  * fix(dasd_rules): remove collect based udev rule creators
  * fix(kernel-modules-extra): handle zstd module extension
  * fix(ifcfg): add SUSE specific write-ifcfg file (bsc#1193518)
  * fix(dracut-functions): skip iSCSI sessions without initiatorname (bsc#1195011)
  * fix(dracut-functions.sh): ip route parsing (bsc#1195011)
  * fix(fips): missing sourcing of dracut-lib
  * fix(fips): wrong error message
  * fix(network-legacy): install only existing SUSE specific files (bsc#1194879)
  * fix(network-legacy): set dhclient as optional (bsc#1194879)
  * fix(40network): consistent use of "$gw" for gateway (bsc#1192685)
  * fix(multipathd-configure.service): drop unneeded dependencies
  * fix(multipath): check if mpathconf is available
  * fix(multipathd.service): drop dependencies on iscsi and iscsid
  * fix(multipathd.service): adapt to upstream multipath-tools unit file
  * fix(multipathd.service): remove dependency on systemd-udev-settle
  * fix(fips): avoid shellcheck warnings
  * fix(fips): get _vmname value only if it is needed
  * fix(fips.sh): respect rd.fips.skipkernel
  * fix(fips): alignment with the upstream format</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1644840000">- Update to version 055+suse.230.g3fdde49a:
  * fix(dasd_rules): correct udev dasd rules parsing (bsc#1195309)
  * revert(lvm): remove 69-dm-lvm-metad.rules (bsc#1195604)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645099200">- Update to version 055+suse.234.gbdaf66ff:
  * fix(tpm2-tss): install SUSE specific files (bsc#1195984)
  * fix(systemd-sysusers): override systemd-sysusers.service (bsc#1195983)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1645185600">- Update to version 055+suse.238.gacab0df5:
  * fix(cpio): correct dev_t -&gt; rmajor/rminor mapping (bsc#1195808)
  * ci(cpio): add test_archive_dev_maj_min (bsc#1195808)
  * ci(cpio): add TempWorkDir.create_tmp_mknod helper (bsc#1195808)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665403200">- Update to version 055+suse.302.gc7aee2dc:
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1666699200">- Update to version 055+suse.323.gca0e74f0:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(network-legacy): misleading duplicate address detection using wicked
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.331.g05b9ccb7:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
</package>
<package pkgid="96f5ed983e2991c46236aa402e5a2b65e8df5e91d67092a3c8a409d0e1f72913" name="drbd-utils" arch="aarch64">
  <version epoch="0" ver="9.19.0" rel="150400.3.6.1"/>
  <changelog author="nwang@suse.com" date="1567771200">- Update to 9.10.0
  * drbdmon: limit desplay lenght, minor fixes
  * drbdsetup,v9: avoid underflow when resync regresses
  * drbdmeta,v9: allow huge (~1PB volumes)
  * drbdsetup,v9: add allow-remote-read flag(9.0.19)
  * docker: switch to UBI images
  * doc: update JA doc</changelog>
  <changelog author="nwang@suse.com" date="1567771201">- Support Kernel 5.2, bsc#1149945 and bsc#1144702
- Add patch netlink-prepare-for-kernel-v5.2.patch
  Add patch netlink-Add-NLA_F_NESTED-flag-to-nested-attribute.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1145296, fix the wrong return code with cib_apply_diff
  Add patch cibadmin-return-code-convert.patch</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to 9.12.0
  * drbd.ocf: new wrc_timeout param, fail on attach failure,
  remove_master_score_if_peer_primary param,
  fail_promote_early_if_peer_primary param, improved helper logging
  no error if wait-connect fails
  * drbdadm,v9: fix dumping meta-disk in corner case
  * crm-fence-peer.9.sh: fix Pacemaker 2 compat
  * drbdsetup,v9: fixes for various json output corner cases
  * drbdsetup,all: prepare for netlink changes (linux v5.2+)
  * drbdadm,v9: fix a check for setting up connections multiple times
  * init: setup file backed loop devices (mapping from LINSTOR)
  * rr-conflict: add retry-connect option (&gt;=drbd 9.0.20)
  * drbdmon: 256/16 colors; events2 handler improvements
  * drbdsetup,v9: new flag: force-resync (&gt;=drbd 9.0.21)
- Remove netlink-prepare-for-kernel-v5.2.patch
  Remove netlink-Add-NLA_F_NESTED-flag-to-nested-attribute.patch
  Remove cibadmin-return-code-convert.patch in 144c8cc1d</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166200 ,fix crm-fence-peer regex issue with pacemaker 2.
- Add patch crm-fence-peer-pacemaker2.patch</changelog>
  <changelog author="nwang@suse.com" date="1589025600">- bsc#1171419, Update to 9.13.0
  * crm-fence-peer{,.9}.sh: detect Pacemaker 2 promotable clones
  * submodules: switch to https, which makes it easier to clone
  if you are behind some weird company firewalls.
  * drbd.service: start pacemaker before drbd-proxy
  * windrbd: various new commands including create-resource-from-url,
  set-syslog-ip, scan-partitions-for-minor, install-bus-device,
  remove-bus-device
- Remove patch crm-fence-peer-pacemaker2.patch</changelog>
  <changelog author="nwang@suse.com" date="1591617600">- bsc#1172641, fix the link error of setup_option.
  Add patch link-error-setup_option.patch</changelog>
  <changelog author="nwang@suse.com" date="1599220800">- bsc#1176065, fail to get master id from cib xml in fence handler
  Add patch crm-fence-peer-pacemaker2-issue2.patch</changelog>
  <changelog author="nwang@suse.com" date="1599825600">- bsc#1176436, update to 9.14.0
  * pacemaker: various fixes/improvements for PM &gt;=1.1.15
  including the 2 series; crm-fence-peer.9.sh
  * systemd dependency for drbd-proxy
  * containers: multi-arch support, especially for s390x
  * multipathd: blacklist drbd
  * drbdsetup: code refactoring and improvements,
  as well as tests for events2!
  add "may_promote", "promotion_score". See man page.
  * build: compile fixes for gcc-10; CI pipeline
  * handlers: add "disconnected"
- Remove patch crm-fence-peer-pacemaker2-issue2.patch (included)
  Remove patch link-error-setup_option.patch (included)</changelog>
  <changelog author="ohering@suse.de" date="1602504000">- Move block-drbd back to /etc/xen/scripts (bsc#1177531)
  The change in xen.spec was reverted, but the revert was not applied
  to this pkg</changelog>
  <changelog author="lnussel@suse.de" date="1605614400">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add pie-fix.patch: explicitly pass -pie linker flag when building drbdmon.
  The Makefile explicitly passes -fPIC, thereby breaking our gcc-PIE profile.
  In addition the Makefile also ignores CXXFLAGS and LDFLAGS passed via the
  environment. Therefore fix it with this patch. This makes drbdmon a PIE
  binary (bsc#1184122, bsc#1185132).</changelog>
  <changelog author="nwang@suse.com" date="1626868800">- Update to 9.18.0 (bsc#1189363)
  * build: remove rpm related targets
  * drbdsetup,v84: fix minor compile warnings
  * systemd: resource specific activation
  * systemd: drbd-reactor promoter templates
  * doc: fix maximum ping timeout
  * doc: add man pages for the systemd templates
  * drbdadm,v9: fix dstate for diskless volumes
  * build/release: use lbvers.py
  * drbd-attr: don't leak fd to drbdsetup
  * doc: various fixes and additions
  * drbdsetup,events2,v9: add backing_device
  * build,Debian: rm dh-systemd dependency
  * drbdsetup,events2,v9: fix --poll regression
  * drbdmeta: fix bug with ALs with small final extents
  * build,Debian: rm mail recommends
  * drbdsetup,events2,v9: allow --poll without --now
  * drbdsetup,invalidate: allow bitmap based resync after verify
  * drbdadm,sh-ll-dev: change output to "none" if diskless
  * drbd-attr/may_promote: fixes from 9.15.1
  * drbdadm,v9: allow set-gi in single node clusters
  * drbsetup,events2,v9: diff(erential) output
  * drbsetup,events2,v9: add --full output
  * v9: allow resource rename, also in drbdmon
  * drbdadm,v9: allow c-max-rate to be disabled
  * New drbd-attr Pacemaker RA
  * events2: handle mixed initial state and multicast events
  * events2: fix regression to always print resync done
- Add patch systemd-drbd-service-needs-network-online.patch</changelog>
  <changelog author="nwang@suse.com" date="1631880000">- bsc#1190591, fail to start due to lack of /usr/var/run/drbd</changelog>
  <changelog author="nwang@suse.com" date="1633953600">- Update to 9.19.0
  * v9,events2: show changes of peer-client
  * v9: rr-conflict strategy auto-discard for protocol A
  * windrbd: various fixes including setting the systemd root
  * containers: switch to UBI8
  * v9,wait-*: fix segfault
- bsc#1191058, active UsrMerge to install in /usr
  Add patch usrmerge_move_lib_to_prefix_lib.patch
- Remove patch fix-libdir-in-Makefile.patch
  Remove patch systemd-drbd-service-needs-network-online.patch (included)
- Add drbd-utils.rpmlintrc for Error missing-call-to-setgroups-before-setuid
- Add rpmlint-build-error.patch to fix rpmbuild build errors</changelog>
  <changelog author="zzhou@suse.com" date="1663329600">- restore drbd scripts back to /usr/lib/drbd from /lib/drbd (bsc#1203220)
  Update drbd-utils.spec
- fix drbd-bash-completion
  Update rpmlint-build-error.patch</changelog>
  <changelog author="zzhou@suse.com" date="1663761600">- drbd-utils.spec force _localstatedir to use /var/lib in runtime (bsc#1203220)</changelog>
  <changelog author="zzhou@suse.com" date="1665748800">- bsc#1204276 remove crm-fence-peer.sh for drbd8 to avoid confusion with v9</changelog>
</package>
<package pkgid="554d7387507fea6d8d5653f4b68227234b73c152d6172bc9a34996ad75d9ebb4" name="drbd-utils" arch="src">
  <version epoch="0" ver="9.19.0" rel="150400.3.6.1"/>
  <changelog author="nwang@suse.com" date="1567771200">- Update to 9.10.0
  * drbdmon: limit desplay lenght, minor fixes
  * drbdsetup,v9: avoid underflow when resync regresses
  * drbdmeta,v9: allow huge (~1PB volumes)
  * drbdsetup,v9: add allow-remote-read flag(9.0.19)
  * docker: switch to UBI images
  * doc: update JA doc</changelog>
  <changelog author="nwang@suse.com" date="1567771201">- Support Kernel 5.2, bsc#1149945 and bsc#1144702
- Add patch netlink-prepare-for-kernel-v5.2.patch
  Add patch netlink-Add-NLA_F_NESTED-flag-to-nested-attribute.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1145296, fix the wrong return code with cib_apply_diff
  Add patch cibadmin-return-code-convert.patch</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to 9.12.0
  * drbd.ocf: new wrc_timeout param, fail on attach failure,
  remove_master_score_if_peer_primary param,
  fail_promote_early_if_peer_primary param, improved helper logging
  no error if wait-connect fails
  * drbdadm,v9: fix dumping meta-disk in corner case
  * crm-fence-peer.9.sh: fix Pacemaker 2 compat
  * drbdsetup,v9: fixes for various json output corner cases
  * drbdsetup,all: prepare for netlink changes (linux v5.2+)
  * drbdadm,v9: fix a check for setting up connections multiple times
  * init: setup file backed loop devices (mapping from LINSTOR)
  * rr-conflict: add retry-connect option (&gt;=drbd 9.0.20)
  * drbdmon: 256/16 colors; events2 handler improvements
  * drbdsetup,v9: new flag: force-resync (&gt;=drbd 9.0.21)
- Remove netlink-prepare-for-kernel-v5.2.patch
  Remove netlink-Add-NLA_F_NESTED-flag-to-nested-attribute.patch
  Remove cibadmin-return-code-convert.patch in 144c8cc1d</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166200 ,fix crm-fence-peer regex issue with pacemaker 2.
- Add patch crm-fence-peer-pacemaker2.patch</changelog>
  <changelog author="nwang@suse.com" date="1589025600">- bsc#1171419, Update to 9.13.0
  * crm-fence-peer{,.9}.sh: detect Pacemaker 2 promotable clones
  * submodules: switch to https, which makes it easier to clone
  if you are behind some weird company firewalls.
  * drbd.service: start pacemaker before drbd-proxy
  * windrbd: various new commands including create-resource-from-url,
  set-syslog-ip, scan-partitions-for-minor, install-bus-device,
  remove-bus-device
- Remove patch crm-fence-peer-pacemaker2.patch</changelog>
  <changelog author="nwang@suse.com" date="1591617600">- bsc#1172641, fix the link error of setup_option.
  Add patch link-error-setup_option.patch</changelog>
  <changelog author="nwang@suse.com" date="1599220800">- bsc#1176065, fail to get master id from cib xml in fence handler
  Add patch crm-fence-peer-pacemaker2-issue2.patch</changelog>
  <changelog author="nwang@suse.com" date="1599825600">- bsc#1176436, update to 9.14.0
  * pacemaker: various fixes/improvements for PM &gt;=1.1.15
  including the 2 series; crm-fence-peer.9.sh
  * systemd dependency for drbd-proxy
  * containers: multi-arch support, especially for s390x
  * multipathd: blacklist drbd
  * drbdsetup: code refactoring and improvements,
  as well as tests for events2!
  add "may_promote", "promotion_score". See man page.
  * build: compile fixes for gcc-10; CI pipeline
  * handlers: add "disconnected"
- Remove patch crm-fence-peer-pacemaker2-issue2.patch (included)
  Remove patch link-error-setup_option.patch (included)</changelog>
  <changelog author="ohering@suse.de" date="1602504000">- Move block-drbd back to /etc/xen/scripts (bsc#1177531)
  The change in xen.spec was reverted, but the revert was not applied
  to this pkg</changelog>
  <changelog author="lnussel@suse.de" date="1605614400">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add pie-fix.patch: explicitly pass -pie linker flag when building drbdmon.
  The Makefile explicitly passes -fPIC, thereby breaking our gcc-PIE profile.
  In addition the Makefile also ignores CXXFLAGS and LDFLAGS passed via the
  environment. Therefore fix it with this patch. This makes drbdmon a PIE
  binary (bsc#1184122, bsc#1185132).</changelog>
  <changelog author="nwang@suse.com" date="1626868800">- Update to 9.18.0 (bsc#1189363)
  * build: remove rpm related targets
  * drbdsetup,v84: fix minor compile warnings
  * systemd: resource specific activation
  * systemd: drbd-reactor promoter templates
  * doc: fix maximum ping timeout
  * doc: add man pages for the systemd templates
  * drbdadm,v9: fix dstate for diskless volumes
  * build/release: use lbvers.py
  * drbd-attr: don't leak fd to drbdsetup
  * doc: various fixes and additions
  * drbdsetup,events2,v9: add backing_device
  * build,Debian: rm dh-systemd dependency
  * drbdsetup,events2,v9: fix --poll regression
  * drbdmeta: fix bug with ALs with small final extents
  * build,Debian: rm mail recommends
  * drbdsetup,events2,v9: allow --poll without --now
  * drbdsetup,invalidate: allow bitmap based resync after verify
  * drbdadm,sh-ll-dev: change output to "none" if diskless
  * drbd-attr/may_promote: fixes from 9.15.1
  * drbdadm,v9: allow set-gi in single node clusters
  * drbsetup,events2,v9: diff(erential) output
  * drbsetup,events2,v9: add --full output
  * v9: allow resource rename, also in drbdmon
  * drbdadm,v9: allow c-max-rate to be disabled
  * New drbd-attr Pacemaker RA
  * events2: handle mixed initial state and multicast events
  * events2: fix regression to always print resync done
- Add patch systemd-drbd-service-needs-network-online.patch</changelog>
  <changelog author="nwang@suse.com" date="1631880000">- bsc#1190591, fail to start due to lack of /usr/var/run/drbd</changelog>
  <changelog author="nwang@suse.com" date="1633953600">- Update to 9.19.0
  * v9,events2: show changes of peer-client
  * v9: rr-conflict strategy auto-discard for protocol A
  * windrbd: various fixes including setting the systemd root
  * containers: switch to UBI8
  * v9,wait-*: fix segfault
- bsc#1191058, active UsrMerge to install in /usr
  Add patch usrmerge_move_lib_to_prefix_lib.patch
- Remove patch fix-libdir-in-Makefile.patch
  Remove patch systemd-drbd-service-needs-network-online.patch (included)
- Add drbd-utils.rpmlintrc for Error missing-call-to-setgroups-before-setuid
- Add rpmlint-build-error.patch to fix rpmbuild build errors</changelog>
  <changelog author="zzhou@suse.com" date="1663329600">- restore drbd scripts back to /usr/lib/drbd from /lib/drbd (bsc#1203220)
  Update drbd-utils.spec
- fix drbd-bash-completion
  Update rpmlint-build-error.patch</changelog>
  <changelog author="zzhou@suse.com" date="1663761600">- drbd-utils.spec force _localstatedir to use /var/lib in runtime (bsc#1203220)</changelog>
  <changelog author="zzhou@suse.com" date="1665748800">- bsc#1204276 remove crm-fence-peer.sh for drbd8 to avoid confusion with v9</changelog>
</package>
<package pkgid="d584ef2672c0fd62cf331281062c935e6c1c5350e107c3df136a54da9bab2b09" name="drbd-utils" arch="x86_64">
  <version epoch="0" ver="9.19.0" rel="150400.3.6.1"/>
  <changelog author="nwang@suse.com" date="1567771200">- Update to 9.10.0
  * drbdmon: limit desplay lenght, minor fixes
  * drbdsetup,v9: avoid underflow when resync regresses
  * drbdmeta,v9: allow huge (~1PB volumes)
  * drbdsetup,v9: add allow-remote-read flag(9.0.19)
  * docker: switch to UBI images
  * doc: update JA doc</changelog>
  <changelog author="nwang@suse.com" date="1567771201">- Support Kernel 5.2, bsc#1149945 and bsc#1144702
- Add patch netlink-prepare-for-kernel-v5.2.patch
  Add patch netlink-Add-NLA_F_NESTED-flag-to-nested-attribute.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1145296, fix the wrong return code with cib_apply_diff
  Add patch cibadmin-return-code-convert.patch</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to 9.12.0
  * drbd.ocf: new wrc_timeout param, fail on attach failure,
  remove_master_score_if_peer_primary param,
  fail_promote_early_if_peer_primary param, improved helper logging
  no error if wait-connect fails
  * drbdadm,v9: fix dumping meta-disk in corner case
  * crm-fence-peer.9.sh: fix Pacemaker 2 compat
  * drbdsetup,v9: fixes for various json output corner cases
  * drbdsetup,all: prepare for netlink changes (linux v5.2+)
  * drbdadm,v9: fix a check for setting up connections multiple times
  * init: setup file backed loop devices (mapping from LINSTOR)
  * rr-conflict: add retry-connect option (&gt;=drbd 9.0.20)
  * drbdmon: 256/16 colors; events2 handler improvements
  * drbdsetup,v9: new flag: force-resync (&gt;=drbd 9.0.21)
- Remove netlink-prepare-for-kernel-v5.2.patch
  Remove netlink-Add-NLA_F_NESTED-flag-to-nested-attribute.patch
  Remove cibadmin-return-code-convert.patch in 144c8cc1d</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166200 ,fix crm-fence-peer regex issue with pacemaker 2.
- Add patch crm-fence-peer-pacemaker2.patch</changelog>
  <changelog author="nwang@suse.com" date="1589025600">- bsc#1171419, Update to 9.13.0
  * crm-fence-peer{,.9}.sh: detect Pacemaker 2 promotable clones
  * submodules: switch to https, which makes it easier to clone
  if you are behind some weird company firewalls.
  * drbd.service: start pacemaker before drbd-proxy
  * windrbd: various new commands including create-resource-from-url,
  set-syslog-ip, scan-partitions-for-minor, install-bus-device,
  remove-bus-device
- Remove patch crm-fence-peer-pacemaker2.patch</changelog>
  <changelog author="nwang@suse.com" date="1591617600">- bsc#1172641, fix the link error of setup_option.
  Add patch link-error-setup_option.patch</changelog>
  <changelog author="nwang@suse.com" date="1599220800">- bsc#1176065, fail to get master id from cib xml in fence handler
  Add patch crm-fence-peer-pacemaker2-issue2.patch</changelog>
  <changelog author="nwang@suse.com" date="1599825600">- bsc#1176436, update to 9.14.0
  * pacemaker: various fixes/improvements for PM &gt;=1.1.15
  including the 2 series; crm-fence-peer.9.sh
  * systemd dependency for drbd-proxy
  * containers: multi-arch support, especially for s390x
  * multipathd: blacklist drbd
  * drbdsetup: code refactoring and improvements,
  as well as tests for events2!
  add "may_promote", "promotion_score". See man page.
  * build: compile fixes for gcc-10; CI pipeline
  * handlers: add "disconnected"
- Remove patch crm-fence-peer-pacemaker2-issue2.patch (included)
  Remove patch link-error-setup_option.patch (included)</changelog>
  <changelog author="ohering@suse.de" date="1602504000">- Move block-drbd back to /etc/xen/scripts (bsc#1177531)
  The change in xen.spec was reverted, but the revert was not applied
  to this pkg</changelog>
  <changelog author="lnussel@suse.de" date="1605614400">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add pie-fix.patch: explicitly pass -pie linker flag when building drbdmon.
  The Makefile explicitly passes -fPIC, thereby breaking our gcc-PIE profile.
  In addition the Makefile also ignores CXXFLAGS and LDFLAGS passed via the
  environment. Therefore fix it with this patch. This makes drbdmon a PIE
  binary (bsc#1184122, bsc#1185132).</changelog>
  <changelog author="nwang@suse.com" date="1626868800">- Update to 9.18.0 (bsc#1189363)
  * build: remove rpm related targets
  * drbdsetup,v84: fix minor compile warnings
  * systemd: resource specific activation
  * systemd: drbd-reactor promoter templates
  * doc: fix maximum ping timeout
  * doc: add man pages for the systemd templates
  * drbdadm,v9: fix dstate for diskless volumes
  * build/release: use lbvers.py
  * drbd-attr: don't leak fd to drbdsetup
  * doc: various fixes and additions
  * drbdsetup,events2,v9: add backing_device
  * build,Debian: rm dh-systemd dependency
  * drbdsetup,events2,v9: fix --poll regression
  * drbdmeta: fix bug with ALs with small final extents
  * build,Debian: rm mail recommends
  * drbdsetup,events2,v9: allow --poll without --now
  * drbdsetup,invalidate: allow bitmap based resync after verify
  * drbdadm,sh-ll-dev: change output to "none" if diskless
  * drbd-attr/may_promote: fixes from 9.15.1
  * drbdadm,v9: allow set-gi in single node clusters
  * drbsetup,events2,v9: diff(erential) output
  * drbsetup,events2,v9: add --full output
  * v9: allow resource rename, also in drbdmon
  * drbdadm,v9: allow c-max-rate to be disabled
  * New drbd-attr Pacemaker RA
  * events2: handle mixed initial state and multicast events
  * events2: fix regression to always print resync done
- Add patch systemd-drbd-service-needs-network-online.patch</changelog>
  <changelog author="nwang@suse.com" date="1631880000">- bsc#1190591, fail to start due to lack of /usr/var/run/drbd</changelog>
  <changelog author="nwang@suse.com" date="1633953600">- Update to 9.19.0
  * v9,events2: show changes of peer-client
  * v9: rr-conflict strategy auto-discard for protocol A
  * windrbd: various fixes including setting the systemd root
  * containers: switch to UBI8
  * v9,wait-*: fix segfault
- bsc#1191058, active UsrMerge to install in /usr
  Add patch usrmerge_move_lib_to_prefix_lib.patch
- Remove patch fix-libdir-in-Makefile.patch
  Remove patch systemd-drbd-service-needs-network-online.patch (included)
- Add drbd-utils.rpmlintrc for Error missing-call-to-setgroups-before-setuid
- Add rpmlint-build-error.patch to fix rpmbuild build errors</changelog>
  <changelog author="zzhou@suse.com" date="1663329600">- restore drbd scripts back to /usr/lib/drbd from /lib/drbd (bsc#1203220)
  Update drbd-utils.spec
- fix drbd-bash-completion
  Update rpmlint-build-error.patch</changelog>
  <changelog author="zzhou@suse.com" date="1663761600">- drbd-utils.spec force _localstatedir to use /var/lib in runtime (bsc#1203220)</changelog>
  <changelog author="zzhou@suse.com" date="1665748800">- bsc#1204276 remove crm-fence-peer.sh for drbd8 to avoid confusion with v9</changelog>
</package>
<package pkgid="02ad5cd4123a7eb6254603e4ea5a17bb4cacdd3a57d3d4bef24e01f0527277dc" name="drbd-utils" arch="aarch64">
  <version epoch="0" ver="9.19.0" rel="150400.3.9.1"/>
  <changelog author="nwang@suse.com" date="1567771200">- Support Kernel 5.2, bsc#1149945 and bsc#1144702
- Add patch netlink-prepare-for-kernel-v5.2.patch
  Add patch netlink-Add-NLA_F_NESTED-flag-to-nested-attribute.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1145296, fix the wrong return code with cib_apply_diff
  Add patch cibadmin-return-code-convert.patch</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to 9.12.0
  * drbd.ocf: new wrc_timeout param, fail on attach failure,
  remove_master_score_if_peer_primary param,
  fail_promote_early_if_peer_primary param, improved helper logging
  no error if wait-connect fails
  * drbdadm,v9: fix dumping meta-disk in corner case
  * crm-fence-peer.9.sh: fix Pacemaker 2 compat
  * drbdsetup,v9: fixes for various json output corner cases
  * drbdsetup,all: prepare for netlink changes (linux v5.2+)
  * drbdadm,v9: fix a check for setting up connections multiple times
  * init: setup file backed loop devices (mapping from LINSTOR)
  * rr-conflict: add retry-connect option (&gt;=drbd 9.0.20)
  * drbdmon: 256/16 colors; events2 handler improvements
  * drbdsetup,v9: new flag: force-resync (&gt;=drbd 9.0.21)
- Remove netlink-prepare-for-kernel-v5.2.patch
  Remove netlink-Add-NLA_F_NESTED-flag-to-nested-attribute.patch
  Remove cibadmin-return-code-convert.patch in 144c8cc1d</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166200 ,fix crm-fence-peer regex issue with pacemaker 2.
- Add patch crm-fence-peer-pacemaker2.patch</changelog>
  <changelog author="nwang@suse.com" date="1589025600">- bsc#1171419, Update to 9.13.0
  * crm-fence-peer{,.9}.sh: detect Pacemaker 2 promotable clones
  * submodules: switch to https, which makes it easier to clone
  if you are behind some weird company firewalls.
  * drbd.service: start pacemaker before drbd-proxy
  * windrbd: various new commands including create-resource-from-url,
  set-syslog-ip, scan-partitions-for-minor, install-bus-device,
  remove-bus-device
- Remove patch crm-fence-peer-pacemaker2.patch</changelog>
  <changelog author="nwang@suse.com" date="1591617600">- bsc#1172641, fix the link error of setup_option.
  Add patch link-error-setup_option.patch</changelog>
  <changelog author="nwang@suse.com" date="1599220800">- bsc#1176065, fail to get master id from cib xml in fence handler
  Add patch crm-fence-peer-pacemaker2-issue2.patch</changelog>
  <changelog author="nwang@suse.com" date="1599825600">- bsc#1176436, update to 9.14.0
  * pacemaker: various fixes/improvements for PM &gt;=1.1.15
  including the 2 series; crm-fence-peer.9.sh
  * systemd dependency for drbd-proxy
  * containers: multi-arch support, especially for s390x
  * multipathd: blacklist drbd
  * drbdsetup: code refactoring and improvements,
  as well as tests for events2!
  add "may_promote", "promotion_score". See man page.
  * build: compile fixes for gcc-10; CI pipeline
  * handlers: add "disconnected"
- Remove patch crm-fence-peer-pacemaker2-issue2.patch (included)
  Remove patch link-error-setup_option.patch (included)</changelog>
  <changelog author="ohering@suse.de" date="1602504000">- Move block-drbd back to /etc/xen/scripts (bsc#1177531)
  The change in xen.spec was reverted, but the revert was not applied
  to this pkg</changelog>
  <changelog author="lnussel@suse.de" date="1605614400">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add pie-fix.patch: explicitly pass -pie linker flag when building drbdmon.
  The Makefile explicitly passes -fPIC, thereby breaking our gcc-PIE profile.
  In addition the Makefile also ignores CXXFLAGS and LDFLAGS passed via the
  environment. Therefore fix it with this patch. This makes drbdmon a PIE
  binary (bsc#1184122, bsc#1185132).</changelog>
  <changelog author="nwang@suse.com" date="1626868800">- Update to 9.18.0 (bsc#1189363)
  * build: remove rpm related targets
  * drbdsetup,v84: fix minor compile warnings
  * systemd: resource specific activation
  * systemd: drbd-reactor promoter templates
  * doc: fix maximum ping timeout
  * doc: add man pages for the systemd templates
  * drbdadm,v9: fix dstate for diskless volumes
  * build/release: use lbvers.py
  * drbd-attr: don't leak fd to drbdsetup
  * doc: various fixes and additions
  * drbdsetup,events2,v9: add backing_device
  * build,Debian: rm dh-systemd dependency
  * drbdsetup,events2,v9: fix --poll regression
  * drbdmeta: fix bug with ALs with small final extents
  * build,Debian: rm mail recommends
  * drbdsetup,events2,v9: allow --poll without --now
  * drbdsetup,invalidate: allow bitmap based resync after verify
  * drbdadm,sh-ll-dev: change output to "none" if diskless
  * drbd-attr/may_promote: fixes from 9.15.1
  * drbdadm,v9: allow set-gi in single node clusters
  * drbsetup,events2,v9: diff(erential) output
  * drbsetup,events2,v9: add --full output
  * v9: allow resource rename, also in drbdmon
  * drbdadm,v9: allow c-max-rate to be disabled
  * New drbd-attr Pacemaker RA
  * events2: handle mixed initial state and multicast events
  * events2: fix regression to always print resync done
- Add patch systemd-drbd-service-needs-network-online.patch</changelog>
  <changelog author="nwang@suse.com" date="1631880000">- bsc#1190591, fail to start due to lack of /usr/var/run/drbd</changelog>
  <changelog author="nwang@suse.com" date="1633953600">- Update to 9.19.0
  * v9,events2: show changes of peer-client
  * v9: rr-conflict strategy auto-discard for protocol A
  * windrbd: various fixes including setting the systemd root
  * containers: switch to UBI8
  * v9,wait-*: fix segfault
- bsc#1191058, active UsrMerge to install in /usr
  Add patch usrmerge_move_lib_to_prefix_lib.patch
- Remove patch fix-libdir-in-Makefile.patch
  Remove patch systemd-drbd-service-needs-network-online.patch (included)
- Add drbd-utils.rpmlintrc for Error missing-call-to-setgroups-before-setuid
- Add rpmlint-build-error.patch to fix rpmbuild build errors</changelog>
  <changelog author="zzhou@suse.com" date="1663329600">- restore drbd scripts back to /usr/lib/drbd from /lib/drbd (bsc#1203220)
  Update drbd-utils.spec
- fix drbd-bash-completion
  Update rpmlint-build-error.patch</changelog>
  <changelog author="zzhou@suse.com" date="1663761600">- drbd-utils.spec force _localstatedir to use /var/lib in runtime (bsc#1203220)</changelog>
  <changelog author="zzhou@suse.com" date="1665748800">- bsc#1204276 remove crm-fence-peer.sh for drbd8 to avoid confusion with v9</changelog>
  <changelog author="heming.zhao@suse.com" date="1672747200">- drbd.service fails to load - incorrect path to executable (bsc#1206754)
  * use %suse_version to replace %UsrMerge
  * modify drbd-utils.spec for create symbolic folder "/lib/drbd"</changelog>
</package>
<package pkgid="04fd0ef027c16069a4300767579b614c9e80278b6851dfa0ed5969d0fc4c847a" name="drbd-utils" arch="src">
  <version epoch="0" ver="9.19.0" rel="150400.3.9.1"/>
  <changelog author="nwang@suse.com" date="1567771200">- Support Kernel 5.2, bsc#1149945 and bsc#1144702
- Add patch netlink-prepare-for-kernel-v5.2.patch
  Add patch netlink-Add-NLA_F_NESTED-flag-to-nested-attribute.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1145296, fix the wrong return code with cib_apply_diff
  Add patch cibadmin-return-code-convert.patch</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to 9.12.0
  * drbd.ocf: new wrc_timeout param, fail on attach failure,
  remove_master_score_if_peer_primary param,
  fail_promote_early_if_peer_primary param, improved helper logging
  no error if wait-connect fails
  * drbdadm,v9: fix dumping meta-disk in corner case
  * crm-fence-peer.9.sh: fix Pacemaker 2 compat
  * drbdsetup,v9: fixes for various json output corner cases
  * drbdsetup,all: prepare for netlink changes (linux v5.2+)
  * drbdadm,v9: fix a check for setting up connections multiple times
  * init: setup file backed loop devices (mapping from LINSTOR)
  * rr-conflict: add retry-connect option (&gt;=drbd 9.0.20)
  * drbdmon: 256/16 colors; events2 handler improvements
  * drbdsetup,v9: new flag: force-resync (&gt;=drbd 9.0.21)
- Remove netlink-prepare-for-kernel-v5.2.patch
  Remove netlink-Add-NLA_F_NESTED-flag-to-nested-attribute.patch
  Remove cibadmin-return-code-convert.patch in 144c8cc1d</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166200 ,fix crm-fence-peer regex issue with pacemaker 2.
- Add patch crm-fence-peer-pacemaker2.patch</changelog>
  <changelog author="nwang@suse.com" date="1589025600">- bsc#1171419, Update to 9.13.0
  * crm-fence-peer{,.9}.sh: detect Pacemaker 2 promotable clones
  * submodules: switch to https, which makes it easier to clone
  if you are behind some weird company firewalls.
  * drbd.service: start pacemaker before drbd-proxy
  * windrbd: various new commands including create-resource-from-url,
  set-syslog-ip, scan-partitions-for-minor, install-bus-device,
  remove-bus-device
- Remove patch crm-fence-peer-pacemaker2.patch</changelog>
  <changelog author="nwang@suse.com" date="1591617600">- bsc#1172641, fix the link error of setup_option.
  Add patch link-error-setup_option.patch</changelog>
  <changelog author="nwang@suse.com" date="1599220800">- bsc#1176065, fail to get master id from cib xml in fence handler
  Add patch crm-fence-peer-pacemaker2-issue2.patch</changelog>
  <changelog author="nwang@suse.com" date="1599825600">- bsc#1176436, update to 9.14.0
  * pacemaker: various fixes/improvements for PM &gt;=1.1.15
  including the 2 series; crm-fence-peer.9.sh
  * systemd dependency for drbd-proxy
  * containers: multi-arch support, especially for s390x
  * multipathd: blacklist drbd
  * drbdsetup: code refactoring and improvements,
  as well as tests for events2!
  add "may_promote", "promotion_score". See man page.
  * build: compile fixes for gcc-10; CI pipeline
  * handlers: add "disconnected"
- Remove patch crm-fence-peer-pacemaker2-issue2.patch (included)
  Remove patch link-error-setup_option.patch (included)</changelog>
  <changelog author="ohering@suse.de" date="1602504000">- Move block-drbd back to /etc/xen/scripts (bsc#1177531)
  The change in xen.spec was reverted, but the revert was not applied
  to this pkg</changelog>
  <changelog author="lnussel@suse.de" date="1605614400">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add pie-fix.patch: explicitly pass -pie linker flag when building drbdmon.
  The Makefile explicitly passes -fPIC, thereby breaking our gcc-PIE profile.
  In addition the Makefile also ignores CXXFLAGS and LDFLAGS passed via the
  environment. Therefore fix it with this patch. This makes drbdmon a PIE
  binary (bsc#1184122, bsc#1185132).</changelog>
  <changelog author="nwang@suse.com" date="1626868800">- Update to 9.18.0 (bsc#1189363)
  * build: remove rpm related targets
  * drbdsetup,v84: fix minor compile warnings
  * systemd: resource specific activation
  * systemd: drbd-reactor promoter templates
  * doc: fix maximum ping timeout
  * doc: add man pages for the systemd templates
  * drbdadm,v9: fix dstate for diskless volumes
  * build/release: use lbvers.py
  * drbd-attr: don't leak fd to drbdsetup
  * doc: various fixes and additions
  * drbdsetup,events2,v9: add backing_device
  * build,Debian: rm dh-systemd dependency
  * drbdsetup,events2,v9: fix --poll regression
  * drbdmeta: fix bug with ALs with small final extents
  * build,Debian: rm mail recommends
  * drbdsetup,events2,v9: allow --poll without --now
  * drbdsetup,invalidate: allow bitmap based resync after verify
  * drbdadm,sh-ll-dev: change output to "none" if diskless
  * drbd-attr/may_promote: fixes from 9.15.1
  * drbdadm,v9: allow set-gi in single node clusters
  * drbsetup,events2,v9: diff(erential) output
  * drbsetup,events2,v9: add --full output
  * v9: allow resource rename, also in drbdmon
  * drbdadm,v9: allow c-max-rate to be disabled
  * New drbd-attr Pacemaker RA
  * events2: handle mixed initial state and multicast events
  * events2: fix regression to always print resync done
- Add patch systemd-drbd-service-needs-network-online.patch</changelog>
  <changelog author="nwang@suse.com" date="1631880000">- bsc#1190591, fail to start due to lack of /usr/var/run/drbd</changelog>
  <changelog author="nwang@suse.com" date="1633953600">- Update to 9.19.0
  * v9,events2: show changes of peer-client
  * v9: rr-conflict strategy auto-discard for protocol A
  * windrbd: various fixes including setting the systemd root
  * containers: switch to UBI8
  * v9,wait-*: fix segfault
- bsc#1191058, active UsrMerge to install in /usr
  Add patch usrmerge_move_lib_to_prefix_lib.patch
- Remove patch fix-libdir-in-Makefile.patch
  Remove patch systemd-drbd-service-needs-network-online.patch (included)
- Add drbd-utils.rpmlintrc for Error missing-call-to-setgroups-before-setuid
- Add rpmlint-build-error.patch to fix rpmbuild build errors</changelog>
  <changelog author="zzhou@suse.com" date="1663329600">- restore drbd scripts back to /usr/lib/drbd from /lib/drbd (bsc#1203220)
  Update drbd-utils.spec
- fix drbd-bash-completion
  Update rpmlint-build-error.patch</changelog>
  <changelog author="zzhou@suse.com" date="1663761600">- drbd-utils.spec force _localstatedir to use /var/lib in runtime (bsc#1203220)</changelog>
  <changelog author="zzhou@suse.com" date="1665748800">- bsc#1204276 remove crm-fence-peer.sh for drbd8 to avoid confusion with v9</changelog>
  <changelog author="heming.zhao@suse.com" date="1672747200">- drbd.service fails to load - incorrect path to executable (bsc#1206754)
  * use %suse_version to replace %UsrMerge
  * modify drbd-utils.spec for create symbolic folder "/lib/drbd"</changelog>
</package>
<package pkgid="9a00ac354407bdd0ae1703e1af4b18ec2450227f4624346a881ee6b9b0a1ae7c" name="drbd-utils" arch="x86_64">
  <version epoch="0" ver="9.19.0" rel="150400.3.9.1"/>
  <changelog author="nwang@suse.com" date="1567771200">- Support Kernel 5.2, bsc#1149945 and bsc#1144702
- Add patch netlink-prepare-for-kernel-v5.2.patch
  Add patch netlink-Add-NLA_F_NESTED-flag-to-nested-attribute.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1145296, fix the wrong return code with cib_apply_diff
  Add patch cibadmin-return-code-convert.patch</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to 9.12.0
  * drbd.ocf: new wrc_timeout param, fail on attach failure,
  remove_master_score_if_peer_primary param,
  fail_promote_early_if_peer_primary param, improved helper logging
  no error if wait-connect fails
  * drbdadm,v9: fix dumping meta-disk in corner case
  * crm-fence-peer.9.sh: fix Pacemaker 2 compat
  * drbdsetup,v9: fixes for various json output corner cases
  * drbdsetup,all: prepare for netlink changes (linux v5.2+)
  * drbdadm,v9: fix a check for setting up connections multiple times
  * init: setup file backed loop devices (mapping from LINSTOR)
  * rr-conflict: add retry-connect option (&gt;=drbd 9.0.20)
  * drbdmon: 256/16 colors; events2 handler improvements
  * drbdsetup,v9: new flag: force-resync (&gt;=drbd 9.0.21)
- Remove netlink-prepare-for-kernel-v5.2.patch
  Remove netlink-Add-NLA_F_NESTED-flag-to-nested-attribute.patch
  Remove cibadmin-return-code-convert.patch in 144c8cc1d</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166200 ,fix crm-fence-peer regex issue with pacemaker 2.
- Add patch crm-fence-peer-pacemaker2.patch</changelog>
  <changelog author="nwang@suse.com" date="1589025600">- bsc#1171419, Update to 9.13.0
  * crm-fence-peer{,.9}.sh: detect Pacemaker 2 promotable clones
  * submodules: switch to https, which makes it easier to clone
  if you are behind some weird company firewalls.
  * drbd.service: start pacemaker before drbd-proxy
  * windrbd: various new commands including create-resource-from-url,
  set-syslog-ip, scan-partitions-for-minor, install-bus-device,
  remove-bus-device
- Remove patch crm-fence-peer-pacemaker2.patch</changelog>
  <changelog author="nwang@suse.com" date="1591617600">- bsc#1172641, fix the link error of setup_option.
  Add patch link-error-setup_option.patch</changelog>
  <changelog author="nwang@suse.com" date="1599220800">- bsc#1176065, fail to get master id from cib xml in fence handler
  Add patch crm-fence-peer-pacemaker2-issue2.patch</changelog>
  <changelog author="nwang@suse.com" date="1599825600">- bsc#1176436, update to 9.14.0
  * pacemaker: various fixes/improvements for PM &gt;=1.1.15
  including the 2 series; crm-fence-peer.9.sh
  * systemd dependency for drbd-proxy
  * containers: multi-arch support, especially for s390x
  * multipathd: blacklist drbd
  * drbdsetup: code refactoring and improvements,
  as well as tests for events2!
  add "may_promote", "promotion_score". See man page.
  * build: compile fixes for gcc-10; CI pipeline
  * handlers: add "disconnected"
- Remove patch crm-fence-peer-pacemaker2-issue2.patch (included)
  Remove patch link-error-setup_option.patch (included)</changelog>
  <changelog author="ohering@suse.de" date="1602504000">- Move block-drbd back to /etc/xen/scripts (bsc#1177531)
  The change in xen.spec was reverted, but the revert was not applied
  to this pkg</changelog>
  <changelog author="lnussel@suse.de" date="1605614400">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add pie-fix.patch: explicitly pass -pie linker flag when building drbdmon.
  The Makefile explicitly passes -fPIC, thereby breaking our gcc-PIE profile.
  In addition the Makefile also ignores CXXFLAGS and LDFLAGS passed via the
  environment. Therefore fix it with this patch. This makes drbdmon a PIE
  binary (bsc#1184122, bsc#1185132).</changelog>
  <changelog author="nwang@suse.com" date="1626868800">- Update to 9.18.0 (bsc#1189363)
  * build: remove rpm related targets
  * drbdsetup,v84: fix minor compile warnings
  * systemd: resource specific activation
  * systemd: drbd-reactor promoter templates
  * doc: fix maximum ping timeout
  * doc: add man pages for the systemd templates
  * drbdadm,v9: fix dstate for diskless volumes
  * build/release: use lbvers.py
  * drbd-attr: don't leak fd to drbdsetup
  * doc: various fixes and additions
  * drbdsetup,events2,v9: add backing_device
  * build,Debian: rm dh-systemd dependency
  * drbdsetup,events2,v9: fix --poll regression
  * drbdmeta: fix bug with ALs with small final extents
  * build,Debian: rm mail recommends
  * drbdsetup,events2,v9: allow --poll without --now
  * drbdsetup,invalidate: allow bitmap based resync after verify
  * drbdadm,sh-ll-dev: change output to "none" if diskless
  * drbd-attr/may_promote: fixes from 9.15.1
  * drbdadm,v9: allow set-gi in single node clusters
  * drbsetup,events2,v9: diff(erential) output
  * drbsetup,events2,v9: add --full output
  * v9: allow resource rename, also in drbdmon
  * drbdadm,v9: allow c-max-rate to be disabled
  * New drbd-attr Pacemaker RA
  * events2: handle mixed initial state and multicast events
  * events2: fix regression to always print resync done
- Add patch systemd-drbd-service-needs-network-online.patch</changelog>
  <changelog author="nwang@suse.com" date="1631880000">- bsc#1190591, fail to start due to lack of /usr/var/run/drbd</changelog>
  <changelog author="nwang@suse.com" date="1633953600">- Update to 9.19.0
  * v9,events2: show changes of peer-client
  * v9: rr-conflict strategy auto-discard for protocol A
  * windrbd: various fixes including setting the systemd root
  * containers: switch to UBI8
  * v9,wait-*: fix segfault
- bsc#1191058, active UsrMerge to install in /usr
  Add patch usrmerge_move_lib_to_prefix_lib.patch
- Remove patch fix-libdir-in-Makefile.patch
  Remove patch systemd-drbd-service-needs-network-online.patch (included)
- Add drbd-utils.rpmlintrc for Error missing-call-to-setgroups-before-setuid
- Add rpmlint-build-error.patch to fix rpmbuild build errors</changelog>
  <changelog author="zzhou@suse.com" date="1663329600">- restore drbd scripts back to /usr/lib/drbd from /lib/drbd (bsc#1203220)
  Update drbd-utils.spec
- fix drbd-bash-completion
  Update rpmlint-build-error.patch</changelog>
  <changelog author="zzhou@suse.com" date="1663761600">- drbd-utils.spec force _localstatedir to use /var/lib in runtime (bsc#1203220)</changelog>
  <changelog author="zzhou@suse.com" date="1665748800">- bsc#1204276 remove crm-fence-peer.sh for drbd8 to avoid confusion with v9</changelog>
  <changelog author="heming.zhao@suse.com" date="1672747200">- drbd.service fails to load - incorrect path to executable (bsc#1206754)
  * use %suse_version to replace %UsrMerge
  * modify drbd-utils.spec for create symbolic folder "/lib/drbd"</changelog>
</package>
<package pkgid="ed1b51be091fbdf707ae590f9c95ad9f7c18adf3349115755793a6b330ae4431" name="gcc12" arch="src">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.5.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="6a7e917432dac18d292ec24c156cae5675b33fc35abf4d2dc7b47ce7e77556b2" name="gcc12" arch="src">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.7.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="6b28089753ca99977b52f7c0f62935583f5eef0f989e52cafa60f5b51a0ddf0e" name="gdk-pixbuf-loader-rsvg" arch="aarch64">
  <version epoch="0" ver="2.52.9" rel="150400.3.3.1"/>
  <changelog author="info@paolostivanin.com" date="1618315200">- Update to version 2.50.4:
  + Update dependent crates that had security vulnerabilities:
  - generic-array to 0.13.3 - RUSTSEC-2020-0146
  + Reduced stack usage
  + Add limit for too-large radiuses on the feMorphology filter
  + Properly ignore elements in an error state inside
    the "switch" element</changelog>
  <changelog author="federico@suse.com" date="1619179200">- Update to version 2.46.5 on SLE and Leap:
  + Update dependent crates that had security vulnerabilities:
    generic-array to 0.12.4 - RUSTSEC-2020-0146
    smallvec to 0.6.14      - RUSTSEC-2021-0003 - CVE-2021-25900
  + There are no changes to the library code.
  + Fix bash-isms in Makefile.am (Tin-Wei Lan).
  + Fix Visual Studio build (Chun-wei Fan).
- bsc#1183403 - CVE-2021-25900 - buffer overflow in the smallvec crate.</changelog>
  <changelog author="dimstar@opensuse.org" date="1619784000">- Update to version 2.50.5:
  + Images embedded as data: URLs didn't render if they had a MIME
    type with a charset parameter.
  + Don't allow number lists with unbounded lengths in tableValues
    attributes, for feComponentTransfer and feConvolveMatrix.
  + Negative rx/ry in rect element should be ignored.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1622116800">- Update to version 2.50.6:
  + Librsvg now requires at least Pango 1.44.
  + glgo#GNOME/librsvg#730: Incorrect text spacing when the
    transform is not 1:1. You can see this when a small font-size
    is scaled up due to a transform. It is less visible for a large
    font-size scaled down.
  + glgo#GNOME/librsvg#704: Fix circle/ellipse in paths when they
    are made out of a single Arc command.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1622894400">- Update to version 2.50.7:
  + Two cairo-related bug fixes:
  - glgo#GNOME/librsvg#745: Fix mismatched cairo_save/restore
    when running in inside the Cairo test suite.
  - glgo#GNOME/librsvg#746: Possible cairo_save() without
    cairo_restore() in render_layer().</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.52.0:
  + The biggest user-visible change is that rsvg-convert has been
    ported to Rust.
  + rsvg-convert is now aware of physical units, and fixes a bug
    where PDFs were created at the wrong size.
  + Support for Accept-Language.
  + rsvg-convert's default DPI is now 96, to better match W3C
    standards.
  + SVG2/CSS3 features:
  - Transform property from SVG2; previously librsvg only
    supported the transform attribute from SVG1.1, which has
    different syntax.
  - context-fill and context-stroke for &lt;marker&gt; and &lt;use&gt;
    elements.
  - markers now support orient="auto-start-reverse".
  - paint-order for text elements.
  - "auto" values for the width and height attributes of the
    &lt;image&gt;, &lt;rect&gt;, and &lt;svg&gt; elements.
  - All the &lt;filter-function&gt; types from the Filter Effects
    Module Level 1 specification: blur(), brightness(),
    contrast(), drop-shadow(), grayscale(), hue-rotate(),
    invert(), opacity(), sepia(), saturate().
  - The filter property now supports chains of uri() filters or
    &lt;filter-function&gt; shortcuts.
  - Support CSS selectors for attribute matching, like
    rect[attr^="prefix"]
  + New APIs: See the HTML documentation for details.
- Drop -lang package: there are no translations available anymore.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632657600">- Disable testsuite run on ix86 and arm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1633521600">- Update to version 2.52.1:
  + Fix ordering of tspan inside text elements for right-to-left
    languages.
  + Fix text-anchor positioning for right-to-left languages.
  + Fix regression in computing sizes when an SVG has only one of
    width/height and a viewBox.
  + Spec compliance - the writing-mode property applies only to
    text elements, no to individual tspan elements.
  + Fix build on big-endian platforms.
  + Clarify documentation for the rsvg_handle_write() /
    rsvg_handle_close() deprecated APIs.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634385600">- Update to version 2.52.2:
  + New features:
  - rsvg-convert now supports generating multi-page PDFs in a
    sensible way.
  - With one SVG document per page, each page with the SVG's
    natural size:
  - rsvg-convert --format=pdf -o out.pdf a.svg b.svg c.svg
  - With all pages sized as portrait US Letter, and each SVG
    scaled to fit so that there is a 1in margin around each page:
    rsvg-convert --format=pdf -o out.pdf \
  - -page-width=8.5in --page-height=11in \
  - -width=6.5in --height=8.5in --keep-aspect-ratio \
  - -top=1in --left=1in a.svg b.svg c.svg
    Please see the man page for details.
  - Support &lt;a&gt; elements inside &lt;text&gt;. Also, support the CSS
    :link pseudo-class for matching against links.
  - Support the CSS :lang() pseudo-class for matching against an
    element's xml:lang attribute.
  - Support the mask-type property from SVG2.
  + Bugs fixed:
  - Don't panic when a shorthand property is set to inherit.
  - Fix regression with the viewport size of interior &lt;svg&gt;
    elements.
  - Allow length units to be case-insensitive, per SVG2.
  + Documentation:
  - There is now a FEATURES.md in the repository, where you can
    see all the elements, attributes, and properties that librsvg
    supports. We will be adding detail to this gradually.
  - For developers, there is now devel-docs/adding-a-property.md
    with a tutorial on how to add support for new CSS properties.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635336000">- Update to version 2.52.3:
  + Bugfixes, mostly for text layout. Also, text links in PDF!
  - Support text-decoration=overline.
  - Basic support for the unicode-bidi property. Librsvg still
    considers each tspan independently of others, which is
    incorrect, but at least bidi-override works now for a single
    embedding level.
  - Fix placement of tspan that changes the text direction.
  - :lang() selector should now match lang attribute from an
    element's parent.
  - Fix the text-anchor property for right-to-left text.
  - PDF now includes links inside text elements.</changelog>
  <changelog author="william.brown@suse.com" date="1635854400">- Add cargo audit obs service</changelog>
  <changelog author="federico@suse.com" date="1636200000">- Add librsvg-s390x-cairo-has-current-point.patch for
  https://github.com/gtk-rs/gtk-rs-core/issues/335 - otherwise the
  test suite fails on s390x due to a bug in the cairo-rs bindings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636804800">- Update to version 2.52.4:
  + New features:
  - Support the isolation property from the Compositing and
    Blending Level 1 specification.
  - Support Visual Studio 2022.
  + Bug fixes:
  - The opacity and mix-blend-mode properties were not being
    applied when an element has a mask.
  - Fix panic when an empty group has a pattern fill and filters.
  - Fix the tests on Windows; the still only work when Fontconfig
    is present.
  - Work around a bug in the cairo-rs bindings in the test suite,
    that only manifests itself in s/390x due to its calling
    convention. See
    https://github.com/gtk-rs/gtk-rs-core/issues/335</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637236800">- Disable testsuite for now, let upstream figure out the issue with
  harfbuzz 3.1.1.</changelog>
  <changelog author="federico@suse.com" date="1638446400">- Remove librsvg-s390x-cairo-has-current-point.patch - it is included
  in the upstream tarball now.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1639742400">- Update to version 2.52.5:
  + Fix mangled output in rsvg-convert when redirecting output to
    a pipe on Windows.
  + When outputting to SVG, rsvg-convert now uses the width/height
    units specified in the command line; it always used pixels
    before.
  + Fix incorrect top/left margins for SVG/PS/EPS/PDF output.
  + Fix incorrect placement of glyphs when text has non-uniform
    scaling in the X/Y axes. This is not a librsvg bug, but is
    fixed by Pango 1.49.3 and later. Hopefully Pango 1.48.11 will
    be released soon with this fix as well. Note that this release
    of librsvg cannot increase the minimum Pango version to 1.48.11
    because it is not released yet.
  + Miscellaneous: Updated crate dependencies: assert_cmd, cast,
    clap cssparser, float-cmp, itertools, nalgebra, png, proptest,
    rctree, selectors, system-deps.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645099200">- Update to version 2.52.6:
  + Fix incorrect text rendering when text has different scales in
    the X/Y axes. This regressed after librsvg 2.52.5, when Pango
    had to revert its fix for the same bug. Now librsvg renders all
    text as paths, and does the scaling itself. Please file a bug
    if you have evidence that this presents a performance problem
    for you.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 2.52.7:
  + Backport a fix for the regression that was introduced in the
    last release: Output filled text as text for PDF; fixes
    regression due to outputting all text as paths.</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.52.8:
  + Catch circular references when rendering patterns.</changelog>
  <changelog author="qkzhu@suse.com" date="1654862400">- Update to version 2.52.9:
  + Fix regressions when computing element geometries.</changelog>
</package>
<package pkgid="9fbd0d2f13e250ea75dc1179de47f0521859ba3a609ae01793098744461833ac" name="gdk-pixbuf-loader-rsvg" arch="x86_64">
  <version epoch="0" ver="2.52.9" rel="150400.3.3.1"/>
  <changelog author="info@paolostivanin.com" date="1618315200">- Update to version 2.50.4:
  + Update dependent crates that had security vulnerabilities:
  - generic-array to 0.13.3 - RUSTSEC-2020-0146
  + Reduced stack usage
  + Add limit for too-large radiuses on the feMorphology filter
  + Properly ignore elements in an error state inside
    the "switch" element</changelog>
  <changelog author="federico@suse.com" date="1619179200">- Update to version 2.46.5 on SLE and Leap:
  + Update dependent crates that had security vulnerabilities:
    generic-array to 0.12.4 - RUSTSEC-2020-0146
    smallvec to 0.6.14      - RUSTSEC-2021-0003 - CVE-2021-25900
  + There are no changes to the library code.
  + Fix bash-isms in Makefile.am (Tin-Wei Lan).
  + Fix Visual Studio build (Chun-wei Fan).
- bsc#1183403 - CVE-2021-25900 - buffer overflow in the smallvec crate.</changelog>
  <changelog author="dimstar@opensuse.org" date="1619784000">- Update to version 2.50.5:
  + Images embedded as data: URLs didn't render if they had a MIME
    type with a charset parameter.
  + Don't allow number lists with unbounded lengths in tableValues
    attributes, for feComponentTransfer and feConvolveMatrix.
  + Negative rx/ry in rect element should be ignored.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1622116800">- Update to version 2.50.6:
  + Librsvg now requires at least Pango 1.44.
  + glgo#GNOME/librsvg#730: Incorrect text spacing when the
    transform is not 1:1. You can see this when a small font-size
    is scaled up due to a transform. It is less visible for a large
    font-size scaled down.
  + glgo#GNOME/librsvg#704: Fix circle/ellipse in paths when they
    are made out of a single Arc command.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1622894400">- Update to version 2.50.7:
  + Two cairo-related bug fixes:
  - glgo#GNOME/librsvg#745: Fix mismatched cairo_save/restore
    when running in inside the Cairo test suite.
  - glgo#GNOME/librsvg#746: Possible cairo_save() without
    cairo_restore() in render_layer().</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.52.0:
  + The biggest user-visible change is that rsvg-convert has been
    ported to Rust.
  + rsvg-convert is now aware of physical units, and fixes a bug
    where PDFs were created at the wrong size.
  + Support for Accept-Language.
  + rsvg-convert's default DPI is now 96, to better match W3C
    standards.
  + SVG2/CSS3 features:
  - Transform property from SVG2; previously librsvg only
    supported the transform attribute from SVG1.1, which has
    different syntax.
  - context-fill and context-stroke for &lt;marker&gt; and &lt;use&gt;
    elements.
  - markers now support orient="auto-start-reverse".
  - paint-order for text elements.
  - "auto" values for the width and height attributes of the
    &lt;image&gt;, &lt;rect&gt;, and &lt;svg&gt; elements.
  - All the &lt;filter-function&gt; types from the Filter Effects
    Module Level 1 specification: blur(), brightness(),
    contrast(), drop-shadow(), grayscale(), hue-rotate(),
    invert(), opacity(), sepia(), saturate().
  - The filter property now supports chains of uri() filters or
    &lt;filter-function&gt; shortcuts.
  - Support CSS selectors for attribute matching, like
    rect[attr^="prefix"]
  + New APIs: See the HTML documentation for details.
- Drop -lang package: there are no translations available anymore.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632657600">- Disable testsuite run on ix86 and arm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1633521600">- Update to version 2.52.1:
  + Fix ordering of tspan inside text elements for right-to-left
    languages.
  + Fix text-anchor positioning for right-to-left languages.
  + Fix regression in computing sizes when an SVG has only one of
    width/height and a viewBox.
  + Spec compliance - the writing-mode property applies only to
    text elements, no to individual tspan elements.
  + Fix build on big-endian platforms.
  + Clarify documentation for the rsvg_handle_write() /
    rsvg_handle_close() deprecated APIs.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634385600">- Update to version 2.52.2:
  + New features:
  - rsvg-convert now supports generating multi-page PDFs in a
    sensible way.
  - With one SVG document per page, each page with the SVG's
    natural size:
  - rsvg-convert --format=pdf -o out.pdf a.svg b.svg c.svg
  - With all pages sized as portrait US Letter, and each SVG
    scaled to fit so that there is a 1in margin around each page:
    rsvg-convert --format=pdf -o out.pdf \
  - -page-width=8.5in --page-height=11in \
  - -width=6.5in --height=8.5in --keep-aspect-ratio \
  - -top=1in --left=1in a.svg b.svg c.svg
    Please see the man page for details.
  - Support &lt;a&gt; elements inside &lt;text&gt;. Also, support the CSS
    :link pseudo-class for matching against links.
  - Support the CSS :lang() pseudo-class for matching against an
    element's xml:lang attribute.
  - Support the mask-type property from SVG2.
  + Bugs fixed:
  - Don't panic when a shorthand property is set to inherit.
  - Fix regression with the viewport size of interior &lt;svg&gt;
    elements.
  - Allow length units to be case-insensitive, per SVG2.
  + Documentation:
  - There is now a FEATURES.md in the repository, where you can
    see all the elements, attributes, and properties that librsvg
    supports. We will be adding detail to this gradually.
  - For developers, there is now devel-docs/adding-a-property.md
    with a tutorial on how to add support for new CSS properties.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635336000">- Update to version 2.52.3:
  + Bugfixes, mostly for text layout. Also, text links in PDF!
  - Support text-decoration=overline.
  - Basic support for the unicode-bidi property. Librsvg still
    considers each tspan independently of others, which is
    incorrect, but at least bidi-override works now for a single
    embedding level.
  - Fix placement of tspan that changes the text direction.
  - :lang() selector should now match lang attribute from an
    element's parent.
  - Fix the text-anchor property for right-to-left text.
  - PDF now includes links inside text elements.</changelog>
  <changelog author="william.brown@suse.com" date="1635854400">- Add cargo audit obs service</changelog>
  <changelog author="federico@suse.com" date="1636200000">- Add librsvg-s390x-cairo-has-current-point.patch for
  https://github.com/gtk-rs/gtk-rs-core/issues/335 - otherwise the
  test suite fails on s390x due to a bug in the cairo-rs bindings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636804800">- Update to version 2.52.4:
  + New features:
  - Support the isolation property from the Compositing and
    Blending Level 1 specification.
  - Support Visual Studio 2022.
  + Bug fixes:
  - The opacity and mix-blend-mode properties were not being
    applied when an element has a mask.
  - Fix panic when an empty group has a pattern fill and filters.
  - Fix the tests on Windows; the still only work when Fontconfig
    is present.
  - Work around a bug in the cairo-rs bindings in the test suite,
    that only manifests itself in s/390x due to its calling
    convention. See
    https://github.com/gtk-rs/gtk-rs-core/issues/335</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637236800">- Disable testsuite for now, let upstream figure out the issue with
  harfbuzz 3.1.1.</changelog>
  <changelog author="federico@suse.com" date="1638446400">- Remove librsvg-s390x-cairo-has-current-point.patch - it is included
  in the upstream tarball now.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1639742400">- Update to version 2.52.5:
  + Fix mangled output in rsvg-convert when redirecting output to
    a pipe on Windows.
  + When outputting to SVG, rsvg-convert now uses the width/height
    units specified in the command line; it always used pixels
    before.
  + Fix incorrect top/left margins for SVG/PS/EPS/PDF output.
  + Fix incorrect placement of glyphs when text has non-uniform
    scaling in the X/Y axes. This is not a librsvg bug, but is
    fixed by Pango 1.49.3 and later. Hopefully Pango 1.48.11 will
    be released soon with this fix as well. Note that this release
    of librsvg cannot increase the minimum Pango version to 1.48.11
    because it is not released yet.
  + Miscellaneous: Updated crate dependencies: assert_cmd, cast,
    clap cssparser, float-cmp, itertools, nalgebra, png, proptest,
    rctree, selectors, system-deps.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645099200">- Update to version 2.52.6:
  + Fix incorrect text rendering when text has different scales in
    the X/Y axes. This regressed after librsvg 2.52.5, when Pango
    had to revert its fix for the same bug. Now librsvg renders all
    text as paths, and does the scaling itself. Please file a bug
    if you have evidence that this presents a performance problem
    for you.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 2.52.7:
  + Backport a fix for the regression that was introduced in the
    last release: Output filled text as text for PDF; fixes
    regression due to outputting all text as paths.</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.52.8:
  + Catch circular references when rendering patterns.</changelog>
  <changelog author="qkzhu@suse.com" date="1654862400">- Update to version 2.52.9:
  + Fix regressions when computing element geometries.</changelog>
</package>
<package pkgid="791dcafd0402cd7bc8beda3a16780db439a5f792f4504d9ff896dc27a345a800" name="glib2" arch="src">
  <version epoch="0" ver="2.70.5" rel="150400.3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 2.68.2:
  + Fix building third-party projects against GLib on CentOS 7.
  + Bugs fixed:
  - json-glib does not build with glib 2.68.1.
  - gmacros: check that __cplusplus or _MSC_VER is defined.
  - gmacros: missing check if __STDC_VERSION__ is defined.
  - Backport !2078 ?gthreadedresolver: don't ignore flags in
    lookup_by_name_with_flags? to glib-2-68.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1623412800">- Update to version 2.68.3:
  + Bugs fixed:
  - testfilemonitor test leaks ip_watched_file_t struct
  - GFile: `g_file_replace_contents()` reports
    `G_IO_ERROR_WRONG_ETAG` when saving from a symlink
  - Backport !2128 ?inotify: Fix a memory leak? to glib-2-68
  - Backport !2136 ?tlscertificate: Avoid possible invalid read?
    to glib-2-68
  - Backport !2138 ?glocalfileoutputstream: Fix ETag check when
    replacing through a symlink? to glib-2-68.</changelog>
  <changelog author="dimstar@opensuse.org" date="1626350400">- Silence output in libgio-2_0-0 post scriptlet in case the
  ENV-mimeapps.list files do not exist: we are ready to create them
  in this case. An error message is only confusing.</changelog>
  <changelog author="yfjiang@suse.com" date="1627646400">- Drop patches fixed upstream on SLE and Leap 15.4:
  + glib2-add-support-for-slim-timezone-format.patch
  + glib2-fix-6-days-until-the-end-of-the-month.patch
  + glib2-CVE-2021-27218.patch
  + glib2-CVE-2021-27219-add-g_memdup2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters
  for close_range (boo#1189088).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629460800">- Update to version 2.68.4:
  + Various bugfixes and backports from master.
  + Updated translations.
- Drop 63e7864.patch: fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629720000">- Update to version 2.69.0:
  + Fix a crash in `GKeyFile` when parsing a file which contains
    translations using a `GKeyFile` instance which has loaded
    another file previously.
  + Ensure `dlerror()` is used with locking as it?s not thread-safe
    in some libc implementations.
  + Drop internal libpcre copy in favour of a subproject from
    wrapdb.
  + Optimise grefcount atomic operations.
  + Fix `g_date_time_format()` return value encoding if `LC_TIME`
    is not a UTF-8 locale but other locale settings are.
  + Set app name in freedesktop.org notifications with
    `GNotification`.
  + Add PKCS#11 flags to `GTlsPasswordFlags`.
  - Drop -Dinternal_pcre=false meson parameter: follow upstreams
    build recipe changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720001">- Update to version 2.69.1:
  + Support categories in desktop notifications (`GNotification`)
  + Add `GPowerProfileMonitor` for monitoring when to use less
    power (due to being on battery power, electricity being
    expensive or high-carbon, etc.)
  + Allow static names to be set for `GSource`s to avoid
    unnecessary string copies
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720002">- Update to version 2.69.2:
  + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once
    more not used if the process is `AT_SECURE`
    (setuid/setgid/setcap); this change was previously applied and
    then reverted because it broke gnome-keyring
  + Add `g_test_fail_printf()`, `g_test_skip_printf()`,
    `g_test_incomplete_printf()` helper functions for printing
    messages when tests end prematurely
  + Add portal implementation of `GPowerProfileMonitor`
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1631016000">- Update to version 2.69.3:
  + g_settings_schema_key_range_check() misbehaves for int versus
    bool.
  + Compiling anything with GCC &lt;4.6 spews deprecation warnings.
  + `g_invoke_closure` bindings API break..
  + GPowerProfileMonitorPortal does not notice initial
    power-saver-enabled status.
  + doc: Explicitly said, that no null term. is needed.
  + ci: Use C.UTF-8 locale on FreeBSD 12.
  + gio: Fix conditions in memory-monitor test.
  + Updated translations.</changelog>
  <changelog author="avvissu@yandex.by" date="1631016001">- desktop-file-utils: add Pantheon desktop environment</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.70.0:
  + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635422400">- Update to version 2.70.1:
  + Fix network changes not being signalled from NetworkManager.
  + Fix build when building with --fatal-meson-warnings.
  + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245,
    glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256,
    glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262,
    glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276,
    glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301,
    glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304.
- Refresh patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636545600">- Stop passing fam=true to meson and drop gamin-devel
  BuildRequires, following upstream default. Following this, drop
  libgio-fam sub-package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638532800">- Update to version 2.70.2:
  + Fix use of the default log writer with journald namespaces
  + Fix hang in `dbus-daemon` under `GTestDBus` when
    `G_MESSAGES_DEBUG=all` is set
  + Speed up `g_canonicalize_filename()` to avoid pathogenic cases
    with `..`
  + Fix URI for pcre subproject as it?s moved upstream
  + Fix storing GSettings dictionaries on macOS
  + Speed up ?remove dot segments? algorithm in `GUri` to avoid
    pathogenic cases with `..`
  + Fix infinite loops in D-Bus message parsing for truncated
    inputs
  + Improve correctness of version information returned by
    `g_get_os_info()` for Windows 10/Server 2019+
  + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426,
    glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530,
    glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541,
    glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313,
    glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316,
    glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335,
    glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340,
    glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356,
    glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361,
    glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366,
    glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643198400">- Update to version 2.70.3:
  + Several important fixes to FD handling in gspawn.
  + Several important fixes to GDBus message and GVariant parsing
    of invalid data.
  + Fix potential data loss due to missing fsync when saving files
    on btrfs.
  + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506,
    glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572,
    glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394,
    glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437,
    glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644580800">- Update to version 2.70.4:
  + Bugs fixed: glgo#GNOME/GLib!2462 ?Fix memory leak in
    gio/gdbusauthmechanismsha1.c? to glib-2-70.
  + Updated translations.</changelog>
  <changelog author="dmueller@suse.com" date="1646049600">- Split gtk-docs from -devel package, these are not needed
  during building projects using glib2
- Use _multibuild as the meson buildprocess is very awkward
  regarding the documentation - builds single-jobs only and
  twice (again during %install). This way the rest of distribution
  waiting for glib2-devel to be available is not blocked by this</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.70.5:
  Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537,
  glgo#GNOME/GLib!2555</changelog>
</package>
<package pkgid="6f9286346915e4cc98917d37550f2d7ce714cd88d28edc6aaef9e6af0506380b" name="glib2-tools" arch="aarch64">
  <version epoch="0" ver="2.70.5" rel="150400.3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 2.68.2:
  + Fix building third-party projects against GLib on CentOS 7.
  + Bugs fixed:
  - json-glib does not build with glib 2.68.1.
  - gmacros: check that __cplusplus or _MSC_VER is defined.
  - gmacros: missing check if __STDC_VERSION__ is defined.
  - Backport !2078 ?gthreadedresolver: don't ignore flags in
    lookup_by_name_with_flags? to glib-2-68.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1623412800">- Update to version 2.68.3:
  + Bugs fixed:
  - testfilemonitor test leaks ip_watched_file_t struct
  - GFile: `g_file_replace_contents()` reports
    `G_IO_ERROR_WRONG_ETAG` when saving from a symlink
  - Backport !2128 ?inotify: Fix a memory leak? to glib-2-68
  - Backport !2136 ?tlscertificate: Avoid possible invalid read?
    to glib-2-68
  - Backport !2138 ?glocalfileoutputstream: Fix ETag check when
    replacing through a symlink? to glib-2-68.</changelog>
  <changelog author="dimstar@opensuse.org" date="1626350400">- Silence output in libgio-2_0-0 post scriptlet in case the
  ENV-mimeapps.list files do not exist: we are ready to create them
  in this case. An error message is only confusing.</changelog>
  <changelog author="yfjiang@suse.com" date="1627646400">- Drop patches fixed upstream on SLE and Leap 15.4:
  + glib2-add-support-for-slim-timezone-format.patch
  + glib2-fix-6-days-until-the-end-of-the-month.patch
  + glib2-CVE-2021-27218.patch
  + glib2-CVE-2021-27219-add-g_memdup2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters
  for close_range (boo#1189088).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629460800">- Update to version 2.68.4:
  + Various bugfixes and backports from master.
  + Updated translations.
- Drop 63e7864.patch: fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629720000">- Update to version 2.69.0:
  + Fix a crash in `GKeyFile` when parsing a file which contains
    translations using a `GKeyFile` instance which has loaded
    another file previously.
  + Ensure `dlerror()` is used with locking as it?s not thread-safe
    in some libc implementations.
  + Drop internal libpcre copy in favour of a subproject from
    wrapdb.
  + Optimise grefcount atomic operations.
  + Fix `g_date_time_format()` return value encoding if `LC_TIME`
    is not a UTF-8 locale but other locale settings are.
  + Set app name in freedesktop.org notifications with
    `GNotification`.
  + Add PKCS#11 flags to `GTlsPasswordFlags`.
  - Drop -Dinternal_pcre=false meson parameter: follow upstreams
    build recipe changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720001">- Update to version 2.69.1:
  + Support categories in desktop notifications (`GNotification`)
  + Add `GPowerProfileMonitor` for monitoring when to use less
    power (due to being on battery power, electricity being
    expensive or high-carbon, etc.)
  + Allow static names to be set for `GSource`s to avoid
    unnecessary string copies
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720002">- Update to version 2.69.2:
  + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once
    more not used if the process is `AT_SECURE`
    (setuid/setgid/setcap); this change was previously applied and
    then reverted because it broke gnome-keyring
  + Add `g_test_fail_printf()`, `g_test_skip_printf()`,
    `g_test_incomplete_printf()` helper functions for printing
    messages when tests end prematurely
  + Add portal implementation of `GPowerProfileMonitor`
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1631016000">- Update to version 2.69.3:
  + g_settings_schema_key_range_check() misbehaves for int versus
    bool.
  + Compiling anything with GCC &lt;4.6 spews deprecation warnings.
  + `g_invoke_closure` bindings API break..
  + GPowerProfileMonitorPortal does not notice initial
    power-saver-enabled status.
  + doc: Explicitly said, that no null term. is needed.
  + ci: Use C.UTF-8 locale on FreeBSD 12.
  + gio: Fix conditions in memory-monitor test.
  + Updated translations.</changelog>
  <changelog author="avvissu@yandex.by" date="1631016001">- desktop-file-utils: add Pantheon desktop environment</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.70.0:
  + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635422400">- Update to version 2.70.1:
  + Fix network changes not being signalled from NetworkManager.
  + Fix build when building with --fatal-meson-warnings.
  + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245,
    glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256,
    glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262,
    glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276,
    glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301,
    glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304.
- Refresh patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636545600">- Stop passing fam=true to meson and drop gamin-devel
  BuildRequires, following upstream default. Following this, drop
  libgio-fam sub-package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638532800">- Update to version 2.70.2:
  + Fix use of the default log writer with journald namespaces
  + Fix hang in `dbus-daemon` under `GTestDBus` when
    `G_MESSAGES_DEBUG=all` is set
  + Speed up `g_canonicalize_filename()` to avoid pathogenic cases
    with `..`
  + Fix URI for pcre subproject as it?s moved upstream
  + Fix storing GSettings dictionaries on macOS
  + Speed up ?remove dot segments? algorithm in `GUri` to avoid
    pathogenic cases with `..`
  + Fix infinite loops in D-Bus message parsing for truncated
    inputs
  + Improve correctness of version information returned by
    `g_get_os_info()` for Windows 10/Server 2019+
  + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426,
    glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530,
    glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541,
    glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313,
    glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316,
    glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335,
    glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340,
    glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356,
    glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361,
    glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366,
    glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643198400">- Update to version 2.70.3:
  + Several important fixes to FD handling in gspawn.
  + Several important fixes to GDBus message and GVariant parsing
    of invalid data.
  + Fix potential data loss due to missing fsync when saving files
    on btrfs.
  + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506,
    glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572,
    glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394,
    glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437,
    glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644580800">- Update to version 2.70.4:
  + Bugs fixed: glgo#GNOME/GLib!2462 ?Fix memory leak in
    gio/gdbusauthmechanismsha1.c? to glib-2-70.
  + Updated translations.</changelog>
  <changelog author="dmueller@suse.com" date="1646049600">- Split gtk-docs from -devel package, these are not needed
  during building projects using glib2
- Use _multibuild as the meson buildprocess is very awkward
  regarding the documentation - builds single-jobs only and
  twice (again during %install). This way the rest of distribution
  waiting for glib2-devel to be available is not blocked by this</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.70.5:
  Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537,
  glgo#GNOME/GLib!2555</changelog>
</package>
<package pkgid="d79e8488516cf0b69b91b2c437f8e2416dd4f975d15d48e13d09db444935189b" name="glib2-tools" arch="x86_64">
  <version epoch="0" ver="2.70.5" rel="150400.3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 2.68.2:
  + Fix building third-party projects against GLib on CentOS 7.
  + Bugs fixed:
  - json-glib does not build with glib 2.68.1.
  - gmacros: check that __cplusplus or _MSC_VER is defined.
  - gmacros: missing check if __STDC_VERSION__ is defined.
  - Backport !2078 ?gthreadedresolver: don't ignore flags in
    lookup_by_name_with_flags? to glib-2-68.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1623412800">- Update to version 2.68.3:
  + Bugs fixed:
  - testfilemonitor test leaks ip_watched_file_t struct
  - GFile: `g_file_replace_contents()` reports
    `G_IO_ERROR_WRONG_ETAG` when saving from a symlink
  - Backport !2128 ?inotify: Fix a memory leak? to glib-2-68
  - Backport !2136 ?tlscertificate: Avoid possible invalid read?
    to glib-2-68
  - Backport !2138 ?glocalfileoutputstream: Fix ETag check when
    replacing through a symlink? to glib-2-68.</changelog>
  <changelog author="dimstar@opensuse.org" date="1626350400">- Silence output in libgio-2_0-0 post scriptlet in case the
  ENV-mimeapps.list files do not exist: we are ready to create them
  in this case. An error message is only confusing.</changelog>
  <changelog author="yfjiang@suse.com" date="1627646400">- Drop patches fixed upstream on SLE and Leap 15.4:
  + glib2-add-support-for-slim-timezone-format.patch
  + glib2-fix-6-days-until-the-end-of-the-month.patch
  + glib2-CVE-2021-27218.patch
  + glib2-CVE-2021-27219-add-g_memdup2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters
  for close_range (boo#1189088).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629460800">- Update to version 2.68.4:
  + Various bugfixes and backports from master.
  + Updated translations.
- Drop 63e7864.patch: fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629720000">- Update to version 2.69.0:
  + Fix a crash in `GKeyFile` when parsing a file which contains
    translations using a `GKeyFile` instance which has loaded
    another file previously.
  + Ensure `dlerror()` is used with locking as it?s not thread-safe
    in some libc implementations.
  + Drop internal libpcre copy in favour of a subproject from
    wrapdb.
  + Optimise grefcount atomic operations.
  + Fix `g_date_time_format()` return value encoding if `LC_TIME`
    is not a UTF-8 locale but other locale settings are.
  + Set app name in freedesktop.org notifications with
    `GNotification`.
  + Add PKCS#11 flags to `GTlsPasswordFlags`.
  - Drop -Dinternal_pcre=false meson parameter: follow upstreams
    build recipe changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720001">- Update to version 2.69.1:
  + Support categories in desktop notifications (`GNotification`)
  + Add `GPowerProfileMonitor` for monitoring when to use less
    power (due to being on battery power, electricity being
    expensive or high-carbon, etc.)
  + Allow static names to be set for `GSource`s to avoid
    unnecessary string copies
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720002">- Update to version 2.69.2:
  + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once
    more not used if the process is `AT_SECURE`
    (setuid/setgid/setcap); this change was previously applied and
    then reverted because it broke gnome-keyring
  + Add `g_test_fail_printf()`, `g_test_skip_printf()`,
    `g_test_incomplete_printf()` helper functions for printing
    messages when tests end prematurely
  + Add portal implementation of `GPowerProfileMonitor`
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1631016000">- Update to version 2.69.3:
  + g_settings_schema_key_range_check() misbehaves for int versus
    bool.
  + Compiling anything with GCC &lt;4.6 spews deprecation warnings.
  + `g_invoke_closure` bindings API break..
  + GPowerProfileMonitorPortal does not notice initial
    power-saver-enabled status.
  + doc: Explicitly said, that no null term. is needed.
  + ci: Use C.UTF-8 locale on FreeBSD 12.
  + gio: Fix conditions in memory-monitor test.
  + Updated translations.</changelog>
  <changelog author="avvissu@yandex.by" date="1631016001">- desktop-file-utils: add Pantheon desktop environment</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.70.0:
  + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635422400">- Update to version 2.70.1:
  + Fix network changes not being signalled from NetworkManager.
  + Fix build when building with --fatal-meson-warnings.
  + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245,
    glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256,
    glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262,
    glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276,
    glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301,
    glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304.
- Refresh patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636545600">- Stop passing fam=true to meson and drop gamin-devel
  BuildRequires, following upstream default. Following this, drop
  libgio-fam sub-package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638532800">- Update to version 2.70.2:
  + Fix use of the default log writer with journald namespaces
  + Fix hang in `dbus-daemon` under `GTestDBus` when
    `G_MESSAGES_DEBUG=all` is set
  + Speed up `g_canonicalize_filename()` to avoid pathogenic cases
    with `..`
  + Fix URI for pcre subproject as it?s moved upstream
  + Fix storing GSettings dictionaries on macOS
  + Speed up ?remove dot segments? algorithm in `GUri` to avoid
    pathogenic cases with `..`
  + Fix infinite loops in D-Bus message parsing for truncated
    inputs
  + Improve correctness of version information returned by
    `g_get_os_info()` for Windows 10/Server 2019+
  + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426,
    glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530,
    glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541,
    glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313,
    glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316,
    glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335,
    glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340,
    glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356,
    glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361,
    glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366,
    glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643198400">- Update to version 2.70.3:
  + Several important fixes to FD handling in gspawn.
  + Several important fixes to GDBus message and GVariant parsing
    of invalid data.
  + Fix potential data loss due to missing fsync when saving files
    on btrfs.
  + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506,
    glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572,
    glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394,
    glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437,
    glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644580800">- Update to version 2.70.4:
  + Bugs fixed: glgo#GNOME/GLib!2462 ?Fix memory leak in
    gio/gdbusauthmechanismsha1.c? to glib-2-70.
  + Updated translations.</changelog>
  <changelog author="dmueller@suse.com" date="1646049600">- Split gtk-docs from -devel package, these are not needed
  during building projects using glib2
- Use _multibuild as the meson buildprocess is very awkward
  regarding the documentation - builds single-jobs only and
  twice (again during %install). This way the rest of distribution
  waiting for glib2-devel to be available is not blocked by this</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.70.5:
  Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537,
  glgo#GNOME/GLib!2555</changelog>
</package>
<package pkgid="1a90d9e0eeb61ec12aeae2246673cf44ba38a95ee749252f8f7b369aee0831f4" name="graphite2" arch="src">
  <version epoch="0" ver="1.3.11" rel="150000.4.3.1"/>
  <changelog author="dmueller@suse.com" date="1413892800">- add link-gcc-shared.diff: link -lgcc_s to fix undefined symbols
  on various ARM architectures</changelog>
  <changelog author="fstrba@suse.com" date="1432036800">- Remove unnecessary utf-8  characters from the spec file</changelog>
  <changelog author="tchvatal@suse.com" date="1438948800">- Version bump to 1.3.0:
  * Various tweaks for the arabic fonts
- Added patches:
  * graphite-nonvoid-return.patch
  * graphite2-1.2.0-cmakepath.patch
- Removed patches:
  * no-specific-nunit-version.diff
  * soname.diff</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Version bump to 1.3.1:
  * Deprecation warning: Full bidi support is about to be deprecated. Make
    contact if this impacts you.
  * Change compression block format slightly to conform to LZ4
  * Handle mono direction text with diacritics consistently. Fonts
    now see the direction they expect consistently and bidi now
    gives expected results.
  * Fixed lots of fuzz bugs
  * Coverity cleanups
  * Build now works for clang and/or asan and/or afl etc.</changelog>
  <changelog author="tchvatal@suse.com" date="1441886400">- Version bump top 1.3.2:
  * Remove full bidi. All segments are assumed to be single directioned.
  * Bug fixes:
    + Decompressor corner cases
    + Various fuzz bugs</changelog>
  <changelog author="pgajdos@suse.com" date="1450267200">- updated to 1.3.3
  * Slight speed up in Collision Avoidance
  * Remove dead bidi code
  * Bug fixes
    . Between pass bidi reorderings and at the end
    . Decompressor fuzz bugs
    . Other fuzz bugs</changelog>
  <changelog author="tchvatal@suse.com" date="1450699200">- Version update to 1.3.4:
  * Fix Collision Kerning ignoring some diacritics
  * Handle pass bits 16-31 to speed up fonts with &gt; 16 passes
  * Various minor fuzz bug fixes
  * Make Coverity happy
  * Add GR_FALLTHROUGH macro for clang c++11
- Upstream moved to github</changelog>
  <changelog author="pgajdos@suse.com" date="1455278400">- updated to 1.3.5 bnc#965803 CVE-2016-1521:
  * Security bug fix
  * Fix ARM misalignment problem
  * Track latest cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1456747200">- Update to 1.3.6
  * This fixes a number of security related bugs. There are no feature
    improvements or bug fixes in this release.</changelog>
  <changelog author="tchvatal@suse.com" date="1464868800">- Version update to 1.3.8:
  * Various bugfixes found by fuzzers</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- Version update to 1.3.9: fixes some bugs in the collision
  avoidance and may give slightly improved results in some cases.</changelog>
  <changelog author="pgajdos@suse.com" date="1493035200">- security update:
  * CVE-2017-5436 [bsc#1035204]
    + graphite2-CVE-2017-5436.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498046400">- Use %ctest macro
- Update license string to lgpl2.1+ and mpl2.0+
- Remove patch graphite2-CVE-2017-5436.patch
- Update to 1.3.10:
  * Upstream marks this as contianing various bugfixes without
    any specific mentions</changelog>
  <changelog author="mpluskal@suse.com" date="1511179200">- Add patches to fix tests when using python3:
  * graphite2-python3_tests.patch
  * graphite2-python3_tests_cornercases.patch
- Refresh all other patches
- Use fancy name for downloaded tarball
- Run spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1512475200">- Make sure we switch to python3 only on SLE15+ and not on SLE12</changelog>
  <changelog author="tchvatal@suse.com" date="1516276800">- Do not BR asciidoc as we do not install the generated html page</changelog>
  <changelog author="schwab@suse.de" date="1518696000">- gcc8.patch: return correct value from stream operator</changelog>
  <changelog author="pgajdos@suse.com" date="1520856000">- Update to 1.3.11:
- removed patches (upstreamed or not needed)
  * gcc8.patch (code commeted out)
  * graphite-nonvoid-return.patch (code commented out)
  * graphite2-python3_tests.patch (upstreamed)
  * graphite2-python3_tests_cornercases.patch (upstreamed
- refreshed patch
  * link-gcc-shared.diff
- fixes security issue: CVE-2018-7999 [bsc#1084850]
  + graphite2-CVE-2018-7999.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1521201600">- Use python3 everywhere
- Drop fonttools test dep as it pulls TON of py3 packages</changelog>
  <changelog author="pgajdos@suse.com" date="1675425600">- fixed license string [bsc#1207676]:
  LGPL-2.1-or-later OR MPL-2.0 OR GPL-2.0-or-later</changelog>
</package>
<package pkgid="30b347144db3214265605c3055dd67ce156c470fc25df00f2e303377af58f89c" name="grub2" arch="aarch64">
  <version epoch="0" ver="2.06" rel="150400.11.17.1"/>
  <changelog author="msuchanek@suse.com" date="1638964800">- Add support for simplefb (boo#1193532).
  + grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1639742400">- Fix can't allocate initrd error (bsc#1191378)
  * 0001-Factor-out-grub_efi_linux_boot.patch
  * 0002-Fix-race-in-EFI-validation.patch
  * 0003-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch
  * 0004-Try-to-pick-better-locations-for-kernel-and-initrd.patch
  * 0005-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch
  * 0006-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch
  * 0007-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch
  * 0008-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch
  * 0009-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch
  * 0010-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch
  * 0011-Also-define-GRUB_EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch</changelog>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="fe27a8b16cb9322014abf20410dd75229f8bc1a56ef145049970dd80c9ffd36c" name="grub2" arch="src">
  <version epoch="0" ver="2.06" rel="150400.11.17.1"/>
  <changelog author="msuchanek@suse.com" date="1638964800">- Add support for simplefb (boo#1193532).
  + grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1639742400">- Fix can't allocate initrd error (bsc#1191378)
  * 0001-Factor-out-grub_efi_linux_boot.patch
  * 0002-Fix-race-in-EFI-validation.patch
  * 0003-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch
  * 0004-Try-to-pick-better-locations-for-kernel-and-initrd.patch
  * 0005-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch
  * 0006-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch
  * 0007-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch
  * 0008-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch
  * 0009-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch
  * 0010-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch
  * 0011-Also-define-GRUB_EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch</changelog>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="e9413525d687cbbeecb90998ef561f6c0af2077fec4f151f09609ea8004107b8" name="grub2" arch="x86_64">
  <version epoch="0" ver="2.06" rel="150400.11.17.1"/>
  <changelog author="msuchanek@suse.com" date="1638964800">- Add support for simplefb (boo#1193532).
  + grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1639742400">- Fix can't allocate initrd error (bsc#1191378)
  * 0001-Factor-out-grub_efi_linux_boot.patch
  * 0002-Fix-race-in-EFI-validation.patch
  * 0003-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch
  * 0004-Try-to-pick-better-locations-for-kernel-and-initrd.patch
  * 0005-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch
  * 0006-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch
  * 0007-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch
  * 0008-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch
  * 0009-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch
  * 0010-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch
  * 0011-Also-define-GRUB_EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch</changelog>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="1195dc614b78ac53cc44779ddfb175d767755c832a77a707fbf8c1903220a55b" name="grub2" arch="aarch64">
  <version epoch="0" ver="2.06" rel="150400.11.23.2"/>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="glin@suse.com" date="1670587200">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
</package>
<package pkgid="ed812141ee7adf6dbf6d71b5ef052353afe12a97acdc93b3b7cfab2c5b1ba654" name="grub2" arch="src">
  <version epoch="0" ver="2.06" rel="150400.11.23.2"/>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="glin@suse.com" date="1670587200">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
</package>
<package pkgid="644d684072cd35233cc32e4ffbbe5a842e5956d00c1b2d109834a4f1751f1264" name="grub2" arch="x86_64">
  <version epoch="0" ver="2.06" rel="150400.11.23.2"/>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="glin@suse.com" date="1670587200">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
</package>
<package pkgid="27c8a0037e6daddf1a4cd0fe23497394160f72126aaa0a6f35f7fd30515e7f15" name="grub2-arm64-efi" arch="noarch">
  <version epoch="0" ver="2.06" rel="150400.11.17.1"/>
  <changelog author="msuchanek@suse.com" date="1638964800">- Add support for simplefb (boo#1193532).
  + grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1639742400">- Fix can't allocate initrd error (bsc#1191378)
  * 0001-Factor-out-grub_efi_linux_boot.patch
  * 0002-Fix-race-in-EFI-validation.patch
  * 0003-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch
  * 0004-Try-to-pick-better-locations-for-kernel-and-initrd.patch
  * 0005-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch
  * 0006-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch
  * 0007-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch
  * 0008-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch
  * 0009-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch
  * 0010-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch
  * 0011-Also-define-GRUB_EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch</changelog>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="2d32508365752a93c3c4fd6ff15bd8c6e9e6683c99466ba882cb3825c78d95c8" name="grub2-arm64-efi" arch="noarch">
  <version epoch="0" ver="2.06" rel="150400.11.23.2"/>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="glin@suse.com" date="1670587200">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
</package>
<package pkgid="3d5ccc4d1f5ff2ad9a4ac0a1aafef034671420ab9a72928ab108a8fe5a026cf8" name="grub2-i386-pc" arch="noarch">
  <version epoch="0" ver="2.06" rel="150400.11.17.1"/>
  <changelog author="msuchanek@suse.com" date="1638964800">- Add support for simplefb (boo#1193532).
  + grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1639742400">- Fix can't allocate initrd error (bsc#1191378)
  * 0001-Factor-out-grub_efi_linux_boot.patch
  * 0002-Fix-race-in-EFI-validation.patch
  * 0003-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch
  * 0004-Try-to-pick-better-locations-for-kernel-and-initrd.patch
  * 0005-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch
  * 0006-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch
  * 0007-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch
  * 0008-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch
  * 0009-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch
  * 0010-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch
  * 0011-Also-define-GRUB_EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch</changelog>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="7f7c499db7c684992da0d88779806289c9476e43236c038072f5d9e9922786da" name="grub2-i386-pc" arch="noarch">
  <version epoch="0" ver="2.06" rel="150400.11.23.2"/>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="glin@suse.com" date="1670587200">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
</package>
<package pkgid="8b69666ab1403f3b393cd01c20d372e2e0cb6f98a7fa4dd9967d3062542082eb" name="grub2-snapper-plugin" arch="noarch">
  <version epoch="0" ver="2.06" rel="150400.11.17.1"/>
  <changelog author="msuchanek@suse.com" date="1638964800">- Add support for simplefb (boo#1193532).
  + grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1639742400">- Fix can't allocate initrd error (bsc#1191378)
  * 0001-Factor-out-grub_efi_linux_boot.patch
  * 0002-Fix-race-in-EFI-validation.patch
  * 0003-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch
  * 0004-Try-to-pick-better-locations-for-kernel-and-initrd.patch
  * 0005-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch
  * 0006-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch
  * 0007-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch
  * 0008-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch
  * 0009-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch
  * 0010-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch
  * 0011-Also-define-GRUB_EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch</changelog>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="3d3abe0b5ba9ab0e924c051edc1d34ca9381eeeabaf0bc4f45b7ecb18474222a" name="grub2-snapper-plugin" arch="noarch">
  <version epoch="0" ver="2.06" rel="150400.11.23.2"/>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="glin@suse.com" date="1670587200">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
</package>
<package pkgid="f16ee7493673888b31f1643e379b22b767efba4f98ed8dd5377c4b1c3b459525" name="grub2-x86_64-efi" arch="noarch">
  <version epoch="0" ver="2.06" rel="150400.11.17.1"/>
  <changelog author="msuchanek@suse.com" date="1638964800">- Add support for simplefb (boo#1193532).
  + grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1639742400">- Fix can't allocate initrd error (bsc#1191378)
  * 0001-Factor-out-grub_efi_linux_boot.patch
  * 0002-Fix-race-in-EFI-validation.patch
  * 0003-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch
  * 0004-Try-to-pick-better-locations-for-kernel-and-initrd.patch
  * 0005-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch
  * 0006-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch
  * 0007-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch
  * 0008-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch
  * 0009-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch
  * 0010-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch
  * 0011-Also-define-GRUB_EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch</changelog>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="7ecd0182649654422bca135d3a25b9d256eef2f501f2aa5449199a14855cec4c" name="grub2-x86_64-efi" arch="noarch">
  <version epoch="0" ver="2.06" rel="150400.11.23.2"/>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="glin@suse.com" date="1670587200">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
</package>
<package pkgid="cc3e06c409a85c3ca2faac447ad568f392078c7fd32ad1180e69e43191d8aac8" name="grub2-x86_64-xen" arch="noarch">
  <version epoch="0" ver="2.06" rel="150400.11.17.1"/>
  <changelog author="msuchanek@suse.com" date="1638964800">- Add support for simplefb (boo#1193532).
  + grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1639742400">- Fix can't allocate initrd error (bsc#1191378)
  * 0001-Factor-out-grub_efi_linux_boot.patch
  * 0002-Fix-race-in-EFI-validation.patch
  * 0003-Handle-multi-arch-64-on-32-boot-in-linuxefi-loader.patch
  * 0004-Try-to-pick-better-locations-for-kernel-and-initrd.patch
  * 0005-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch
  * 0006-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch
  * 0007-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch
  * 0008-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch
  * 0009-x86-efi-Reduce-maximum-bounce-buffer-size-to-16-MiB.patch
  * 0010-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch
  * 0011-Also-define-GRUB_EFI_MAX_ALLOCATION_ADDRESS-for-RISC.patch</changelog>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="d93c3dd8436b8aa5b4168d5a49fa2ebc9246d248800a919b575ca7b68bdcec70" name="grub2-x86_64-xen" arch="noarch">
  <version epoch="0" ver="2.06" rel="150400.11.23.2"/>
  <changelog author="mchang@suse.com" date="1640088000">- Fix CVE-2021-3981 (bsc#1189644)
  * 0001-grub-mkconfig-restore-umask-for-grub.cfg.patch</changelog>
  <changelog author="mchang@suse.com" date="1641816000">- Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090)
  * grub2-systemd-sleep-plugin</changelog>
  <changelog author="mchang@suse.com" date="1641902400">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * grub2.spec
- Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144)
  (bsc#1192686)
  * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch
  * 0002-ieee1275-claim-more-memory.patch
  * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch
  * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch
  * 0005-docs-grub-Document-signing-grub-under-UEFI.patch
  * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch
  * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch
  * 0008-pgp-factor-out-rsa_pad.patch
  * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch
  * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch
  * 0011-libtasn1-import-libtasn1-4.18.0.patch
  * 0012-libtasn1-disable-code-not-needed-in-grub.patch
  * 0013-libtasn1-changes-for-grub-compatibility.patch
  * 0014-libtasn1-compile-into-asn1-module.patch
  * 0015-test_asn1-test-module-for-libtasn1.patch
  * 0016-grub-install-support-embedding-x509-certificates.patch
  * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch
  * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch
  * 0019-appended-signatures-support-verifying-appended-signa.patch
  * 0020-appended-signatures-verification-tests.patch
  * 0021-appended-signatures-documentation.patch
  * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch
  * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch</changelog>
  <changelog author="mchang@suse.com" date="1642075200">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1642161600">- Power guest secure boot with static keys: GRUB2 signing portion
  (jsc#SLE-18271) (bsc#1192764)
  * 0001-grub-install-Add-SUSE-signed-image-support-for-power.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644494400">- Set grub2-check-default shebang to "#!/bin/bash", as the the code
  uses many instructions which are undefined for a POSIX sh.
  (boo#1195794).</changelog>
  <changelog author="msuchanek@suse.com" date="1646136000">- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.</changelog>
  <changelog author="mchang@suse.com" date="1646395200">- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913601">- Fix riscv64 build error
  * 0001-RISC-V-Adjust-march-flags-for-binutils-2.38.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1650542400">- Fix Power10 LPAR error "The partition fails to activate as partition went
  into invalid state" (bsc#1198714)
  * 0001-powerpc-do-CAS-in-a-more-compatible-way.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0017-net-ip-Do-IP-fragment-maths-safely.patch
  * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0022-net-tftp-Avoid-a-trivial-UAF.patch
  * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0024-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0025-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0026-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0027-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0028-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0029-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0030-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0031-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0032-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1663329600">- Fix installation failure due to unavailable nvram device on
  ppc64le (bsc#1201361)
  * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch</changelog>
  <changelog author="mchang@suse.com" date="1664884800">- Add patches for automatic TPM disk unlock (jsc#SLE-24018) (bsc#1196668) (jsc#PED-1276)
  * 0001-luks2-Add-debug-message-to-align-with-luks-and-geli-.patch
  * 0002-cryptodisk-Refactor-to-discard-have_it-global.patch
  * 0003-cryptodisk-Return-failure-in-cryptomount-when-no-cry.patch
  * 0004-cryptodisk-Improve-error-messaging-in-cryptomount-in.patch
  * 0005-cryptodisk-Improve-cryptomount-u-error-message.patch
  * 0006-cryptodisk-Add-infrastructure-to-pass-data-from-cryp.patch
  * 0007-cryptodisk-Refactor-password-input-out-of-crypto-dev.patch
  * 0008-cryptodisk-Move-global-variables-into-grub_cryptomou.patch
  * 0009-cryptodisk-Improve-handling-of-partition-name-in-cry.patch
  * 0010-protectors-Add-key-protectors-framework.patch
  * 0011-tpm2-Add-TPM-Software-Stack-TSS.patch
  * 0012-protectors-Add-TPM2-Key-Protector.patch
  * 0013-cryptodisk-Support-key-protectors.patch
  * 0014-util-grub-protect-Add-new-tool.patch
- Fix no disk unlocking happen (bsc#1196668)
  * 0001-crytodisk-fix-cryptodisk-module-looking-up.patch
- Fix build error
  * fix-tpm2-build.patch</changelog>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="glin@suse.com" date="1670587200">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
</package>
<package pkgid="df37f3db28d86a19236261193efa302b6758c804d549a7a014902fa8f322bebd" name="haproxy" arch="aarch64">
  <version epoch="0" ver="2.4.8+git0.d1f8d41e0" rel="150400.3.10.1"/>
  <changelog author="mrueckert@suse.de" date="1610539200">- Update to version 2.3.4+git0.10189c965:
  * [RELEASE] Released version 2.3.4
  * MINOR: contrib/prometheus-exporter: use fill_info for process dump
  * MINOR: contrib/prometheus-exporter: avoid connection close header
  * BUG/MINOR: init: enforce strict-limits when using master-worker
  * BUG/MINOR: check: Don't perform any check on servers defined in a frontend
  * BUG/MINOR: sample: Memory leak of sample_expr structure in case of error
  * Revert "BUG/MINOR: dns: SRV records ignores duplicated AR records"
  * MINOR: reg-tests: add base prometheus test
  * BUG/MINOR: reg-tests: fix service dependency script
  * BUG/MINOR: sample: check alloc_trash_chunk return value in concat()
  * MINOR: reg-tests: add a way to add service dependency</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Add lua54.patch to fix building with lua 5.4</changelog>
  <changelog author="mrueckert@suse.de" date="1612612800">- Update to version 2.3.5+git0.5902ad99b:
  * [RELEASE] Released version 2.3.5
  * MINOR: config: Deprecate and ignore tune.chksize global option
  * BUG/MINOR: sock: Unclosed fd in case of connection allocation failure
  * BUG/MEDIUM: mux-h2: do not quit the demux loop before setting END_REACHED
  * BUG/MEDIUM: mux-h2: handle remaining read0 cases
  * BUILD: Makefile: move REGTESTST_TYPE default setting
  * MINOR: cli/show_fd: report local and report ports when known
  * BUILD: ssl: fix build breakage with last commit
  * BUG/MINOR: ssl: do not try to use early data if not configured
  * BUG/MINOR: xxhash: make sure armv6 uses memcpy()
  * BUG/MINOR: mux_h2: fix incorrect stat titles
  * BUG/MEDIUM: ssl: check a connection's status before computing a handshake
  * BUG/MEDIUM: ssl/cli: abort ssl cert is freeing the old store
  * BUG/MINOR: stick-table: Always call smp_fetch_src() with a valid arg list
  * DOC: management: fix "show resolvers" alphabetical ordering
  * MINOR: h1: Raise the chunk size limit up to (2^52 - 1)
  * MINOR: mux-h1/show_fd: report as suspicious an entry with too many calls
  * MINOR: mux-h2/show_fd: report as suspicious an entry with too many calls
  * MINOR: ssl/show_fd: report some FDs as suspicious when possible
  * MINOR: cli/show_fd: report some easily detectable suspicious states
  * MINOR: cli: give the show_fd helpers the ability to report a suspicious entry
  * MINOR: mux-fcgi: make the "show fd" helper also decode the fstrm subscriber when known
  * MINOR: mux-h1: make the "show fd" helper also decode the h1s subscriber when known
  * MINOR: mux-h2: make the "show fd" helper also decode the h2s subscriber when known
  * MINOR: xprt/mux: export all *_io_cb functions so that "show fd" resolves them
  * MINOR: ssl: provide a "show fd" helper to report important SSL information
  * MINOR: xprt: add a new show_fd() helper to complete some "show fd" dumps.
  * MINOR: cli: make "show fd" also report the xprt and xprt_ctx
  * CLEANUP: cli: make "show fd" use a const connection to access other fields
  * CLEANUP: tools: make resolve_sym_name() take a const pointer
  * MINOR: contrib: Make the wireshark peers dissector compile for more distribs.
  * BUG/MINOR: backend: check available list allocation for reuse
  * BUG/MEDIUM: backend: never reuse a connection for tcp mode
  * REORG: backend: simplify conn_backend_get
  * BUG/MEDIUM: session: only retrieve ready idle conn from session
  * BUG/MINOR: ssl: init tmp chunk correctly in ssl_sock_load_sctl_from_file()
  * BUG/MINOR: config: fix leak on proxy.conn_src.bind_hdr_name
  * BUG/MEDIUM: filters/htx: Fix data forwarding when payload length is unknown
  * DOC: Improve documentation of the various hdr() fetches
  * BUILD/MINOR: lua: define _GNU_SOURCE for LLONG_MAX
  * BUG/MEDIUM: mux-h2: fix read0 handling on partial frames
  * BUG/MEDIUM: tcpcheck: Don't destroy connection in the wake callback context
  * BUG/MINOR: mworker: define _GNU_SOURCE for strsignal()
  * BUG/MINOR: mux_h2: missing space between "st" and ".flg" in the "show fd" helper
  * BUG/MINOR: peers: Wrong "new_conn" value for "show peers" CLI command.
  * MINOR: build: discard echoing in help target
  * BUG/MINOR: peers: Possible appctx pointer dereference.
  * BUG/MEDIUM: stats: add missing INF_BUILD_INFO definition
  * BUILD: peers: fix build warning about unused variable
  * BUG/MINOR: dns: SRV records ignores duplicated AR records (v2)
  * MINOR: peers: Add traces for peer control messages.
  * BUG/MINOR: threads: Fixes the number of possible cpus report for Mac.
  * MINOR: server: Forbid server definitions in frontend sections
  * MINOR: config: Add failifnotcap() to emit an alert on proxy capabilities
  * BUG/MINOR: init: Use a dynamic buffer to set HAPROXY_CFGFILES env variable</changelog>
  <changelog author="mrueckert@suse.de" date="1614772800">- Update to version 2.3.6+git0.7851701ed:
  * [RELEASE] Released version 2.3.6
  * BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout
  * BUG/MINOR: mux-h2: Fix typo in scheme adjustment
  * DOC: spoe: Add a note about fragmentation support in HAProxy
  * BUG/MEDIUM: spoe: Kill applets if there are pending connections and nbthread &gt; 1
  * BUG/MINOR: connection: Use the client's dst family for adressless servers
  * BUG/MINOR: tcp-act: Don't forget to set the original port for IPv4 set-dst rule
  * BUG/MINOR: http-ana: Only consider dst address to process originalto option
  * BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf()
  * BUG/MINOR: stats: fix compare of no-maint url suffix
  * CLEANUP: muxes: Remove useless if condition in show_fd function
  * BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup()
  * BUG/MEDIUM: resolvers: Reset address for unresolved servers
  * BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records
  * BUG/MINOR: resolvers: new callback to properly handle SRV record errors
  * BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record
  * BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned
  * BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl()
  * BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal
  * BUG/MEDIUM: cli/shutdown sessions: make it thread-safe
  * BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop
  * BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe
  * BUG/MINOR: sample: secure convs that accept base64 string and var name as args
  * MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes
  * BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert"
  * BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok
  * BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line
  * BUG/MINOR: server: Init params before parsing a new server-state line
  * BUG/MINOR: http-rules: Always replace the response status on a return action
  * BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer
  * BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ().
  * DOC: explain the relation between pool-low-conn and tune.idle-pool.shared
  * BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions
  * BUG/MINOR: sample: Always consider zero size string samples as unsafe
  * BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust()
  * BUG/MINOR: checks: properly handle wrapping time in __health_adjust()
  * BUG/MINOR: session: atomically increment the tracked sessions counter
  * BUG/MINOR: server: Remove RMAINT from admin state when loading server state
  * CLEANUP: channel: fix comment in ci_putblk.
  * DOC: tune: explain the origin of block size for ssl.cachesize
  * BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL
  * BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines
  * BUG/MINOR: stats: revert the change on ST_CONVDONE
  * BUG/MEDIUM: config: don't pick unset values from last defaults section
  * CLEANUP: deinit: release global and per-proxy server-state variables on deinit
  * BUG/MINOR: server: Fix server-state-file-name directive
  * BUG/MINOR: backend: hold correctly lock when killing idle conn
  * BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints()
  * BUG/MINOR: server: re-align state file fields number
  * BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state
  * BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors
  * BUG/MINOR: intops: fix mul32hi()'s off-by-one
  * BUILD: ssl: guard SSL_CTX_set_msg_callback with SSL_CTRL_SET_MSG_CALLBACK macro
  * BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro
  * BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro
  * MINOR: check: do not ignore a connection header for http-check send</changelog>
  <changelog author="mrueckert@suse.de" date="1615896000">- Update to version 2.3.7+git0.2d39ce334:
  * [RELEASE] Released version 2.3.7
  * BUG/MINOR: resolvers: Add missing case-insensitive comparisons of DNS hostnames
  * MINOR: resolvers: Don't try to match immediatly renewed ADD items
  * MINOR: resolvers: Use milliseconds for cached items in resolver responses
  * BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set
  * BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks
  * MINOR: resolvers: Directly call srvrq_update_srv_state() when possible
  * MINOR: resolvers: Add function to change the srv status based on SRV resolution
  * MINOR: resolvers: Purge answer items when a SRV resolution triggers an error
  * MINOR: resolvers: Use a function to remove answers attached to a resolution
  * BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete
  * BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item
  * MINOR: resolvers: new function find_srvrq_answer_record()
  * BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item
  * BUG/MEDIUM: resolvers: Don't set an address-less server as UP
  * BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution
  * BUG/MINOR: resolvers: Reset server address on DNS error only on status change
  * BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error
  * Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record"
  * CLEANUP: tcp-rules: add missing actions in the tcp-request error message
  * BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check
  * BUG/MINOR: session: Add some forgotten tests on session's listener
  * BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters
  * BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check
  * BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached
  * BUILD: atomic/arm64: force the register pairs to use in __ha_cas_dw()
  * BUG/MEDIUM: stick-tables: fix ref counter in table entry using multiple http tracksc.
  * OPTIM: task: automatically adjust the default runqueue-depth to the threads
  * MINOR: task: give the scheduler a bit more flexibility in the runqueue size
  * MEDIUM: task: remove the tasks_run_queue counter and have one per thread
  * MEDIUM: ssl: implement xprt_set_used and xprt_set_idle to relax context checks
  * MINOR: xprt: add new xprt_set_idle and xprt_set_used methods
  * MEDIUM: muxes: mark idle conns tasklets with TASK_F_USR1
  * MINOR: task: add an application specific flag to the state: TASK_F_USR1
  * BUG/MEDIUM: ssl: properly remove the TASK_HEAVY flag at end of handshake
  * MINOR: ssl: mark the SSL handshake tasklet as heavy
  * MINOR: task: limit the number of subsequent heavy tasks with flag TASK_HEAVY
  * MEDIUM: backend: use a trylock when trying to grab an idle connection
  * MINOR: pools: double the local pool cache size to 1 MB
  * MEDIUM: pools: add CONFIG_HAP_NO_GLOBAL_POOLS and CONFIG_HAP_GLOBAL_POOLS
  * MEDIUM: streams: do not use the streams lock anymore
  * MINOR: streams: use one list per stream instead of a global one
  * MINOR: cli/streams: make "show sess" dump all streams till the new epoch
  * MINOR: stream: add an "epoch" to figure which streams appeared when
  * MINOR: dynbuf: pass offer_buffers() the number of buffers instead of a threshold
  * MINOR: dynbuf: use regular lists instead of mt_lists for buffer_wait
  * MINOR: dynbuf: make the buffer wait queue per thread
  * OPTIM: lb-leastconn: do not unlink the server if it did not change
  * OPTIM: lb-leastconn: do not take the server lock on take_conn/drop_conn
  * OPTIM: lb-first: do not take the server lock on take_conn/drop_conn
  * MINOR: lb/api: let callers of take_conn/drop_conn tell if they have the lock
  * MINOR: server: move actconns to the per-thread structure
  * OPTIM: server: switch the actconn list to an mt-list
  * MINOR: listener: refine the default MAX_ACCEPT from 64 to 4
  * MINOR: tasks: refine the default run queue depth
  * BUG/MEDIUM: session: NULL dereference possible when accessing the listener
  * MINOR: atomic: implement a more efficient arm64 __ha_cas_dw() using pairs
  * MINOR: atomic: add armv8.1-a atomics variant for cas-dw
  * BUG/MINOR: mt-list: always perform a cpu_relax call on failure
  * REORG: atomic: reimplement pl_cpu_relax() from atomic-ops.h
  * BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode
  * BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring()
  * BUG/MINOR: backend: fix condition for reuse on mode HTTP</changelog>
  <changelog author="mrueckert@suse.de" date="1616673600">- Update to version 2.3.8+git0.e572195c7:
  * [RELEASE] Released version 2.3.8
  * BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters
  * MINOR: tools: make url2ipv4 return the exact number of bytes parsed
  * BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless
  * BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available.
  * CLEANUP: fd: remove unused fd_set_running_excl()
  * BUG/MEDIUM: fd: do not wait on FD removal in fd_delete()
  * MINOR: fd: remove the unneeded running bit from fd_insert()
  * MINOR: fd: make fd_clr_running() return the remaining running mask
  * BUG/MEDIUM: lua: Always init the lua stack before referencing the context
  * BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback
  * MINOR: lua: Slightly improve function dumping the lua traceback
  * BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro
  * BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list"
  * BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable
  * MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua
  * MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master CLI socket
  * BUG/MINOR: protocol: add missing support of dgram unix socket.
  * BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable
  * MINOR: time: also provide a global, monotonic global_now_ms timer
  * BUG/MEDIUM: mux-fcgi: Fix locking of idle_conns lock in the FCGI I/O callback
  * BUG/MINOR: freq_ctr/threads: make use of the last updated global time
  * MINOR: time: export the global_now variable</changelog>
  <changelog author="mrueckert@suse.de" date="1617105600">- Update to version 2.3.9+git1.afb63bc04:
  * BUILD: backend: fix build breakage in idle conn locking fix
  * [RELEASE] Released version 2.3.9
  * BUG/MEDIUM: time: make sure to always initialize the global tick
  * BUG/MINOR: stats: Apply proper styles in HTML status page.
  * BUG/MINOR: payload: Wait for more data if buffer is empty in payload/payload_lv
  * MEDIUM: backend: use a trylock to grab a connection on high FD counts as well
  * BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent</changelog>
  <changelog author="mrueckert@suse.de" date="1619179200">- Update to version 2.3.10+git0.4764f0e4e:
  * [RELEASE] Released version 2.3.10
  * BUG/MEDIUM: peers: re-work refcnt on table to protect against flush
  * BUG/MEDIUM: peers: re-work connection to new process during reload.
  * BUG/MINOR: peers: remove useless table check if initial resync is finished
  * BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data
  * BUG/MINOR: mworker: don't use oldpids[] anymore for reload
  * BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases
  * BUG/MEDIUM: config: fix cpu-map notation with both process and threads
  * BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames
  * BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers
  * BUG/MINOR: server: free srv.lb_nodes in free_server
  * BUG/MINOR: mux-h1: Release idle server H1 connection if data are received
  * BUG/MINOR: logs: Report the true number of retries if there was no connection
  * BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function
  * BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded
  * BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check
  * MINOR: connection: Make bc_http_major compatible with tcp-checks
  * BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections
  * MINOR: logs: Add support of checks as session origin to format lf strings
  * BUG/MINOR: checks: Set missing id to the dummy checks frontend
  * BUG/MEDIUM: threads: Ignore current thread to end its harmless period
  * DOC: ssl: Certificate hot update only works on fronted certificates
  * BUG/MEDIUM: sample: Fix adjusting size in field converter
  * MINOR: No longer rely on deprecated sample fetches for predefined ACLs
  * DOC: clarify that compression works for HTTP/2
  * BUG/MINOR: tools: fix parsing "us" unit for timers
  * CONTRIB: halog: fix issue with array of type char
  * REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken
  * DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options
  * REGTESTS: ssl: "set ssl cert" and multi-certificates bundle
  * BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free
  * BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields
  * BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one
  * BUG/MINOR: ssl: Fix update of default certificate
  * BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS
  * BUG/MINOR: tcp: fix silent-drop workaround for IPv6</changelog>
  <changelog author="mrueckert@suse.de" date="1620993600">- Update to version 2.4.0+git0.6cbbecf09:
  https://www.haproxy.com/blog/announcing-haproxy-2-4/
  for all the details see /usr/share/doc/packages/haproxy/CHANGELOG
- refreshed patches to apply cleanly again
  haproxy-1.6.0-makefile_lib.patch
  haproxy-1.6.0-sec-options.patch
  lua54.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1623931200">- Update to version 2.4.1+git0.1ce7d4925:
  * [RELEASE] Released version 2.4.1
  * BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces
  * BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace
  * MINOR: mux-h2: obey http-ignore-probes during the preface
  * BUG/MINOR: stats: make "show stat typed desc" work again
  * CLEANUP: mux-h2/traces: better align user messages
  * MINOR: mux-h2/trace: report a few connection-level info during h2_init()
  * MINOR: connection: add helper conn_append_debug_info()
  * BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers
  * BUG/MINOR: mux-h1: do not skip the error response on bad requests
  * MINOR: backend: only skip LB when there are actual connections
  * BUG/MAJOR: queue: set SF_ASSIGNED when setting strm-&gt;target on dequeue
  * CLEANUP: global: remove unused definition of stopping_task[]
  * BUG/MINOR: mworker: fix typo in chroot error message
  * BUG/MINOR: ssl: use atomic ops to update global shctx stats
  * BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE
  * BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node
  * BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree
  * BUG/MEDIUM: server: do not forget to generate the dynamic servers ids
  * BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees
  * BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server'
  * BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id
  * DOC: lua: Add a warning about buffers modification in HTTP
  * BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs
  * MEDIUM: resolvers: add a ref between servers and srv request or used SRV record
  * MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item
  * BUG/MINOR: resolvers: answser item list was randomly purged or errors
  * CLEANUP: l7-retries: do not test the buffer before calling b_alloc()
  * BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default
  * BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded
  * CLEANUP: pools: remove now unused seq and pool_free_list
  * BUG/MAJOR: pools: fix possible race with free() in the lockless variant
  * MEDIUM: pools: use a single pool_gc() function for locked and lockless
  * MINOR: pools: call malloc_trim() under thread isolation
  * MINOR: pools: do not maintain the lock during pool_flush()
  * BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location
  * BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush()
  * BUG/MEDIUM: compression: Add a flag to know the filter is still processing data
  * BUG/MEDIUM: compression: Properly get the next block to iterate on payload
  * BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next block
  * BUG/MEDIUM: opentracing: initialization before establishing daemon and/or chroot mode
  * Revert "BUG/MINOR: opentracing: initialization after establishing daemon mode"
  * BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future
  * BUILD: make tune.ssl.keylog available again
  * DOC: use the req.ssl_sni in examples
  * MINOR: errors: allow empty va_args for diag variadic macro
  * BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry
  * DOC/MINOR: move uuid in the configuration to the right alphabetical order
  * BUG/MINOR: vars: Be sure to have a session to get checks variables
  * CLEANUP: http-ana: Remove useless if statement about L7 retries
  * BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree
  * BUG/MINOR: http: Missing calloc return value check in make_arg_list
  * BUG/MINOR: http: Missing calloc return value check while parsing redirect rule
  * BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list
  * BUG/MINOR: compression: Missing calloc return value check in comp_append_type/algo
  * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request rule
  * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request/tcp-response
  * BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy
  * BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare
  * BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture
  * BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine
  * BUG/MINOR: peers: Missing calloc return value check in peers_register_table
  * BUG/MINOR: server: Missing calloc return value check in srv_parse_source
  * DOC: intro: Fix typo in starter guide
  * MINOR: cfgparse: Fail when encountering extra arguments in macro
  * MINOR: http-ana: Perform L7 retries because of status codes in response analyser
  * BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts
  * BUG/MINOR: http-ana: Send the right error if max retries is reached on L7 retry
  * Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers"
  * BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response
  * BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter
  * BUILD/MINOR: opentracing: fixed build when using clang
  * BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'
  * BUG/MEDIUM: ebtree: Invalid read when looking for dup entry</changelog>
  <changelog author="mrueckert@suse.de" date="1625659200">- Update to version 2.4.2+git0.553dee326:
  * [RELEASE] Released version 2.4.2
  * REGTESTS: add http scheme-based normalization test
  * MEDIUM: h2: apply scheme-based normalization on h2 requests
  * MEDIUM: h1-htx: apply scheme-based normalization on h1 requests
  * MEDIUM: http: implement scheme-based normalization
  * MINOR: http: implement http_get_scheme
  * Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules"
  * BUG/MINOR: cli: fix server name output in "show fd"
  * BUG/MEDIUM: sock: make sure to never miss early connection failures
  * DOC: stick-table: add missing documentation about gpt0 stored type
  * BUG/MINOR: peers: fix data_type bit computation more than 32 data_types
  * BUG/MINOR: stick-table: fix several printf sign errors dumping tables
  * DOC: config: use CREATE USER for mysql-check
  * BUG/MEDIUM: resolvers: Make 1st server of a template take part to SRV resolution
  * BUG/MINOR: mqtt: Support empty client ID in CONNECT message
  * BUG/MINOR: mqtt: Fix parser for string with more than 127 characters
  * BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules
  * BUILD: Makefile: fix linkage for Haiku.
  * BUG/MINOR: checks: return correct error code for srv_parse_agent_check
  * MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response()
  * BUG/MINOR: resolvers: Reset server IP when no ip is found in the response
  * BUG/MINOR: resolvers: Always attach server on matching record on resolution
  * CLEANUP: dns: Remove a forgotten debug message
  * DOC: config: Add missing actions in "tcp-request session" documentation
  * MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules
  * REGTESTS: fix maxconn update with agent-check
  * BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check
  * BUG/MINOR: cache: Correctly handle existing-but-empty 'accept-encoding' header
  * BUG/MINOR: server/cli: Fix locking in function processing "set server" command
  * BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task()
  * BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status
  * MINOR: resolvers: Remove server from named_servers tree when removing a SRV item
  * MINOR: resolvers: Clean server in a dedicated function when removing a SRV item
  * BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI
  * BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled
  * BUG/MINOR: server-state: load SRV resolution only if params match the config</changelog>
  <changelog author="mrueckert@suse.de" date="1629201600">- Update to version 2.4.3+git0.4dd5a5a6c:
    CVE-2021-39240 CVE-2021-39241 CVE-2021-39242
    (boo#1189366 boo#1189548 boo#1189549)
  * [RELEASE] Released version 2.4.3
  * REGTESTS: add a test to prevent h2 desync attacks
  * BUG/MEDIUM: h2: give :authority precedence over Host
  * BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header
  * BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it
  * BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax
  * MINOR: http: add a new function http_validate_scheme() to validate a scheme
  * DOC/MINOR: fix typo in management document
  * CLEANUP: assorted typo fixes in the code and comments
  * BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during config check
  * BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued
  * DOC: config: Fix 'http-response send-spoe-group' documentation
  * DOC: Improve the lua documentation
  * BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer
  * BUG/MINOR: buffer: fix buffer_dump() formatting
  * BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one is released
  * MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure
  * ADMIN: dyncookie: implement a simple dynamic cookie calculator
  * MINOR: server: unmark deprecated on enable health/agent cli
  * BUG/MINOR: server: update last_change on maint-&gt;ready transitions too
  * BUG/MINOR: server: remove srv from px list on CLI 'add server' error
  * BUILD: opentracing: fixed build when using pkg-config utility
  * DOC: internals: document the FD takeover process
  * BUG/MINOR: fd: protect fd state harder against a concurrent takeover
  * BUG/MINOR: pollers: always program an update for migrated FDs
  * BUG/MINOR: poll: fix abnormally high skip_fd counter
  * BUG/MINOR: select: fix excess number of dead/skip reported
  * BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before
  * BUG/MEDIUM: connection: close a rare race between idle conn close and takeover
  * BUG/MINOR: connection: Add missing error labels to conn_err_code_str
  * BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames
  * BUG/MINOR: mux-h1: Be sure to swap H1C to splice mode when rcv_pipe() is called
  * BUG/MINOR: mux-h2: Obey dontlognull option during the preface
  * BUG/MINOR: mux-h1: Obey dontlognull option for empty requests
  * BUG/MINOR: systemd: must check the configuration using -Ws
  * BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree
  * BUG/MINOR: check: fix the condition to validate a port-less server
  * BUG/MINOR: stats: Add missing agent stats on servers
  * BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request
  * BUILD/MINOR: memprof fix macOs build.
  * BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs
  * BUG/MEDIUM: mworker: do not register an exit handler if exit is expected
  * BUILD: lua: silence a build warning with TCC
  * BUILD: add detection of missing important CFLAGS
  * BUG/MINOR: ssl: Default-server configuration ignored by server
  * MINOR: mux_h2: define config to disable h2 websocket support
  * BUILD: http_htx: fix ci compilation error with isdigit for Windows</changelog>
  <changelog author="mrueckert@suse.de" date="1631016000">- Update to version 2.4.4+git0.acb1d0bea: CVE-2021-40346 (boo#1189877)
  * [RELEASE] Released version 2.4.4
  * Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive"
  * BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer
  * CLEANUP: htx: remove comments about "must be &lt; 256 MB"
  * BUG/MINOR: config: reject configs using HTTP with bufsize &gt;= 256 MB
  * DOC: configuration: remove wrong tcp-request examples in tcp-response
  * BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser
  * CLEANUP: Add missing include guard to signal.h
  * BUG/MINOR: tools: Fix loop condition in dump_text()
  * BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time
  * BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long
  * MINOR: time: add report_idle() to report process-wide idle time
  * BUG/MINOR: time: fix idle time computation for long sleeps
  * BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords
  * MINOR: compiler: implement an ONLY_ONCE() macro
  * BUG/MINOR: base64: base64urldec() ignores padding in output size check
  * BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec}
  * BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions
  * MINOR: hlua: take the global Lua lock inside a global function
  * REGTESTS: abortonclose: after retries, 503 is expected, not close
  * REGTESTS: http_upgrade: fix incorrect expectation on TCP-&gt;H1-&gt;H2
  * BUG/MEDIUM: h2: match absolute-path not path-absolute for :path</changelog>
  <changelog author="mrueckert@suse.de" date="1633089600">- Update to version 2.4.5+git0.e74a1b34b:
  * [RELEASE] Released version 2.4.5
  * MINOR: tasks: catch TICK_ETERNITY with BUG_ON() in __task_queue()
  * BUG/MINOR: tcp-rules: Stop content rules eval on read error and end-of-input
  * BUG/MINOR: tcpcheck: Don't use arg list for default proxies during parsing
  * MINOR: arg: Be able to forbid unresolved args when building an argument list
  * BUG/MAJOR: lua: use task_wakeup() to properly run a task once
  * BUG/MEDIUM: lua: fix wakeup condition from sleep()
  * MINOR: Makefile: add MEMORY_POOLS to the list of DEBUG_xxx options
  * DOC: peers: fix doc "enable" statement on "peers" sections
  * BUG/MINOR: mux-h1/mux-fcgi: Sanitize TE header to only send "trailers"
  * MINOR: stream-int: Notify mux when the buffer is not stuck when calling rcv_buf
  * BUG/MEDIUM: stream-int: Defrag HTX message in si_cs_recv() if necessary
  * MINOR: htx: Add a function to know if the free space wraps
  * MINOR: htx: Add an HTX flag to know when a message is fragmented
  * MINOR: stream-int: Set CO_RFL transient/persistent flags apart in si_cs_rcv()
  * BUG/MEDIUM: stream: Stop waiting for more data if SI is blocked on RXBLK_ROOM
  * BUG/MEDIUM: stream-int: Notify stream that the mux wants more room to xfer data
  * BUG/MEDIUM: mux-h1: Adjust conditions to ask more space in the channel buffer
  * BUG/MINOR: stats: use refcount to protect dynamic server on dump
  * MINOR: server: return the next srv instance on free_server
  * BUG/MINOR: server: do not use refcount in free_server in stopping mode
  * MINOR: global: define MODE_STOPPING
  * MINOR: server: implement a refcount for dynamic servers
  * BUG/MINOR: http-ana: increment internal_errors counter on response error
  * BUG/MINOR: h1-htx: Fix a typo when request parser is reset
  * BUG/MEDIUM: leastconn: fix rare possibility of divide by zero
  * BUG/MINOR: server: allow 'enable health' only if check configured
  * BUILD: threads: fix -Wundef for _POSIX_PRIORITY_SCHEDULING on libmusl
  * BUILD: halog: fix a -Wundef warning on non-glibc systems
  * BUILD: compiler: fixed a missing test on  defined(__GNUC__)
  * BUILD: fix dragonfly build again on __read_mostly
  * BUG/MINOR: vars: do not talk about global section in CLI errors for set-var
  * BUG/MINOR: vars: truncate the variable name in error reports about scope.
  * BUG/MINOR: vars: properly set the argument parsing context in the expression
  * MINOR: sample: add missing ARGC_ entries
  * BUG/MINOR: vars: improve accuracy of the rules used to check expression validity
  * BUILD: tools: properly guard __GLIBC__ with defined()
  * BUILD: ssl: fix two remaining occurrences of #if USE_OPENSSL
  * BUILD: ssl: next round of build warnings on LIBRESSL_VERSION_NUMBER
  * BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -Wundef
  * IMPORT: slz: silence a build warning with -Wundef
  * BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -Wundef
  * BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -Wundef
  * BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILING
  * MINOR: proc: setting the process to produce a core dump on FreeBSD.
  * MINOR: tools: add FreeBSD support to get_exec_path()
  * BUILD: tools: get the absolute path of the current binary on NetBSD.
  * BUG/MINOR: flt-trace: fix an infinite loop when random-parsing is set
  * BUG/MINOR: cli/payload: do not search for args inside payload
  * BUILD: ist: prevent gcc11 maybe-uninitialized warning on istalloc
  * BUG/MINOR: connection: prevent null deref on mux cleanup task allocation
  * DOC: management: certificate files must be sanitized before injection
  * BUG/MINOR: tcpcheck: Improve LDAP response parsing to fix LDAP check
  * BUG/MAJOR: mux-h1: Don't eval input data if an error was reported
  * MINOR: pools: use mallinfo2() when available instead of mallinfo()
  * MINOR: pools: automatically disable malloc_trim() with external allocators
  * CLEANUP: pools: factor all malloc_trim() calls into trim_all_pools()
  * BUG/MINOR: compat: make sure __WORDSIZE is always defined
  * BUG/MEDIUM: stream-int: Don't block SI on a channel policy if EOI is reached
  * CLEANUP: mux-h1: Remove condition rejecting upgrade requests with payload
  * MINOR: htx: Skip headers with no value when adding a header list to a message
  * BUG/MEDIUM: mux-h1: Remove "Upgrade:" header for requests with payload
  * BUG/MINOR: systemd: ExecStartPre must use -Ws
  * BUG/MINOR: filters: Set right FLT_END analyser depending on channel
  * BUG/MINOR: filters: Always set FLT_END analyser when CF_FLT_ANALYZE flag is set
  * BUG/MEDIUM: http-ana: Reset channels analysers when returning an error
  * BUG/MINOR: stream: Don't release a stream if FLT_END is still registered
  * BUG/MINOR: lua: Don't yield in channel.append() and channel.set()
  * BUG/MINOR: lua: Yield in channel functions only if lua context can yield
  * MINOR: lua: Add a flag on lua context to know the yield capability at run time</changelog>
  <changelog author="mrueckert@suse.de" date="1633348800">- Update to version 2.4.6+git0.d83fd76a1:
  * [RELEASE] Released version 2.4.6
  * BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release</changelog>
  <changelog author="mrueckert@suse.de" date="1633348801">- Update to version 2.4.7+git0.b5e51a5e2:
  * [RELEASE] Released version 2.4.7
  * BUG/MEDIUM: http-ana: Clear request analyzers when applying redirect rule</changelog>
  <changelog author="mrueckert@suse.de" date="1635940800">- Update to version 2.4.8+git0.d1f8d41e0:
  * [RELEASE] Released version 2.4.8
  * SCRIPTS: git-show-backports: re-enable file-based filtering
  * DOC/peers: some grammar fixes for peers 2.1 spec
  * MINOR: stream: Improve dump of bogus streams
  * BUILD/MINOR: cpuset freebsd build fix
  * DOC: config: Fix alphabetical order of fc_* samples
  * BUG/MINOR: sample: fix backend direction flags consecutive to last fix
  * BUG/MEDIUM: sample: Cumulate frontend and backend sample validity flags
  * BUG/MEDIUM: stream-int: Block reads if channel cannot receive more data
  * BUG/MINOR: http: Authorization value can have multiple spaces after the scheme
  * BUG/MEDIUM: http-ana: Drain request data waiting the tarpit timeout expiration
  * MINOR: halog: Add support for extracting captures using -hdr
  * BUG/MINOR: halog: Add missing newlines in die() messages
  * CLEANUP: halog: Use consistent indentation in help()
  * MINOR: halog: Rename -qry to -query
  * DOC: halog: Move the `-qry` parameter into the correct section in help text
  * MINOR: halog: Add -qry parameter allowing to preserve the query string in -uX
  * BUG/MEDIUM: resolvers: Track api calls with a counter to free resolutions
  * BUG/MEDIUM: resolvers: Don't recursively perform requester unlink
  * MEDIUM: resolvers: remove the last occurrences of the "safe" argument
  * MEDIUM: resolvers: use a kill list to preserve the list consistency
  * CLEANUP: resolvers: replace all LIST_DELETE with LIST_DEL_INIT
  * CLEANUP: resolvers: simplify resolv_link_resolution() regarding requesters
  * CLEANUP: always initialize the answer_list
  * CLEANUP: resolvers: do not export resolv_purge_resolution_answer_records()
  * BUG/MEDIUM: mux-h1: Perform a connection shutdown when the h1c is released
  * BUG/MINOR: mux-h1: Save shutdown mode if the shutdown is delayed
  * BUILD: atomic: fix build on mac/arm64
  * BUG/MINOR: backend: fix improper insert in avail tree for always reuse
  * BUILD: fix compilation on NetBSD
  * MINOR: memprof: add one pointer size to the size of allocations
  * MINOR: memprof: report the delta between alloc and free on realloc()
  * BUG/MEDIUM: lua: fix memory leaks with realloc() on non-glibc systems
  * BUG/MINOR: mux-h2: do not prevent from sending a final GOAWAY frame
  * BUG/MINOR: task: do not set TASK_F_USR1 for no reason
  * BUG/MAJOR: buf: fix varint API post- vs pre- increment
  * BUG/MEDIUM: resolvers: always check a valid item in query_list
  * BUILD: resolvers: avoid a possible warning on null-deref
  * BUG/MAJOR: resolvers: add other missing references during resolution removal
  * MINOR: resolvers: merge address and target into a union "data"
  * BUG/MEDIUM: resolvers: use correct storage for the target address
  * BUG/MEDIUM: resolvers: fix truncated TLD consecutive to the API fix
  * MINOR: resolvers: fix the resolv_dn_label_to_str() API about trailing zero
  * BUG/MINOR: resolvers: do not reject host names of length 255 in SRV records
  * BUG/MEDIUM: resolver: make sure to always use the correct hostname length
  * MINOR: resolvers: fix the resolv_str_to_dn_label() API about trailing zero
  * BUG/MAJOR: dns: attempt to lock globaly for msg waiter list instead of use barrier
  * BUG/MAJOR: dns: tcp session can remain attached to a list after a free
  * BUG/MEDIUM: tcpcheck: Properly catch early HTTP parsing errors
  * Revert "CLEANUP: server: always include the storage for SSL settings"
  * BUG/MEDIUM: stream: Keep FLT_END analyzers if a stream detects a channel error
  * BUG/MEDIUM: cpuset: fix cpuset size for FreeBSD
  * BUG/MINOR: sample: Fix 'fix_tag_value' sample when waiting for more data
  * BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back
  * MINOR: initcall: Rename __GLOBL and __GLOBL1.
  * DOC: configuration: add clarification on escaping in keyword arguments
  * BUG/MEDIUM: mux_h2: Handle others remaining read0 cases on partial frames
  * BUG/MEDIUM: sample: properly verify that variables cast to sample
  * MINOR: sample: provide a generic var-to-sample conversion function
  * CLEANUP: sample: uninline sample_conv_var2smp_str()
  * CLEANUP: sample: rename sample_conv_var2smp() to *_sint
  * CLEANUP: server: always include the storage for SSL settings</changelog>
  <changelog author="varkoly@suse.com" date="1646740800">- (bsc#1196408) VUL-0: CVE-2022-0711: haproxy: Denial of service via set-cookie2 header
  o Apply upstream patch:
    0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch</changelog>
  <changelog author="varkoly@suse.com" date="1674043200">- VUL-0: CVE-2023-0056: haproxy: segfault DoS (bsc#1207181)
  o Apply upstream patch:
    0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch</changelog>
  <changelog author="varkoly@suse.com" date="1676030400">- VUL-0: serious vulnerability in the HTTP/1 parser (bsc#1208132)
  o Apply upstream patch:
    2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch
- The output buffer is not zero-initialized. If we don't clear reserved
  bytes, fcgi requests sent to backend will leak sensitive data.
  o Apply proposed patch:
    0001-output-buffer-is-not-zero-initialized.path</changelog>
</package>
<package pkgid="34081bcada402e72709c8cdd8ccc83b00568e6eea1c5f1b70d2a2aa9fd6599ee" name="haproxy" arch="src">
  <version epoch="0" ver="2.4.8+git0.d1f8d41e0" rel="150400.3.10.1"/>
  <changelog author="mrueckert@suse.de" date="1610539200">- Update to version 2.3.4+git0.10189c965:
  * [RELEASE] Released version 2.3.4
  * MINOR: contrib/prometheus-exporter: use fill_info for process dump
  * MINOR: contrib/prometheus-exporter: avoid connection close header
  * BUG/MINOR: init: enforce strict-limits when using master-worker
  * BUG/MINOR: check: Don't perform any check on servers defined in a frontend
  * BUG/MINOR: sample: Memory leak of sample_expr structure in case of error
  * Revert "BUG/MINOR: dns: SRV records ignores duplicated AR records"
  * MINOR: reg-tests: add base prometheus test
  * BUG/MINOR: reg-tests: fix service dependency script
  * BUG/MINOR: sample: check alloc_trash_chunk return value in concat()
  * MINOR: reg-tests: add a way to add service dependency</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Add lua54.patch to fix building with lua 5.4</changelog>
  <changelog author="mrueckert@suse.de" date="1612612800">- Update to version 2.3.5+git0.5902ad99b:
  * [RELEASE] Released version 2.3.5
  * MINOR: config: Deprecate and ignore tune.chksize global option
  * BUG/MINOR: sock: Unclosed fd in case of connection allocation failure
  * BUG/MEDIUM: mux-h2: do not quit the demux loop before setting END_REACHED
  * BUG/MEDIUM: mux-h2: handle remaining read0 cases
  * BUILD: Makefile: move REGTESTST_TYPE default setting
  * MINOR: cli/show_fd: report local and report ports when known
  * BUILD: ssl: fix build breakage with last commit
  * BUG/MINOR: ssl: do not try to use early data if not configured
  * BUG/MINOR: xxhash: make sure armv6 uses memcpy()
  * BUG/MINOR: mux_h2: fix incorrect stat titles
  * BUG/MEDIUM: ssl: check a connection's status before computing a handshake
  * BUG/MEDIUM: ssl/cli: abort ssl cert is freeing the old store
  * BUG/MINOR: stick-table: Always call smp_fetch_src() with a valid arg list
  * DOC: management: fix "show resolvers" alphabetical ordering
  * MINOR: h1: Raise the chunk size limit up to (2^52 - 1)
  * MINOR: mux-h1/show_fd: report as suspicious an entry with too many calls
  * MINOR: mux-h2/show_fd: report as suspicious an entry with too many calls
  * MINOR: ssl/show_fd: report some FDs as suspicious when possible
  * MINOR: cli/show_fd: report some easily detectable suspicious states
  * MINOR: cli: give the show_fd helpers the ability to report a suspicious entry
  * MINOR: mux-fcgi: make the "show fd" helper also decode the fstrm subscriber when known
  * MINOR: mux-h1: make the "show fd" helper also decode the h1s subscriber when known
  * MINOR: mux-h2: make the "show fd" helper also decode the h2s subscriber when known
  * MINOR: xprt/mux: export all *_io_cb functions so that "show fd" resolves them
  * MINOR: ssl: provide a "show fd" helper to report important SSL information
  * MINOR: xprt: add a new show_fd() helper to complete some "show fd" dumps.
  * MINOR: cli: make "show fd" also report the xprt and xprt_ctx
  * CLEANUP: cli: make "show fd" use a const connection to access other fields
  * CLEANUP: tools: make resolve_sym_name() take a const pointer
  * MINOR: contrib: Make the wireshark peers dissector compile for more distribs.
  * BUG/MINOR: backend: check available list allocation for reuse
  * BUG/MEDIUM: backend: never reuse a connection for tcp mode
  * REORG: backend: simplify conn_backend_get
  * BUG/MEDIUM: session: only retrieve ready idle conn from session
  * BUG/MINOR: ssl: init tmp chunk correctly in ssl_sock_load_sctl_from_file()
  * BUG/MINOR: config: fix leak on proxy.conn_src.bind_hdr_name
  * BUG/MEDIUM: filters/htx: Fix data forwarding when payload length is unknown
  * DOC: Improve documentation of the various hdr() fetches
  * BUILD/MINOR: lua: define _GNU_SOURCE for LLONG_MAX
  * BUG/MEDIUM: mux-h2: fix read0 handling on partial frames
  * BUG/MEDIUM: tcpcheck: Don't destroy connection in the wake callback context
  * BUG/MINOR: mworker: define _GNU_SOURCE for strsignal()
  * BUG/MINOR: mux_h2: missing space between "st" and ".flg" in the "show fd" helper
  * BUG/MINOR: peers: Wrong "new_conn" value for "show peers" CLI command.
  * MINOR: build: discard echoing in help target
  * BUG/MINOR: peers: Possible appctx pointer dereference.
  * BUG/MEDIUM: stats: add missing INF_BUILD_INFO definition
  * BUILD: peers: fix build warning about unused variable
  * BUG/MINOR: dns: SRV records ignores duplicated AR records (v2)
  * MINOR: peers: Add traces for peer control messages.
  * BUG/MINOR: threads: Fixes the number of possible cpus report for Mac.
  * MINOR: server: Forbid server definitions in frontend sections
  * MINOR: config: Add failifnotcap() to emit an alert on proxy capabilities
  * BUG/MINOR: init: Use a dynamic buffer to set HAPROXY_CFGFILES env variable</changelog>
  <changelog author="mrueckert@suse.de" date="1614772800">- Update to version 2.3.6+git0.7851701ed:
  * [RELEASE] Released version 2.3.6
  * BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout
  * BUG/MINOR: mux-h2: Fix typo in scheme adjustment
  * DOC: spoe: Add a note about fragmentation support in HAProxy
  * BUG/MEDIUM: spoe: Kill applets if there are pending connections and nbthread &gt; 1
  * BUG/MINOR: connection: Use the client's dst family for adressless servers
  * BUG/MINOR: tcp-act: Don't forget to set the original port for IPv4 set-dst rule
  * BUG/MINOR: http-ana: Only consider dst address to process originalto option
  * BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf()
  * BUG/MINOR: stats: fix compare of no-maint url suffix
  * CLEANUP: muxes: Remove useless if condition in show_fd function
  * BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup()
  * BUG/MEDIUM: resolvers: Reset address for unresolved servers
  * BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records
  * BUG/MINOR: resolvers: new callback to properly handle SRV record errors
  * BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record
  * BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned
  * BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl()
  * BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal
  * BUG/MEDIUM: cli/shutdown sessions: make it thread-safe
  * BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop
  * BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe
  * BUG/MINOR: sample: secure convs that accept base64 string and var name as args
  * MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes
  * BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert"
  * BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok
  * BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line
  * BUG/MINOR: server: Init params before parsing a new server-state line
  * BUG/MINOR: http-rules: Always replace the response status on a return action
  * BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer
  * BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ().
  * DOC: explain the relation between pool-low-conn and tune.idle-pool.shared
  * BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions
  * BUG/MINOR: sample: Always consider zero size string samples as unsafe
  * BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust()
  * BUG/MINOR: checks: properly handle wrapping time in __health_adjust()
  * BUG/MINOR: session: atomically increment the tracked sessions counter
  * BUG/MINOR: server: Remove RMAINT from admin state when loading server state
  * CLEANUP: channel: fix comment in ci_putblk.
  * DOC: tune: explain the origin of block size for ssl.cachesize
  * BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL
  * BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines
  * BUG/MINOR: stats: revert the change on ST_CONVDONE
  * BUG/MEDIUM: config: don't pick unset values from last defaults section
  * CLEANUP: deinit: release global and per-proxy server-state variables on deinit
  * BUG/MINOR: server: Fix server-state-file-name directive
  * BUG/MINOR: backend: hold correctly lock when killing idle conn
  * BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints()
  * BUG/MINOR: server: re-align state file fields number
  * BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state
  * BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors
  * BUG/MINOR: intops: fix mul32hi()'s off-by-one
  * BUILD: ssl: guard SSL_CTX_set_msg_callback with SSL_CTRL_SET_MSG_CALLBACK macro
  * BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro
  * BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro
  * MINOR: check: do not ignore a connection header for http-check send</changelog>
  <changelog author="mrueckert@suse.de" date="1615896000">- Update to version 2.3.7+git0.2d39ce334:
  * [RELEASE] Released version 2.3.7
  * BUG/MINOR: resolvers: Add missing case-insensitive comparisons of DNS hostnames
  * MINOR: resolvers: Don't try to match immediatly renewed ADD items
  * MINOR: resolvers: Use milliseconds for cached items in resolver responses
  * BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set
  * BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks
  * MINOR: resolvers: Directly call srvrq_update_srv_state() when possible
  * MINOR: resolvers: Add function to change the srv status based on SRV resolution
  * MINOR: resolvers: Purge answer items when a SRV resolution triggers an error
  * MINOR: resolvers: Use a function to remove answers attached to a resolution
  * BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete
  * BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item
  * MINOR: resolvers: new function find_srvrq_answer_record()
  * BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item
  * BUG/MEDIUM: resolvers: Don't set an address-less server as UP
  * BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution
  * BUG/MINOR: resolvers: Reset server address on DNS error only on status change
  * BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error
  * Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record"
  * CLEANUP: tcp-rules: add missing actions in the tcp-request error message
  * BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check
  * BUG/MINOR: session: Add some forgotten tests on session's listener
  * BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters
  * BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check
  * BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached
  * BUILD: atomic/arm64: force the register pairs to use in __ha_cas_dw()
  * BUG/MEDIUM: stick-tables: fix ref counter in table entry using multiple http tracksc.
  * OPTIM: task: automatically adjust the default runqueue-depth to the threads
  * MINOR: task: give the scheduler a bit more flexibility in the runqueue size
  * MEDIUM: task: remove the tasks_run_queue counter and have one per thread
  * MEDIUM: ssl: implement xprt_set_used and xprt_set_idle to relax context checks
  * MINOR: xprt: add new xprt_set_idle and xprt_set_used methods
  * MEDIUM: muxes: mark idle conns tasklets with TASK_F_USR1
  * MINOR: task: add an application specific flag to the state: TASK_F_USR1
  * BUG/MEDIUM: ssl: properly remove the TASK_HEAVY flag at end of handshake
  * MINOR: ssl: mark the SSL handshake tasklet as heavy
  * MINOR: task: limit the number of subsequent heavy tasks with flag TASK_HEAVY
  * MEDIUM: backend: use a trylock when trying to grab an idle connection
  * MINOR: pools: double the local pool cache size to 1 MB
  * MEDIUM: pools: add CONFIG_HAP_NO_GLOBAL_POOLS and CONFIG_HAP_GLOBAL_POOLS
  * MEDIUM: streams: do not use the streams lock anymore
  * MINOR: streams: use one list per stream instead of a global one
  * MINOR: cli/streams: make "show sess" dump all streams till the new epoch
  * MINOR: stream: add an "epoch" to figure which streams appeared when
  * MINOR: dynbuf: pass offer_buffers() the number of buffers instead of a threshold
  * MINOR: dynbuf: use regular lists instead of mt_lists for buffer_wait
  * MINOR: dynbuf: make the buffer wait queue per thread
  * OPTIM: lb-leastconn: do not unlink the server if it did not change
  * OPTIM: lb-leastconn: do not take the server lock on take_conn/drop_conn
  * OPTIM: lb-first: do not take the server lock on take_conn/drop_conn
  * MINOR: lb/api: let callers of take_conn/drop_conn tell if they have the lock
  * MINOR: server: move actconns to the per-thread structure
  * OPTIM: server: switch the actconn list to an mt-list
  * MINOR: listener: refine the default MAX_ACCEPT from 64 to 4
  * MINOR: tasks: refine the default run queue depth
  * BUG/MEDIUM: session: NULL dereference possible when accessing the listener
  * MINOR: atomic: implement a more efficient arm64 __ha_cas_dw() using pairs
  * MINOR: atomic: add armv8.1-a atomics variant for cas-dw
  * BUG/MINOR: mt-list: always perform a cpu_relax call on failure
  * REORG: atomic: reimplement pl_cpu_relax() from atomic-ops.h
  * BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode
  * BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring()
  * BUG/MINOR: backend: fix condition for reuse on mode HTTP</changelog>
  <changelog author="mrueckert@suse.de" date="1616673600">- Update to version 2.3.8+git0.e572195c7:
  * [RELEASE] Released version 2.3.8
  * BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters
  * MINOR: tools: make url2ipv4 return the exact number of bytes parsed
  * BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless
  * BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available.
  * CLEANUP: fd: remove unused fd_set_running_excl()
  * BUG/MEDIUM: fd: do not wait on FD removal in fd_delete()
  * MINOR: fd: remove the unneeded running bit from fd_insert()
  * MINOR: fd: make fd_clr_running() return the remaining running mask
  * BUG/MEDIUM: lua: Always init the lua stack before referencing the context
  * BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback
  * MINOR: lua: Slightly improve function dumping the lua traceback
  * BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro
  * BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list"
  * BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable
  * MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua
  * MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master CLI socket
  * BUG/MINOR: protocol: add missing support of dgram unix socket.
  * BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable
  * MINOR: time: also provide a global, monotonic global_now_ms timer
  * BUG/MEDIUM: mux-fcgi: Fix locking of idle_conns lock in the FCGI I/O callback
  * BUG/MINOR: freq_ctr/threads: make use of the last updated global time
  * MINOR: time: export the global_now variable</changelog>
  <changelog author="mrueckert@suse.de" date="1617105600">- Update to version 2.3.9+git1.afb63bc04:
  * BUILD: backend: fix build breakage in idle conn locking fix
  * [RELEASE] Released version 2.3.9
  * BUG/MEDIUM: time: make sure to always initialize the global tick
  * BUG/MINOR: stats: Apply proper styles in HTML status page.
  * BUG/MINOR: payload: Wait for more data if buffer is empty in payload/payload_lv
  * MEDIUM: backend: use a trylock to grab a connection on high FD counts as well
  * BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent</changelog>
  <changelog author="mrueckert@suse.de" date="1619179200">- Update to version 2.3.10+git0.4764f0e4e:
  * [RELEASE] Released version 2.3.10
  * BUG/MEDIUM: peers: re-work refcnt on table to protect against flush
  * BUG/MEDIUM: peers: re-work connection to new process during reload.
  * BUG/MINOR: peers: remove useless table check if initial resync is finished
  * BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data
  * BUG/MINOR: mworker: don't use oldpids[] anymore for reload
  * BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases
  * BUG/MEDIUM: config: fix cpu-map notation with both process and threads
  * BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames
  * BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers
  * BUG/MINOR: server: free srv.lb_nodes in free_server
  * BUG/MINOR: mux-h1: Release idle server H1 connection if data are received
  * BUG/MINOR: logs: Report the true number of retries if there was no connection
  * BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function
  * BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded
  * BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check
  * MINOR: connection: Make bc_http_major compatible with tcp-checks
  * BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections
  * MINOR: logs: Add support of checks as session origin to format lf strings
  * BUG/MINOR: checks: Set missing id to the dummy checks frontend
  * BUG/MEDIUM: threads: Ignore current thread to end its harmless period
  * DOC: ssl: Certificate hot update only works on fronted certificates
  * BUG/MEDIUM: sample: Fix adjusting size in field converter
  * MINOR: No longer rely on deprecated sample fetches for predefined ACLs
  * DOC: clarify that compression works for HTTP/2
  * BUG/MINOR: tools: fix parsing "us" unit for timers
  * CONTRIB: halog: fix issue with array of type char
  * REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken
  * DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options
  * REGTESTS: ssl: "set ssl cert" and multi-certificates bundle
  * BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free
  * BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields
  * BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one
  * BUG/MINOR: ssl: Fix update of default certificate
  * BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS
  * BUG/MINOR: tcp: fix silent-drop workaround for IPv6</changelog>
  <changelog author="mrueckert@suse.de" date="1620993600">- Update to version 2.4.0+git0.6cbbecf09:
  https://www.haproxy.com/blog/announcing-haproxy-2-4/
  for all the details see /usr/share/doc/packages/haproxy/CHANGELOG
- refreshed patches to apply cleanly again
  haproxy-1.6.0-makefile_lib.patch
  haproxy-1.6.0-sec-options.patch
  lua54.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1623931200">- Update to version 2.4.1+git0.1ce7d4925:
  * [RELEASE] Released version 2.4.1
  * BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces
  * BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace
  * MINOR: mux-h2: obey http-ignore-probes during the preface
  * BUG/MINOR: stats: make "show stat typed desc" work again
  * CLEANUP: mux-h2/traces: better align user messages
  * MINOR: mux-h2/trace: report a few connection-level info during h2_init()
  * MINOR: connection: add helper conn_append_debug_info()
  * BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers
  * BUG/MINOR: mux-h1: do not skip the error response on bad requests
  * MINOR: backend: only skip LB when there are actual connections
  * BUG/MAJOR: queue: set SF_ASSIGNED when setting strm-&gt;target on dequeue
  * CLEANUP: global: remove unused definition of stopping_task[]
  * BUG/MINOR: mworker: fix typo in chroot error message
  * BUG/MINOR: ssl: use atomic ops to update global shctx stats
  * BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE
  * BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node
  * BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree
  * BUG/MEDIUM: server: do not forget to generate the dynamic servers ids
  * BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees
  * BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server'
  * BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id
  * DOC: lua: Add a warning about buffers modification in HTTP
  * BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs
  * MEDIUM: resolvers: add a ref between servers and srv request or used SRV record
  * MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item
  * BUG/MINOR: resolvers: answser item list was randomly purged or errors
  * CLEANUP: l7-retries: do not test the buffer before calling b_alloc()
  * BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default
  * BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded
  * CLEANUP: pools: remove now unused seq and pool_free_list
  * BUG/MAJOR: pools: fix possible race with free() in the lockless variant
  * MEDIUM: pools: use a single pool_gc() function for locked and lockless
  * MINOR: pools: call malloc_trim() under thread isolation
  * MINOR: pools: do not maintain the lock during pool_flush()
  * BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location
  * BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush()
  * BUG/MEDIUM: compression: Add a flag to know the filter is still processing data
  * BUG/MEDIUM: compression: Properly get the next block to iterate on payload
  * BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next block
  * BUG/MEDIUM: opentracing: initialization before establishing daemon and/or chroot mode
  * Revert "BUG/MINOR: opentracing: initialization after establishing daemon mode"
  * BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future
  * BUILD: make tune.ssl.keylog available again
  * DOC: use the req.ssl_sni in examples
  * MINOR: errors: allow empty va_args for diag variadic macro
  * BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry
  * DOC/MINOR: move uuid in the configuration to the right alphabetical order
  * BUG/MINOR: vars: Be sure to have a session to get checks variables
  * CLEANUP: http-ana: Remove useless if statement about L7 retries
  * BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree
  * BUG/MINOR: http: Missing calloc return value check in make_arg_list
  * BUG/MINOR: http: Missing calloc return value check while parsing redirect rule
  * BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list
  * BUG/MINOR: compression: Missing calloc return value check in comp_append_type/algo
  * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request rule
  * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request/tcp-response
  * BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy
  * BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare
  * BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture
  * BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine
  * BUG/MINOR: peers: Missing calloc return value check in peers_register_table
  * BUG/MINOR: server: Missing calloc return value check in srv_parse_source
  * DOC: intro: Fix typo in starter guide
  * MINOR: cfgparse: Fail when encountering extra arguments in macro
  * MINOR: http-ana: Perform L7 retries because of status codes in response analyser
  * BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts
  * BUG/MINOR: http-ana: Send the right error if max retries is reached on L7 retry
  * Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers"
  * BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response
  * BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter
  * BUILD/MINOR: opentracing: fixed build when using clang
  * BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'
  * BUG/MEDIUM: ebtree: Invalid read when looking for dup entry</changelog>
  <changelog author="mrueckert@suse.de" date="1625659200">- Update to version 2.4.2+git0.553dee326:
  * [RELEASE] Released version 2.4.2
  * REGTESTS: add http scheme-based normalization test
  * MEDIUM: h2: apply scheme-based normalization on h2 requests
  * MEDIUM: h1-htx: apply scheme-based normalization on h1 requests
  * MEDIUM: http: implement scheme-based normalization
  * MINOR: http: implement http_get_scheme
  * Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules"
  * BUG/MINOR: cli: fix server name output in "show fd"
  * BUG/MEDIUM: sock: make sure to never miss early connection failures
  * DOC: stick-table: add missing documentation about gpt0 stored type
  * BUG/MINOR: peers: fix data_type bit computation more than 32 data_types
  * BUG/MINOR: stick-table: fix several printf sign errors dumping tables
  * DOC: config: use CREATE USER for mysql-check
  * BUG/MEDIUM: resolvers: Make 1st server of a template take part to SRV resolution
  * BUG/MINOR: mqtt: Support empty client ID in CONNECT message
  * BUG/MINOR: mqtt: Fix parser for string with more than 127 characters
  * BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules
  * BUILD: Makefile: fix linkage for Haiku.
  * BUG/MINOR: checks: return correct error code for srv_parse_agent_check
  * MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response()
  * BUG/MINOR: resolvers: Reset server IP when no ip is found in the response
  * BUG/MINOR: resolvers: Always attach server on matching record on resolution
  * CLEANUP: dns: Remove a forgotten debug message
  * DOC: config: Add missing actions in "tcp-request session" documentation
  * MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules
  * REGTESTS: fix maxconn update with agent-check
  * BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check
  * BUG/MINOR: cache: Correctly handle existing-but-empty 'accept-encoding' header
  * BUG/MINOR: server/cli: Fix locking in function processing "set server" command
  * BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task()
  * BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status
  * MINOR: resolvers: Remove server from named_servers tree when removing a SRV item
  * MINOR: resolvers: Clean server in a dedicated function when removing a SRV item
  * BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI
  * BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled
  * BUG/MINOR: server-state: load SRV resolution only if params match the config</changelog>
  <changelog author="mrueckert@suse.de" date="1629201600">- Update to version 2.4.3+git0.4dd5a5a6c:
    CVE-2021-39240 CVE-2021-39241 CVE-2021-39242
    (boo#1189366 boo#1189548 boo#1189549)
  * [RELEASE] Released version 2.4.3
  * REGTESTS: add a test to prevent h2 desync attacks
  * BUG/MEDIUM: h2: give :authority precedence over Host
  * BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header
  * BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it
  * BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax
  * MINOR: http: add a new function http_validate_scheme() to validate a scheme
  * DOC/MINOR: fix typo in management document
  * CLEANUP: assorted typo fixes in the code and comments
  * BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during config check
  * BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued
  * DOC: config: Fix 'http-response send-spoe-group' documentation
  * DOC: Improve the lua documentation
  * BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer
  * BUG/MINOR: buffer: fix buffer_dump() formatting
  * BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one is released
  * MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure
  * ADMIN: dyncookie: implement a simple dynamic cookie calculator
  * MINOR: server: unmark deprecated on enable health/agent cli
  * BUG/MINOR: server: update last_change on maint-&gt;ready transitions too
  * BUG/MINOR: server: remove srv from px list on CLI 'add server' error
  * BUILD: opentracing: fixed build when using pkg-config utility
  * DOC: internals: document the FD takeover process
  * BUG/MINOR: fd: protect fd state harder against a concurrent takeover
  * BUG/MINOR: pollers: always program an update for migrated FDs
  * BUG/MINOR: poll: fix abnormally high skip_fd counter
  * BUG/MINOR: select: fix excess number of dead/skip reported
  * BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before
  * BUG/MEDIUM: connection: close a rare race between idle conn close and takeover
  * BUG/MINOR: connection: Add missing error labels to conn_err_code_str
  * BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames
  * BUG/MINOR: mux-h1: Be sure to swap H1C to splice mode when rcv_pipe() is called
  * BUG/MINOR: mux-h2: Obey dontlognull option during the preface
  * BUG/MINOR: mux-h1: Obey dontlognull option for empty requests
  * BUG/MINOR: systemd: must check the configuration using -Ws
  * BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree
  * BUG/MINOR: check: fix the condition to validate a port-less server
  * BUG/MINOR: stats: Add missing agent stats on servers
  * BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request
  * BUILD/MINOR: memprof fix macOs build.
  * BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs
  * BUG/MEDIUM: mworker: do not register an exit handler if exit is expected
  * BUILD: lua: silence a build warning with TCC
  * BUILD: add detection of missing important CFLAGS
  * BUG/MINOR: ssl: Default-server configuration ignored by server
  * MINOR: mux_h2: define config to disable h2 websocket support
  * BUILD: http_htx: fix ci compilation error with isdigit for Windows</changelog>
  <changelog author="mrueckert@suse.de" date="1631016000">- Update to version 2.4.4+git0.acb1d0bea: CVE-2021-40346 (boo#1189877)
  * [RELEASE] Released version 2.4.4
  * Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive"
  * BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer
  * CLEANUP: htx: remove comments about "must be &lt; 256 MB"
  * BUG/MINOR: config: reject configs using HTTP with bufsize &gt;= 256 MB
  * DOC: configuration: remove wrong tcp-request examples in tcp-response
  * BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser
  * CLEANUP: Add missing include guard to signal.h
  * BUG/MINOR: tools: Fix loop condition in dump_text()
  * BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time
  * BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long
  * MINOR: time: add report_idle() to report process-wide idle time
  * BUG/MINOR: time: fix idle time computation for long sleeps
  * BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords
  * MINOR: compiler: implement an ONLY_ONCE() macro
  * BUG/MINOR: base64: base64urldec() ignores padding in output size check
  * BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec}
  * BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions
  * MINOR: hlua: take the global Lua lock inside a global function
  * REGTESTS: abortonclose: after retries, 503 is expected, not close
  * REGTESTS: http_upgrade: fix incorrect expectation on TCP-&gt;H1-&gt;H2
  * BUG/MEDIUM: h2: match absolute-path not path-absolute for :path</changelog>
  <changelog author="mrueckert@suse.de" date="1633089600">- Update to version 2.4.5+git0.e74a1b34b:
  * [RELEASE] Released version 2.4.5
  * MINOR: tasks: catch TICK_ETERNITY with BUG_ON() in __task_queue()
  * BUG/MINOR: tcp-rules: Stop content rules eval on read error and end-of-input
  * BUG/MINOR: tcpcheck: Don't use arg list for default proxies during parsing
  * MINOR: arg: Be able to forbid unresolved args when building an argument list
  * BUG/MAJOR: lua: use task_wakeup() to properly run a task once
  * BUG/MEDIUM: lua: fix wakeup condition from sleep()
  * MINOR: Makefile: add MEMORY_POOLS to the list of DEBUG_xxx options
  * DOC: peers: fix doc "enable" statement on "peers" sections
  * BUG/MINOR: mux-h1/mux-fcgi: Sanitize TE header to only send "trailers"
  * MINOR: stream-int: Notify mux when the buffer is not stuck when calling rcv_buf
  * BUG/MEDIUM: stream-int: Defrag HTX message in si_cs_recv() if necessary
  * MINOR: htx: Add a function to know if the free space wraps
  * MINOR: htx: Add an HTX flag to know when a message is fragmented
  * MINOR: stream-int: Set CO_RFL transient/persistent flags apart in si_cs_rcv()
  * BUG/MEDIUM: stream: Stop waiting for more data if SI is blocked on RXBLK_ROOM
  * BUG/MEDIUM: stream-int: Notify stream that the mux wants more room to xfer data
  * BUG/MEDIUM: mux-h1: Adjust conditions to ask more space in the channel buffer
  * BUG/MINOR: stats: use refcount to protect dynamic server on dump
  * MINOR: server: return the next srv instance on free_server
  * BUG/MINOR: server: do not use refcount in free_server in stopping mode
  * MINOR: global: define MODE_STOPPING
  * MINOR: server: implement a refcount for dynamic servers
  * BUG/MINOR: http-ana: increment internal_errors counter on response error
  * BUG/MINOR: h1-htx: Fix a typo when request parser is reset
  * BUG/MEDIUM: leastconn: fix rare possibility of divide by zero
  * BUG/MINOR: server: allow 'enable health' only if check configured
  * BUILD: threads: fix -Wundef for _POSIX_PRIORITY_SCHEDULING on libmusl
  * BUILD: halog: fix a -Wundef warning on non-glibc systems
  * BUILD: compiler: fixed a missing test on  defined(__GNUC__)
  * BUILD: fix dragonfly build again on __read_mostly
  * BUG/MINOR: vars: do not talk about global section in CLI errors for set-var
  * BUG/MINOR: vars: truncate the variable name in error reports about scope.
  * BUG/MINOR: vars: properly set the argument parsing context in the expression
  * MINOR: sample: add missing ARGC_ entries
  * BUG/MINOR: vars: improve accuracy of the rules used to check expression validity
  * BUILD: tools: properly guard __GLIBC__ with defined()
  * BUILD: ssl: fix two remaining occurrences of #if USE_OPENSSL
  * BUILD: ssl: next round of build warnings on LIBRESSL_VERSION_NUMBER
  * BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -Wundef
  * IMPORT: slz: silence a build warning with -Wundef
  * BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -Wundef
  * BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -Wundef
  * BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILING
  * MINOR: proc: setting the process to produce a core dump on FreeBSD.
  * MINOR: tools: add FreeBSD support to get_exec_path()
  * BUILD: tools: get the absolute path of the current binary on NetBSD.
  * BUG/MINOR: flt-trace: fix an infinite loop when random-parsing is set
  * BUG/MINOR: cli/payload: do not search for args inside payload
  * BUILD: ist: prevent gcc11 maybe-uninitialized warning on istalloc
  * BUG/MINOR: connection: prevent null deref on mux cleanup task allocation
  * DOC: management: certificate files must be sanitized before injection
  * BUG/MINOR: tcpcheck: Improve LDAP response parsing to fix LDAP check
  * BUG/MAJOR: mux-h1: Don't eval input data if an error was reported
  * MINOR: pools: use mallinfo2() when available instead of mallinfo()
  * MINOR: pools: automatically disable malloc_trim() with external allocators
  * CLEANUP: pools: factor all malloc_trim() calls into trim_all_pools()
  * BUG/MINOR: compat: make sure __WORDSIZE is always defined
  * BUG/MEDIUM: stream-int: Don't block SI on a channel policy if EOI is reached
  * CLEANUP: mux-h1: Remove condition rejecting upgrade requests with payload
  * MINOR: htx: Skip headers with no value when adding a header list to a message
  * BUG/MEDIUM: mux-h1: Remove "Upgrade:" header for requests with payload
  * BUG/MINOR: systemd: ExecStartPre must use -Ws
  * BUG/MINOR: filters: Set right FLT_END analyser depending on channel
  * BUG/MINOR: filters: Always set FLT_END analyser when CF_FLT_ANALYZE flag is set
  * BUG/MEDIUM: http-ana: Reset channels analysers when returning an error
  * BUG/MINOR: stream: Don't release a stream if FLT_END is still registered
  * BUG/MINOR: lua: Don't yield in channel.append() and channel.set()
  * BUG/MINOR: lua: Yield in channel functions only if lua context can yield
  * MINOR: lua: Add a flag on lua context to know the yield capability at run time</changelog>
  <changelog author="mrueckert@suse.de" date="1633348800">- Update to version 2.4.6+git0.d83fd76a1:
  * [RELEASE] Released version 2.4.6
  * BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release</changelog>
  <changelog author="mrueckert@suse.de" date="1633348801">- Update to version 2.4.7+git0.b5e51a5e2:
  * [RELEASE] Released version 2.4.7
  * BUG/MEDIUM: http-ana: Clear request analyzers when applying redirect rule</changelog>
  <changelog author="mrueckert@suse.de" date="1635940800">- Update to version 2.4.8+git0.d1f8d41e0:
  * [RELEASE] Released version 2.4.8
  * SCRIPTS: git-show-backports: re-enable file-based filtering
  * DOC/peers: some grammar fixes for peers 2.1 spec
  * MINOR: stream: Improve dump of bogus streams
  * BUILD/MINOR: cpuset freebsd build fix
  * DOC: config: Fix alphabetical order of fc_* samples
  * BUG/MINOR: sample: fix backend direction flags consecutive to last fix
  * BUG/MEDIUM: sample: Cumulate frontend and backend sample validity flags
  * BUG/MEDIUM: stream-int: Block reads if channel cannot receive more data
  * BUG/MINOR: http: Authorization value can have multiple spaces after the scheme
  * BUG/MEDIUM: http-ana: Drain request data waiting the tarpit timeout expiration
  * MINOR: halog: Add support for extracting captures using -hdr
  * BUG/MINOR: halog: Add missing newlines in die() messages
  * CLEANUP: halog: Use consistent indentation in help()
  * MINOR: halog: Rename -qry to -query
  * DOC: halog: Move the `-qry` parameter into the correct section in help text
  * MINOR: halog: Add -qry parameter allowing to preserve the query string in -uX
  * BUG/MEDIUM: resolvers: Track api calls with a counter to free resolutions
  * BUG/MEDIUM: resolvers: Don't recursively perform requester unlink
  * MEDIUM: resolvers: remove the last occurrences of the "safe" argument
  * MEDIUM: resolvers: use a kill list to preserve the list consistency
  * CLEANUP: resolvers: replace all LIST_DELETE with LIST_DEL_INIT
  * CLEANUP: resolvers: simplify resolv_link_resolution() regarding requesters
  * CLEANUP: always initialize the answer_list
  * CLEANUP: resolvers: do not export resolv_purge_resolution_answer_records()
  * BUG/MEDIUM: mux-h1: Perform a connection shutdown when the h1c is released
  * BUG/MINOR: mux-h1: Save shutdown mode if the shutdown is delayed
  * BUILD: atomic: fix build on mac/arm64
  * BUG/MINOR: backend: fix improper insert in avail tree for always reuse
  * BUILD: fix compilation on NetBSD
  * MINOR: memprof: add one pointer size to the size of allocations
  * MINOR: memprof: report the delta between alloc and free on realloc()
  * BUG/MEDIUM: lua: fix memory leaks with realloc() on non-glibc systems
  * BUG/MINOR: mux-h2: do not prevent from sending a final GOAWAY frame
  * BUG/MINOR: task: do not set TASK_F_USR1 for no reason
  * BUG/MAJOR: buf: fix varint API post- vs pre- increment
  * BUG/MEDIUM: resolvers: always check a valid item in query_list
  * BUILD: resolvers: avoid a possible warning on null-deref
  * BUG/MAJOR: resolvers: add other missing references during resolution removal
  * MINOR: resolvers: merge address and target into a union "data"
  * BUG/MEDIUM: resolvers: use correct storage for the target address
  * BUG/MEDIUM: resolvers: fix truncated TLD consecutive to the API fix
  * MINOR: resolvers: fix the resolv_dn_label_to_str() API about trailing zero
  * BUG/MINOR: resolvers: do not reject host names of length 255 in SRV records
  * BUG/MEDIUM: resolver: make sure to always use the correct hostname length
  * MINOR: resolvers: fix the resolv_str_to_dn_label() API about trailing zero
  * BUG/MAJOR: dns: attempt to lock globaly for msg waiter list instead of use barrier
  * BUG/MAJOR: dns: tcp session can remain attached to a list after a free
  * BUG/MEDIUM: tcpcheck: Properly catch early HTTP parsing errors
  * Revert "CLEANUP: server: always include the storage for SSL settings"
  * BUG/MEDIUM: stream: Keep FLT_END analyzers if a stream detects a channel error
  * BUG/MEDIUM: cpuset: fix cpuset size for FreeBSD
  * BUG/MINOR: sample: Fix 'fix_tag_value' sample when waiting for more data
  * BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back
  * MINOR: initcall: Rename __GLOBL and __GLOBL1.
  * DOC: configuration: add clarification on escaping in keyword arguments
  * BUG/MEDIUM: mux_h2: Handle others remaining read0 cases on partial frames
  * BUG/MEDIUM: sample: properly verify that variables cast to sample
  * MINOR: sample: provide a generic var-to-sample conversion function
  * CLEANUP: sample: uninline sample_conv_var2smp_str()
  * CLEANUP: sample: rename sample_conv_var2smp() to *_sint
  * CLEANUP: server: always include the storage for SSL settings</changelog>
  <changelog author="varkoly@suse.com" date="1646740800">- (bsc#1196408) VUL-0: CVE-2022-0711: haproxy: Denial of service via set-cookie2 header
  o Apply upstream patch:
    0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch</changelog>
  <changelog author="varkoly@suse.com" date="1674043200">- VUL-0: CVE-2023-0056: haproxy: segfault DoS (bsc#1207181)
  o Apply upstream patch:
    0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch</changelog>
  <changelog author="varkoly@suse.com" date="1676030400">- VUL-0: serious vulnerability in the HTTP/1 parser (bsc#1208132)
  o Apply upstream patch:
    2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch
- The output buffer is not zero-initialized. If we don't clear reserved
  bytes, fcgi requests sent to backend will leak sensitive data.
  o Apply proposed patch:
    0001-output-buffer-is-not-zero-initialized.path</changelog>
</package>
<package pkgid="a5f85dc48d6f64029f1ef660da7797e0bfab1d91cf5dfba11c366d0a7c0d8605" name="haproxy" arch="x86_64">
  <version epoch="0" ver="2.4.8+git0.d1f8d41e0" rel="150400.3.10.1"/>
  <changelog author="mrueckert@suse.de" date="1610539200">- Update to version 2.3.4+git0.10189c965:
  * [RELEASE] Released version 2.3.4
  * MINOR: contrib/prometheus-exporter: use fill_info for process dump
  * MINOR: contrib/prometheus-exporter: avoid connection close header
  * BUG/MINOR: init: enforce strict-limits when using master-worker
  * BUG/MINOR: check: Don't perform any check on servers defined in a frontend
  * BUG/MINOR: sample: Memory leak of sample_expr structure in case of error
  * Revert "BUG/MINOR: dns: SRV records ignores duplicated AR records"
  * MINOR: reg-tests: add base prometheus test
  * BUG/MINOR: reg-tests: fix service dependency script
  * BUG/MINOR: sample: check alloc_trash_chunk return value in concat()
  * MINOR: reg-tests: add a way to add service dependency</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Add lua54.patch to fix building with lua 5.4</changelog>
  <changelog author="mrueckert@suse.de" date="1612612800">- Update to version 2.3.5+git0.5902ad99b:
  * [RELEASE] Released version 2.3.5
  * MINOR: config: Deprecate and ignore tune.chksize global option
  * BUG/MINOR: sock: Unclosed fd in case of connection allocation failure
  * BUG/MEDIUM: mux-h2: do not quit the demux loop before setting END_REACHED
  * BUG/MEDIUM: mux-h2: handle remaining read0 cases
  * BUILD: Makefile: move REGTESTST_TYPE default setting
  * MINOR: cli/show_fd: report local and report ports when known
  * BUILD: ssl: fix build breakage with last commit
  * BUG/MINOR: ssl: do not try to use early data if not configured
  * BUG/MINOR: xxhash: make sure armv6 uses memcpy()
  * BUG/MINOR: mux_h2: fix incorrect stat titles
  * BUG/MEDIUM: ssl: check a connection's status before computing a handshake
  * BUG/MEDIUM: ssl/cli: abort ssl cert is freeing the old store
  * BUG/MINOR: stick-table: Always call smp_fetch_src() with a valid arg list
  * DOC: management: fix "show resolvers" alphabetical ordering
  * MINOR: h1: Raise the chunk size limit up to (2^52 - 1)
  * MINOR: mux-h1/show_fd: report as suspicious an entry with too many calls
  * MINOR: mux-h2/show_fd: report as suspicious an entry with too many calls
  * MINOR: ssl/show_fd: report some FDs as suspicious when possible
  * MINOR: cli/show_fd: report some easily detectable suspicious states
  * MINOR: cli: give the show_fd helpers the ability to report a suspicious entry
  * MINOR: mux-fcgi: make the "show fd" helper also decode the fstrm subscriber when known
  * MINOR: mux-h1: make the "show fd" helper also decode the h1s subscriber when known
  * MINOR: mux-h2: make the "show fd" helper also decode the h2s subscriber when known
  * MINOR: xprt/mux: export all *_io_cb functions so that "show fd" resolves them
  * MINOR: ssl: provide a "show fd" helper to report important SSL information
  * MINOR: xprt: add a new show_fd() helper to complete some "show fd" dumps.
  * MINOR: cli: make "show fd" also report the xprt and xprt_ctx
  * CLEANUP: cli: make "show fd" use a const connection to access other fields
  * CLEANUP: tools: make resolve_sym_name() take a const pointer
  * MINOR: contrib: Make the wireshark peers dissector compile for more distribs.
  * BUG/MINOR: backend: check available list allocation for reuse
  * BUG/MEDIUM: backend: never reuse a connection for tcp mode
  * REORG: backend: simplify conn_backend_get
  * BUG/MEDIUM: session: only retrieve ready idle conn from session
  * BUG/MINOR: ssl: init tmp chunk correctly in ssl_sock_load_sctl_from_file()
  * BUG/MINOR: config: fix leak on proxy.conn_src.bind_hdr_name
  * BUG/MEDIUM: filters/htx: Fix data forwarding when payload length is unknown
  * DOC: Improve documentation of the various hdr() fetches
  * BUILD/MINOR: lua: define _GNU_SOURCE for LLONG_MAX
  * BUG/MEDIUM: mux-h2: fix read0 handling on partial frames
  * BUG/MEDIUM: tcpcheck: Don't destroy connection in the wake callback context
  * BUG/MINOR: mworker: define _GNU_SOURCE for strsignal()
  * BUG/MINOR: mux_h2: missing space between "st" and ".flg" in the "show fd" helper
  * BUG/MINOR: peers: Wrong "new_conn" value for "show peers" CLI command.
  * MINOR: build: discard echoing in help target
  * BUG/MINOR: peers: Possible appctx pointer dereference.
  * BUG/MEDIUM: stats: add missing INF_BUILD_INFO definition
  * BUILD: peers: fix build warning about unused variable
  * BUG/MINOR: dns: SRV records ignores duplicated AR records (v2)
  * MINOR: peers: Add traces for peer control messages.
  * BUG/MINOR: threads: Fixes the number of possible cpus report for Mac.
  * MINOR: server: Forbid server definitions in frontend sections
  * MINOR: config: Add failifnotcap() to emit an alert on proxy capabilities
  * BUG/MINOR: init: Use a dynamic buffer to set HAPROXY_CFGFILES env variable</changelog>
  <changelog author="mrueckert@suse.de" date="1614772800">- Update to version 2.3.6+git0.7851701ed:
  * [RELEASE] Released version 2.3.6
  * BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout
  * BUG/MINOR: mux-h2: Fix typo in scheme adjustment
  * DOC: spoe: Add a note about fragmentation support in HAProxy
  * BUG/MEDIUM: spoe: Kill applets if there are pending connections and nbthread &gt; 1
  * BUG/MINOR: connection: Use the client's dst family for adressless servers
  * BUG/MINOR: tcp-act: Don't forget to set the original port for IPv4 set-dst rule
  * BUG/MINOR: http-ana: Only consider dst address to process originalto option
  * BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf()
  * BUG/MINOR: stats: fix compare of no-maint url suffix
  * CLEANUP: muxes: Remove useless if condition in show_fd function
  * BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup()
  * BUG/MEDIUM: resolvers: Reset address for unresolved servers
  * BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records
  * BUG/MINOR: resolvers: new callback to properly handle SRV record errors
  * BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record
  * BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned
  * BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl()
  * BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal
  * BUG/MEDIUM: cli/shutdown sessions: make it thread-safe
  * BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop
  * BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe
  * BUG/MINOR: sample: secure convs that accept base64 string and var name as args
  * MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes
  * BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert"
  * BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok
  * BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line
  * BUG/MINOR: server: Init params before parsing a new server-state line
  * BUG/MINOR: http-rules: Always replace the response status on a return action
  * BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer
  * BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ().
  * DOC: explain the relation between pool-low-conn and tune.idle-pool.shared
  * BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions
  * BUG/MINOR: sample: Always consider zero size string samples as unsafe
  * BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust()
  * BUG/MINOR: checks: properly handle wrapping time in __health_adjust()
  * BUG/MINOR: session: atomically increment the tracked sessions counter
  * BUG/MINOR: server: Remove RMAINT from admin state when loading server state
  * CLEANUP: channel: fix comment in ci_putblk.
  * DOC: tune: explain the origin of block size for ssl.cachesize
  * BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL
  * BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines
  * BUG/MINOR: stats: revert the change on ST_CONVDONE
  * BUG/MEDIUM: config: don't pick unset values from last defaults section
  * CLEANUP: deinit: release global and per-proxy server-state variables on deinit
  * BUG/MINOR: server: Fix server-state-file-name directive
  * BUG/MINOR: backend: hold correctly lock when killing idle conn
  * BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints()
  * BUG/MINOR: server: re-align state file fields number
  * BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state
  * BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors
  * BUG/MINOR: intops: fix mul32hi()'s off-by-one
  * BUILD: ssl: guard SSL_CTX_set_msg_callback with SSL_CTRL_SET_MSG_CALLBACK macro
  * BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro
  * BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro
  * MINOR: check: do not ignore a connection header for http-check send</changelog>
  <changelog author="mrueckert@suse.de" date="1615896000">- Update to version 2.3.7+git0.2d39ce334:
  * [RELEASE] Released version 2.3.7
  * BUG/MINOR: resolvers: Add missing case-insensitive comparisons of DNS hostnames
  * MINOR: resolvers: Don't try to match immediatly renewed ADD items
  * MINOR: resolvers: Use milliseconds for cached items in resolver responses
  * BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set
  * BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks
  * MINOR: resolvers: Directly call srvrq_update_srv_state() when possible
  * MINOR: resolvers: Add function to change the srv status based on SRV resolution
  * MINOR: resolvers: Purge answer items when a SRV resolution triggers an error
  * MINOR: resolvers: Use a function to remove answers attached to a resolution
  * BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete
  * BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item
  * MINOR: resolvers: new function find_srvrq_answer_record()
  * BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item
  * BUG/MEDIUM: resolvers: Don't set an address-less server as UP
  * BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution
  * BUG/MINOR: resolvers: Reset server address on DNS error only on status change
  * BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error
  * Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record"
  * CLEANUP: tcp-rules: add missing actions in the tcp-request error message
  * BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check
  * BUG/MINOR: session: Add some forgotten tests on session's listener
  * BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters
  * BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check
  * BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached
  * BUILD: atomic/arm64: force the register pairs to use in __ha_cas_dw()
  * BUG/MEDIUM: stick-tables: fix ref counter in table entry using multiple http tracksc.
  * OPTIM: task: automatically adjust the default runqueue-depth to the threads
  * MINOR: task: give the scheduler a bit more flexibility in the runqueue size
  * MEDIUM: task: remove the tasks_run_queue counter and have one per thread
  * MEDIUM: ssl: implement xprt_set_used and xprt_set_idle to relax context checks
  * MINOR: xprt: add new xprt_set_idle and xprt_set_used methods
  * MEDIUM: muxes: mark idle conns tasklets with TASK_F_USR1
  * MINOR: task: add an application specific flag to the state: TASK_F_USR1
  * BUG/MEDIUM: ssl: properly remove the TASK_HEAVY flag at end of handshake
  * MINOR: ssl: mark the SSL handshake tasklet as heavy
  * MINOR: task: limit the number of subsequent heavy tasks with flag TASK_HEAVY
  * MEDIUM: backend: use a trylock when trying to grab an idle connection
  * MINOR: pools: double the local pool cache size to 1 MB
  * MEDIUM: pools: add CONFIG_HAP_NO_GLOBAL_POOLS and CONFIG_HAP_GLOBAL_POOLS
  * MEDIUM: streams: do not use the streams lock anymore
  * MINOR: streams: use one list per stream instead of a global one
  * MINOR: cli/streams: make "show sess" dump all streams till the new epoch
  * MINOR: stream: add an "epoch" to figure which streams appeared when
  * MINOR: dynbuf: pass offer_buffers() the number of buffers instead of a threshold
  * MINOR: dynbuf: use regular lists instead of mt_lists for buffer_wait
  * MINOR: dynbuf: make the buffer wait queue per thread
  * OPTIM: lb-leastconn: do not unlink the server if it did not change
  * OPTIM: lb-leastconn: do not take the server lock on take_conn/drop_conn
  * OPTIM: lb-first: do not take the server lock on take_conn/drop_conn
  * MINOR: lb/api: let callers of take_conn/drop_conn tell if they have the lock
  * MINOR: server: move actconns to the per-thread structure
  * OPTIM: server: switch the actconn list to an mt-list
  * MINOR: listener: refine the default MAX_ACCEPT from 64 to 4
  * MINOR: tasks: refine the default run queue depth
  * BUG/MEDIUM: session: NULL dereference possible when accessing the listener
  * MINOR: atomic: implement a more efficient arm64 __ha_cas_dw() using pairs
  * MINOR: atomic: add armv8.1-a atomics variant for cas-dw
  * BUG/MINOR: mt-list: always perform a cpu_relax call on failure
  * REORG: atomic: reimplement pl_cpu_relax() from atomic-ops.h
  * BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode
  * BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring()
  * BUG/MINOR: backend: fix condition for reuse on mode HTTP</changelog>
  <changelog author="mrueckert@suse.de" date="1616673600">- Update to version 2.3.8+git0.e572195c7:
  * [RELEASE] Released version 2.3.8
  * BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters
  * MINOR: tools: make url2ipv4 return the exact number of bytes parsed
  * BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless
  * BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available.
  * CLEANUP: fd: remove unused fd_set_running_excl()
  * BUG/MEDIUM: fd: do not wait on FD removal in fd_delete()
  * MINOR: fd: remove the unneeded running bit from fd_insert()
  * MINOR: fd: make fd_clr_running() return the remaining running mask
  * BUG/MEDIUM: lua: Always init the lua stack before referencing the context
  * BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback
  * MINOR: lua: Slightly improve function dumping the lua traceback
  * BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro
  * BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list"
  * BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable
  * MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua
  * MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master CLI socket
  * BUG/MINOR: protocol: add missing support of dgram unix socket.
  * BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable
  * MINOR: time: also provide a global, monotonic global_now_ms timer
  * BUG/MEDIUM: mux-fcgi: Fix locking of idle_conns lock in the FCGI I/O callback
  * BUG/MINOR: freq_ctr/threads: make use of the last updated global time
  * MINOR: time: export the global_now variable</changelog>
  <changelog author="mrueckert@suse.de" date="1617105600">- Update to version 2.3.9+git1.afb63bc04:
  * BUILD: backend: fix build breakage in idle conn locking fix
  * [RELEASE] Released version 2.3.9
  * BUG/MEDIUM: time: make sure to always initialize the global tick
  * BUG/MINOR: stats: Apply proper styles in HTML status page.
  * BUG/MINOR: payload: Wait for more data if buffer is empty in payload/payload_lv
  * MEDIUM: backend: use a trylock to grab a connection on high FD counts as well
  * BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent</changelog>
  <changelog author="mrueckert@suse.de" date="1619179200">- Update to version 2.3.10+git0.4764f0e4e:
  * [RELEASE] Released version 2.3.10
  * BUG/MEDIUM: peers: re-work refcnt on table to protect against flush
  * BUG/MEDIUM: peers: re-work connection to new process during reload.
  * BUG/MINOR: peers: remove useless table check if initial resync is finished
  * BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data
  * BUG/MINOR: mworker: don't use oldpids[] anymore for reload
  * BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases
  * BUG/MEDIUM: config: fix cpu-map notation with both process and threads
  * BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames
  * BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers
  * BUG/MINOR: server: free srv.lb_nodes in free_server
  * BUG/MINOR: mux-h1: Release idle server H1 connection if data are received
  * BUG/MINOR: logs: Report the true number of retries if there was no connection
  * BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function
  * BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded
  * BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check
  * MINOR: connection: Make bc_http_major compatible with tcp-checks
  * BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections
  * MINOR: logs: Add support of checks as session origin to format lf strings
  * BUG/MINOR: checks: Set missing id to the dummy checks frontend
  * BUG/MEDIUM: threads: Ignore current thread to end its harmless period
  * DOC: ssl: Certificate hot update only works on fronted certificates
  * BUG/MEDIUM: sample: Fix adjusting size in field converter
  * MINOR: No longer rely on deprecated sample fetches for predefined ACLs
  * DOC: clarify that compression works for HTTP/2
  * BUG/MINOR: tools: fix parsing "us" unit for timers
  * CONTRIB: halog: fix issue with array of type char
  * REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken
  * DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options
  * REGTESTS: ssl: "set ssl cert" and multi-certificates bundle
  * BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free
  * BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields
  * BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one
  * BUG/MINOR: ssl: Fix update of default certificate
  * BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS
  * BUG/MINOR: tcp: fix silent-drop workaround for IPv6</changelog>
  <changelog author="mrueckert@suse.de" date="1620993600">- Update to version 2.4.0+git0.6cbbecf09:
  https://www.haproxy.com/blog/announcing-haproxy-2-4/
  for all the details see /usr/share/doc/packages/haproxy/CHANGELOG
- refreshed patches to apply cleanly again
  haproxy-1.6.0-makefile_lib.patch
  haproxy-1.6.0-sec-options.patch
  lua54.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1623931200">- Update to version 2.4.1+git0.1ce7d4925:
  * [RELEASE] Released version 2.4.1
  * BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces
  * BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace
  * MINOR: mux-h2: obey http-ignore-probes during the preface
  * BUG/MINOR: stats: make "show stat typed desc" work again
  * CLEANUP: mux-h2/traces: better align user messages
  * MINOR: mux-h2/trace: report a few connection-level info during h2_init()
  * MINOR: connection: add helper conn_append_debug_info()
  * BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers
  * BUG/MINOR: mux-h1: do not skip the error response on bad requests
  * MINOR: backend: only skip LB when there are actual connections
  * BUG/MAJOR: queue: set SF_ASSIGNED when setting strm-&gt;target on dequeue
  * CLEANUP: global: remove unused definition of stopping_task[]
  * BUG/MINOR: mworker: fix typo in chroot error message
  * BUG/MINOR: ssl: use atomic ops to update global shctx stats
  * BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE
  * BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node
  * BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree
  * BUG/MEDIUM: server: do not forget to generate the dynamic servers ids
  * BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees
  * BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server'
  * BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id
  * DOC: lua: Add a warning about buffers modification in HTTP
  * BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs
  * MEDIUM: resolvers: add a ref between servers and srv request or used SRV record
  * MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item
  * BUG/MINOR: resolvers: answser item list was randomly purged or errors
  * CLEANUP: l7-retries: do not test the buffer before calling b_alloc()
  * BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default
  * BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded
  * CLEANUP: pools: remove now unused seq and pool_free_list
  * BUG/MAJOR: pools: fix possible race with free() in the lockless variant
  * MEDIUM: pools: use a single pool_gc() function for locked and lockless
  * MINOR: pools: call malloc_trim() under thread isolation
  * MINOR: pools: do not maintain the lock during pool_flush()
  * BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location
  * BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush()
  * BUG/MEDIUM: compression: Add a flag to know the filter is still processing data
  * BUG/MEDIUM: compression: Properly get the next block to iterate on payload
  * BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next block
  * BUG/MEDIUM: opentracing: initialization before establishing daemon and/or chroot mode
  * Revert "BUG/MINOR: opentracing: initialization after establishing daemon mode"
  * BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future
  * BUILD: make tune.ssl.keylog available again
  * DOC: use the req.ssl_sni in examples
  * MINOR: errors: allow empty va_args for diag variadic macro
  * BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry
  * DOC/MINOR: move uuid in the configuration to the right alphabetical order
  * BUG/MINOR: vars: Be sure to have a session to get checks variables
  * CLEANUP: http-ana: Remove useless if statement about L7 retries
  * BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree
  * BUG/MINOR: http: Missing calloc return value check in make_arg_list
  * BUG/MINOR: http: Missing calloc return value check while parsing redirect rule
  * BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list
  * BUG/MINOR: compression: Missing calloc return value check in comp_append_type/algo
  * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request rule
  * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request/tcp-response
  * BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy
  * BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare
  * BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture
  * BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine
  * BUG/MINOR: peers: Missing calloc return value check in peers_register_table
  * BUG/MINOR: server: Missing calloc return value check in srv_parse_source
  * DOC: intro: Fix typo in starter guide
  * MINOR: cfgparse: Fail when encountering extra arguments in macro
  * MINOR: http-ana: Perform L7 retries because of status codes in response analyser
  * BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts
  * BUG/MINOR: http-ana: Send the right error if max retries is reached on L7 retry
  * Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers"
  * BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response
  * BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter
  * BUILD/MINOR: opentracing: fixed build when using clang
  * BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'
  * BUG/MEDIUM: ebtree: Invalid read when looking for dup entry</changelog>
  <changelog author="mrueckert@suse.de" date="1625659200">- Update to version 2.4.2+git0.553dee326:
  * [RELEASE] Released version 2.4.2
  * REGTESTS: add http scheme-based normalization test
  * MEDIUM: h2: apply scheme-based normalization on h2 requests
  * MEDIUM: h1-htx: apply scheme-based normalization on h1 requests
  * MEDIUM: http: implement scheme-based normalization
  * MINOR: http: implement http_get_scheme
  * Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules"
  * BUG/MINOR: cli: fix server name output in "show fd"
  * BUG/MEDIUM: sock: make sure to never miss early connection failures
  * DOC: stick-table: add missing documentation about gpt0 stored type
  * BUG/MINOR: peers: fix data_type bit computation more than 32 data_types
  * BUG/MINOR: stick-table: fix several printf sign errors dumping tables
  * DOC: config: use CREATE USER for mysql-check
  * BUG/MEDIUM: resolvers: Make 1st server of a template take part to SRV resolution
  * BUG/MINOR: mqtt: Support empty client ID in CONNECT message
  * BUG/MINOR: mqtt: Fix parser for string with more than 127 characters
  * BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules
  * BUILD: Makefile: fix linkage for Haiku.
  * BUG/MINOR: checks: return correct error code for srv_parse_agent_check
  * MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response()
  * BUG/MINOR: resolvers: Reset server IP when no ip is found in the response
  * BUG/MINOR: resolvers: Always attach server on matching record on resolution
  * CLEANUP: dns: Remove a forgotten debug message
  * DOC: config: Add missing actions in "tcp-request session" documentation
  * MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules
  * REGTESTS: fix maxconn update with agent-check
  * BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check
  * BUG/MINOR: cache: Correctly handle existing-but-empty 'accept-encoding' header
  * BUG/MINOR: server/cli: Fix locking in function processing "set server" command
  * BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task()
  * BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status
  * MINOR: resolvers: Remove server from named_servers tree when removing a SRV item
  * MINOR: resolvers: Clean server in a dedicated function when removing a SRV item
  * BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI
  * BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled
  * BUG/MINOR: server-state: load SRV resolution only if params match the config</changelog>
  <changelog author="mrueckert@suse.de" date="1629201600">- Update to version 2.4.3+git0.4dd5a5a6c:
    CVE-2021-39240 CVE-2021-39241 CVE-2021-39242
    (boo#1189366 boo#1189548 boo#1189549)
  * [RELEASE] Released version 2.4.3
  * REGTESTS: add a test to prevent h2 desync attacks
  * BUG/MEDIUM: h2: give :authority precedence over Host
  * BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header
  * BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it
  * BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax
  * MINOR: http: add a new function http_validate_scheme() to validate a scheme
  * DOC/MINOR: fix typo in management document
  * CLEANUP: assorted typo fixes in the code and comments
  * BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during config check
  * BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued
  * DOC: config: Fix 'http-response send-spoe-group' documentation
  * DOC: Improve the lua documentation
  * BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer
  * BUG/MINOR: buffer: fix buffer_dump() formatting
  * BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one is released
  * MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure
  * ADMIN: dyncookie: implement a simple dynamic cookie calculator
  * MINOR: server: unmark deprecated on enable health/agent cli
  * BUG/MINOR: server: update last_change on maint-&gt;ready transitions too
  * BUG/MINOR: server: remove srv from px list on CLI 'add server' error
  * BUILD: opentracing: fixed build when using pkg-config utility
  * DOC: internals: document the FD takeover process
  * BUG/MINOR: fd: protect fd state harder against a concurrent takeover
  * BUG/MINOR: pollers: always program an update for migrated FDs
  * BUG/MINOR: poll: fix abnormally high skip_fd counter
  * BUG/MINOR: select: fix excess number of dead/skip reported
  * BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before
  * BUG/MEDIUM: connection: close a rare race between idle conn close and takeover
  * BUG/MINOR: connection: Add missing error labels to conn_err_code_str
  * BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames
  * BUG/MINOR: mux-h1: Be sure to swap H1C to splice mode when rcv_pipe() is called
  * BUG/MINOR: mux-h2: Obey dontlognull option during the preface
  * BUG/MINOR: mux-h1: Obey dontlognull option for empty requests
  * BUG/MINOR: systemd: must check the configuration using -Ws
  * BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree
  * BUG/MINOR: check: fix the condition to validate a port-less server
  * BUG/MINOR: stats: Add missing agent stats on servers
  * BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request
  * BUILD/MINOR: memprof fix macOs build.
  * BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs
  * BUG/MEDIUM: mworker: do not register an exit handler if exit is expected
  * BUILD: lua: silence a build warning with TCC
  * BUILD: add detection of missing important CFLAGS
  * BUG/MINOR: ssl: Default-server configuration ignored by server
  * MINOR: mux_h2: define config to disable h2 websocket support
  * BUILD: http_htx: fix ci compilation error with isdigit for Windows</changelog>
  <changelog author="mrueckert@suse.de" date="1631016000">- Update to version 2.4.4+git0.acb1d0bea: CVE-2021-40346 (boo#1189877)
  * [RELEASE] Released version 2.4.4
  * Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive"
  * BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer
  * CLEANUP: htx: remove comments about "must be &lt; 256 MB"
  * BUG/MINOR: config: reject configs using HTTP with bufsize &gt;= 256 MB
  * DOC: configuration: remove wrong tcp-request examples in tcp-response
  * BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser
  * CLEANUP: Add missing include guard to signal.h
  * BUG/MINOR: tools: Fix loop condition in dump_text()
  * BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time
  * BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long
  * MINOR: time: add report_idle() to report process-wide idle time
  * BUG/MINOR: time: fix idle time computation for long sleeps
  * BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords
  * MINOR: compiler: implement an ONLY_ONCE() macro
  * BUG/MINOR: base64: base64urldec() ignores padding in output size check
  * BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec}
  * BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions
  * MINOR: hlua: take the global Lua lock inside a global function
  * REGTESTS: abortonclose: after retries, 503 is expected, not close
  * REGTESTS: http_upgrade: fix incorrect expectation on TCP-&gt;H1-&gt;H2
  * BUG/MEDIUM: h2: match absolute-path not path-absolute for :path</changelog>
  <changelog author="mrueckert@suse.de" date="1633089600">- Update to version 2.4.5+git0.e74a1b34b:
  * [RELEASE] Released version 2.4.5
  * MINOR: tasks: catch TICK_ETERNITY with BUG_ON() in __task_queue()
  * BUG/MINOR: tcp-rules: Stop content rules eval on read error and end-of-input
  * BUG/MINOR: tcpcheck: Don't use arg list for default proxies during parsing
  * MINOR: arg: Be able to forbid unresolved args when building an argument list
  * BUG/MAJOR: lua: use task_wakeup() to properly run a task once
  * BUG/MEDIUM: lua: fix wakeup condition from sleep()
  * MINOR: Makefile: add MEMORY_POOLS to the list of DEBUG_xxx options
  * DOC: peers: fix doc "enable" statement on "peers" sections
  * BUG/MINOR: mux-h1/mux-fcgi: Sanitize TE header to only send "trailers"
  * MINOR: stream-int: Notify mux when the buffer is not stuck when calling rcv_buf
  * BUG/MEDIUM: stream-int: Defrag HTX message in si_cs_recv() if necessary
  * MINOR: htx: Add a function to know if the free space wraps
  * MINOR: htx: Add an HTX flag to know when a message is fragmented
  * MINOR: stream-int: Set CO_RFL transient/persistent flags apart in si_cs_rcv()
  * BUG/MEDIUM: stream: Stop waiting for more data if SI is blocked on RXBLK_ROOM
  * BUG/MEDIUM: stream-int: Notify stream that the mux wants more room to xfer data
  * BUG/MEDIUM: mux-h1: Adjust conditions to ask more space in the channel buffer
  * BUG/MINOR: stats: use refcount to protect dynamic server on dump
  * MINOR: server: return the next srv instance on free_server
  * BUG/MINOR: server: do not use refcount in free_server in stopping mode
  * MINOR: global: define MODE_STOPPING
  * MINOR: server: implement a refcount for dynamic servers
  * BUG/MINOR: http-ana: increment internal_errors counter on response error
  * BUG/MINOR: h1-htx: Fix a typo when request parser is reset
  * BUG/MEDIUM: leastconn: fix rare possibility of divide by zero
  * BUG/MINOR: server: allow 'enable health' only if check configured
  * BUILD: threads: fix -Wundef for _POSIX_PRIORITY_SCHEDULING on libmusl
  * BUILD: halog: fix a -Wundef warning on non-glibc systems
  * BUILD: compiler: fixed a missing test on  defined(__GNUC__)
  * BUILD: fix dragonfly build again on __read_mostly
  * BUG/MINOR: vars: do not talk about global section in CLI errors for set-var
  * BUG/MINOR: vars: truncate the variable name in error reports about scope.
  * BUG/MINOR: vars: properly set the argument parsing context in the expression
  * MINOR: sample: add missing ARGC_ entries
  * BUG/MINOR: vars: improve accuracy of the rules used to check expression validity
  * BUILD: tools: properly guard __GLIBC__ with defined()
  * BUILD: ssl: fix two remaining occurrences of #if USE_OPENSSL
  * BUILD: ssl: next round of build warnings on LIBRESSL_VERSION_NUMBER
  * BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -Wundef
  * IMPORT: slz: silence a build warning with -Wundef
  * BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -Wundef
  * BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -Wundef
  * BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILING
  * MINOR: proc: setting the process to produce a core dump on FreeBSD.
  * MINOR: tools: add FreeBSD support to get_exec_path()
  * BUILD: tools: get the absolute path of the current binary on NetBSD.
  * BUG/MINOR: flt-trace: fix an infinite loop when random-parsing is set
  * BUG/MINOR: cli/payload: do not search for args inside payload
  * BUILD: ist: prevent gcc11 maybe-uninitialized warning on istalloc
  * BUG/MINOR: connection: prevent null deref on mux cleanup task allocation
  * DOC: management: certificate files must be sanitized before injection
  * BUG/MINOR: tcpcheck: Improve LDAP response parsing to fix LDAP check
  * BUG/MAJOR: mux-h1: Don't eval input data if an error was reported
  * MINOR: pools: use mallinfo2() when available instead of mallinfo()
  * MINOR: pools: automatically disable malloc_trim() with external allocators
  * CLEANUP: pools: factor all malloc_trim() calls into trim_all_pools()
  * BUG/MINOR: compat: make sure __WORDSIZE is always defined
  * BUG/MEDIUM: stream-int: Don't block SI on a channel policy if EOI is reached
  * CLEANUP: mux-h1: Remove condition rejecting upgrade requests with payload
  * MINOR: htx: Skip headers with no value when adding a header list to a message
  * BUG/MEDIUM: mux-h1: Remove "Upgrade:" header for requests with payload
  * BUG/MINOR: systemd: ExecStartPre must use -Ws
  * BUG/MINOR: filters: Set right FLT_END analyser depending on channel
  * BUG/MINOR: filters: Always set FLT_END analyser when CF_FLT_ANALYZE flag is set
  * BUG/MEDIUM: http-ana: Reset channels analysers when returning an error
  * BUG/MINOR: stream: Don't release a stream if FLT_END is still registered
  * BUG/MINOR: lua: Don't yield in channel.append() and channel.set()
  * BUG/MINOR: lua: Yield in channel functions only if lua context can yield
  * MINOR: lua: Add a flag on lua context to know the yield capability at run time</changelog>
  <changelog author="mrueckert@suse.de" date="1633348800">- Update to version 2.4.6+git0.d83fd76a1:
  * [RELEASE] Released version 2.4.6
  * BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release</changelog>
  <changelog author="mrueckert@suse.de" date="1633348801">- Update to version 2.4.7+git0.b5e51a5e2:
  * [RELEASE] Released version 2.4.7
  * BUG/MEDIUM: http-ana: Clear request analyzers when applying redirect rule</changelog>
  <changelog author="mrueckert@suse.de" date="1635940800">- Update to version 2.4.8+git0.d1f8d41e0:
  * [RELEASE] Released version 2.4.8
  * SCRIPTS: git-show-backports: re-enable file-based filtering
  * DOC/peers: some grammar fixes for peers 2.1 spec
  * MINOR: stream: Improve dump of bogus streams
  * BUILD/MINOR: cpuset freebsd build fix
  * DOC: config: Fix alphabetical order of fc_* samples
  * BUG/MINOR: sample: fix backend direction flags consecutive to last fix
  * BUG/MEDIUM: sample: Cumulate frontend and backend sample validity flags
  * BUG/MEDIUM: stream-int: Block reads if channel cannot receive more data
  * BUG/MINOR: http: Authorization value can have multiple spaces after the scheme
  * BUG/MEDIUM: http-ana: Drain request data waiting the tarpit timeout expiration
  * MINOR: halog: Add support for extracting captures using -hdr
  * BUG/MINOR: halog: Add missing newlines in die() messages
  * CLEANUP: halog: Use consistent indentation in help()
  * MINOR: halog: Rename -qry to -query
  * DOC: halog: Move the `-qry` parameter into the correct section in help text
  * MINOR: halog: Add -qry parameter allowing to preserve the query string in -uX
  * BUG/MEDIUM: resolvers: Track api calls with a counter to free resolutions
  * BUG/MEDIUM: resolvers: Don't recursively perform requester unlink
  * MEDIUM: resolvers: remove the last occurrences of the "safe" argument
  * MEDIUM: resolvers: use a kill list to preserve the list consistency
  * CLEANUP: resolvers: replace all LIST_DELETE with LIST_DEL_INIT
  * CLEANUP: resolvers: simplify resolv_link_resolution() regarding requesters
  * CLEANUP: always initialize the answer_list
  * CLEANUP: resolvers: do not export resolv_purge_resolution_answer_records()
  * BUG/MEDIUM: mux-h1: Perform a connection shutdown when the h1c is released
  * BUG/MINOR: mux-h1: Save shutdown mode if the shutdown is delayed
  * BUILD: atomic: fix build on mac/arm64
  * BUG/MINOR: backend: fix improper insert in avail tree for always reuse
  * BUILD: fix compilation on NetBSD
  * MINOR: memprof: add one pointer size to the size of allocations
  * MINOR: memprof: report the delta between alloc and free on realloc()
  * BUG/MEDIUM: lua: fix memory leaks with realloc() on non-glibc systems
  * BUG/MINOR: mux-h2: do not prevent from sending a final GOAWAY frame
  * BUG/MINOR: task: do not set TASK_F_USR1 for no reason
  * BUG/MAJOR: buf: fix varint API post- vs pre- increment
  * BUG/MEDIUM: resolvers: always check a valid item in query_list
  * BUILD: resolvers: avoid a possible warning on null-deref
  * BUG/MAJOR: resolvers: add other missing references during resolution removal
  * MINOR: resolvers: merge address and target into a union "data"
  * BUG/MEDIUM: resolvers: use correct storage for the target address
  * BUG/MEDIUM: resolvers: fix truncated TLD consecutive to the API fix
  * MINOR: resolvers: fix the resolv_dn_label_to_str() API about trailing zero
  * BUG/MINOR: resolvers: do not reject host names of length 255 in SRV records
  * BUG/MEDIUM: resolver: make sure to always use the correct hostname length
  * MINOR: resolvers: fix the resolv_str_to_dn_label() API about trailing zero
  * BUG/MAJOR: dns: attempt to lock globaly for msg waiter list instead of use barrier
  * BUG/MAJOR: dns: tcp session can remain attached to a list after a free
  * BUG/MEDIUM: tcpcheck: Properly catch early HTTP parsing errors
  * Revert "CLEANUP: server: always include the storage for SSL settings"
  * BUG/MEDIUM: stream: Keep FLT_END analyzers if a stream detects a channel error
  * BUG/MEDIUM: cpuset: fix cpuset size for FreeBSD
  * BUG/MINOR: sample: Fix 'fix_tag_value' sample when waiting for more data
  * BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back
  * MINOR: initcall: Rename __GLOBL and __GLOBL1.
  * DOC: configuration: add clarification on escaping in keyword arguments
  * BUG/MEDIUM: mux_h2: Handle others remaining read0 cases on partial frames
  * BUG/MEDIUM: sample: properly verify that variables cast to sample
  * MINOR: sample: provide a generic var-to-sample conversion function
  * CLEANUP: sample: uninline sample_conv_var2smp_str()
  * CLEANUP: sample: rename sample_conv_var2smp() to *_sint
  * CLEANUP: server: always include the storage for SSL settings</changelog>
  <changelog author="varkoly@suse.com" date="1646740800">- (bsc#1196408) VUL-0: CVE-2022-0711: haproxy: Denial of service via set-cookie2 header
  o Apply upstream patch:
    0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch</changelog>
  <changelog author="varkoly@suse.com" date="1674043200">- VUL-0: CVE-2023-0056: haproxy: segfault DoS (bsc#1207181)
  o Apply upstream patch:
    0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch</changelog>
  <changelog author="varkoly@suse.com" date="1676030400">- VUL-0: serious vulnerability in the HTTP/1 parser (bsc#1208132)
  o Apply upstream patch:
    2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch
- The output buffer is not zero-initialized. If we don't clear reserved
  bytes, fcgi requests sent to backend will leak sensitive data.
  o Apply proposed patch:
    0001-output-buffer-is-not-zero-initialized.path</changelog>
</package>
<package pkgid="cf07e07a74c94df7bc0aadcec5d909aeb5c124d74602386ffcd55c7f982820b3" name="haproxy" arch="aarch64">
  <version epoch="0" ver="2.4.8+git0.d1f8d41e0" rel="150400.3.6.1"/>
  <changelog author="mrueckert@suse.de" date="1610107200">- Update to version 2.3.3+git0.9233c2143:
  * [RELEASE] Released version 2.3.3
  * BUG/MINOR: sample: fix concat() converter's corruption with non-string variables
  * DOC: Add maintainers for the Prometheus exporter
  * SCRIPTS: announce-release: fix typo in help message
  * DOC: fix some spelling issues over multiple files
  * MINOR: contrib/prometheus-exporter: export build_info
  * CLEANUP: cfgparse: replace "realloc" with "my_realloc2" to fix to memory leak on error
  * BUILD: Makefile: exclude broken tests by default
  * MINOR: converter: adding support for url_enc
  * BUG/MINOR: srv: do not cleanup idle conns if pool max is null
  * BUG/MINOR: srv: do not init address if backend is disabled
  * SCRIPTS: make announce release support preparing announces before tag exists
  * SCRIPTS: improve announce-release to support different tag and versions
  * BUG/MINOR: stats: Make stat_l variable used to dump a stat line thread local
  * DOC: Improve the message printed when running `make` w/o `TARGET`
  * BUG/MINOR: tcpcheck: Report a L7OK if the last evaluated rule is a send rule
  * BUG/MINOR: cfgparse: Fail if the strdup() for `rule-&gt;be.name` for `use_backend` fails
  * BUG/MINOR: sink: Return an allocation failure in __sink_new if strdup() fails
  * MINOR: atomic: don't use ; to separate instruction on aarch64.
  * BUILD: hpack: hpack-tbl-t.h uses VAR_ARRAY but does not include compiler.h
  * BUG/MEDIUM: mux_h2: Add missing braces in h2_snd_buf()around trace+wakeup
  * DOC: fix "smp_size" vs "sample_size" in "log" directive arguments
  * BUG/MINOR: dns: SRV records ignores duplicated AR records
  * BUILD: ssl: fine guard for SSL_CTX_get0_privatekey call
  * BUILD: plock: remove dead code that causes a warning in gcc 11
  * CONTRIB: debug: address "poll" utility build on non-linux platforms
  * CONTRIB: halog: fix signed/unsigned build warnings on counts and timestamps
  * CONTRIB: halog: mark the has_zero* functions unused
  * CONTRIB: halog: fix build issue caused by %L printf format
  * BUG/MEDIUM: mux-h1: Handle h1_process() failures on a pipelined request
  * BUG/MEDIUM: http-ana: Never for sending data in TUNNEL mode
  * BUG/MINOR: mux-h1: Don't set CS_FL_EOI too early for protocol upgrade requests
  * BUILD: Makefile: have "make clean" destroy .o/.a/.s in contrib subdirs as well
  * BUILD: SSL: fine guard for SSL_CTX_add_server_custom_ext call
  * REGTESTS: make use of HAPROXY_ARGS and pass -dM by default
  * BUG/MEDIUM: ssl/crt-list: bad behavior with "commit ssl cert"
  * BUG/MEDIUM: lb-leastconn: Reposition a server using the right eweight
  * BUG/MINOR: tools: Reject size format not starting by a digit
  * BUG/MINOR: tools: make parse_time_err() more strict on the timer validity
  * MINOR: tcpcheck: Only wait for more payload data on HTTP expect rules
  * BUG/MINOR: tcpcheck: Don't rearm the check timeout on each read
  * BUG/MINOR: http-check: Use right condition to consider HTX message as full
  * DOC: email change of the DeviceAtlas maintainer
  * BUG/MEDIUM: spoa/python: Fixing references to None
  * BUG/MEDIUM: spoa/python: Fixing PyObject_Call positional arguments
  * BUG/MINOR: spoa/python: Cleanup ipaddress objects if initialization fails
  * BUG/MINOR: spoa/python: Cleanup references for failed Module Addobject operations
  * DOC: spoa/python: Fixing typos in comments
  * DOC: spoa/python: Rephrasing memory related error messages
  * DOC: spoa/python: Fixing typo in IP related error messages
  * BUG/MAJOR: spoa/python: Fixing return None
  * MEDIUM: ssl: fatal error with bundle + openssl &lt; 1.1.1
  * MINOR: listener: now use a generic add_listener() function
  * MINOR: listener: automatically set the port when creating listeners
  * MINOR: protocol: add a -&gt;set_port() helper to address families
  * BUG/MINOR: mux-h1: Handle keep-alive timeout for idle frontend connections
  * BUG/MINOR: listener: use sockaddr_in6 for IPv6
  * DOC/MINOR: Fix formatting in Management Guide
  * BUILD/MINOR: haproxy DragonFlyBSD affinity build update.
  * BUG/MAJOR: ring: tcp forward on ring can break the reader counter.
  * BUG/MINOR: lua: warn when registering action, conv, sf, cli or applet multiple times
  * MINOR: cli: add a function to look up a CLI service description
  * MINOR: actions: add a function returning a service pointer from its name
  * MINOR: actions: Export actions lookup functions
  * BUG/MINOR: lua: Some lua init operation are processed unsafe
  * BUG/MINOR: lua: Post init register function are not executed beyond the first one
  * BUG/MINOR: lua: lua-load doesn't check its parameters
  * BUG/MINOR: lua: missing "\n" in error message
  * BUG/MINOR: mux-h2/stats: not all GOAWAY frames are errors
  * BUG/MINOR: mux-h2/stats: make stream/connection proto errors more accurate
  * BUG/MEDIUM: local log format regression.
  * BUG/MEDIUM: task: close a possible data race condition on a tasklet's list link
  * MINOR: task: remove __tasklet_remove_from_tasklet_list()
  * BUG/MEDIUM: lists: Lock the element while we check if it is in a list.
  * MINOR: plock: use an ARMv8 instruction barrier for the pause instruction</changelog>
  <changelog author="mrueckert@suse.de" date="1610539200">- Update to version 2.3.4+git0.10189c965:
  * [RELEASE] Released version 2.3.4
  * MINOR: contrib/prometheus-exporter: use fill_info for process dump
  * MINOR: contrib/prometheus-exporter: avoid connection close header
  * BUG/MINOR: init: enforce strict-limits when using master-worker
  * BUG/MINOR: check: Don't perform any check on servers defined in a frontend
  * BUG/MINOR: sample: Memory leak of sample_expr structure in case of error
  * Revert "BUG/MINOR: dns: SRV records ignores duplicated AR records"
  * MINOR: reg-tests: add base prometheus test
  * BUG/MINOR: reg-tests: fix service dependency script
  * BUG/MINOR: sample: check alloc_trash_chunk return value in concat()
  * MINOR: reg-tests: add a way to add service dependency</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Add lua54.patch to fix building with lua 5.4</changelog>
  <changelog author="mrueckert@suse.de" date="1612612800">- Update to version 2.3.5+git0.5902ad99b:
  * [RELEASE] Released version 2.3.5
  * MINOR: config: Deprecate and ignore tune.chksize global option
  * BUG/MINOR: sock: Unclosed fd in case of connection allocation failure
  * BUG/MEDIUM: mux-h2: do not quit the demux loop before setting END_REACHED
  * BUG/MEDIUM: mux-h2: handle remaining read0 cases
  * BUILD: Makefile: move REGTESTST_TYPE default setting
  * MINOR: cli/show_fd: report local and report ports when known
  * BUILD: ssl: fix build breakage with last commit
  * BUG/MINOR: ssl: do not try to use early data if not configured
  * BUG/MINOR: xxhash: make sure armv6 uses memcpy()
  * BUG/MINOR: mux_h2: fix incorrect stat titles
  * BUG/MEDIUM: ssl: check a connection's status before computing a handshake
  * BUG/MEDIUM: ssl/cli: abort ssl cert is freeing the old store
  * BUG/MINOR: stick-table: Always call smp_fetch_src() with a valid arg list
  * DOC: management: fix "show resolvers" alphabetical ordering
  * MINOR: h1: Raise the chunk size limit up to (2^52 - 1)
  * MINOR: mux-h1/show_fd: report as suspicious an entry with too many calls
  * MINOR: mux-h2/show_fd: report as suspicious an entry with too many calls
  * MINOR: ssl/show_fd: report some FDs as suspicious when possible
  * MINOR: cli/show_fd: report some easily detectable suspicious states
  * MINOR: cli: give the show_fd helpers the ability to report a suspicious entry
  * MINOR: mux-fcgi: make the "show fd" helper also decode the fstrm subscriber when known
  * MINOR: mux-h1: make the "show fd" helper also decode the h1s subscriber when known
  * MINOR: mux-h2: make the "show fd" helper also decode the h2s subscriber when known
  * MINOR: xprt/mux: export all *_io_cb functions so that "show fd" resolves them
  * MINOR: ssl: provide a "show fd" helper to report important SSL information
  * MINOR: xprt: add a new show_fd() helper to complete some "show fd" dumps.
  * MINOR: cli: make "show fd" also report the xprt and xprt_ctx
  * CLEANUP: cli: make "show fd" use a const connection to access other fields
  * CLEANUP: tools: make resolve_sym_name() take a const pointer
  * MINOR: contrib: Make the wireshark peers dissector compile for more distribs.
  * BUG/MINOR: backend: check available list allocation for reuse
  * BUG/MEDIUM: backend: never reuse a connection for tcp mode
  * REORG: backend: simplify conn_backend_get
  * BUG/MEDIUM: session: only retrieve ready idle conn from session
  * BUG/MINOR: ssl: init tmp chunk correctly in ssl_sock_load_sctl_from_file()
  * BUG/MINOR: config: fix leak on proxy.conn_src.bind_hdr_name
  * BUG/MEDIUM: filters/htx: Fix data forwarding when payload length is unknown
  * DOC: Improve documentation of the various hdr() fetches
  * BUILD/MINOR: lua: define _GNU_SOURCE for LLONG_MAX
  * BUG/MEDIUM: mux-h2: fix read0 handling on partial frames
  * BUG/MEDIUM: tcpcheck: Don't destroy connection in the wake callback context
  * BUG/MINOR: mworker: define _GNU_SOURCE for strsignal()
  * BUG/MINOR: mux_h2: missing space between "st" and ".flg" in the "show fd" helper
  * BUG/MINOR: peers: Wrong "new_conn" value for "show peers" CLI command.
  * MINOR: build: discard echoing in help target
  * BUG/MINOR: peers: Possible appctx pointer dereference.
  * BUG/MEDIUM: stats: add missing INF_BUILD_INFO definition
  * BUILD: peers: fix build warning about unused variable
  * BUG/MINOR: dns: SRV records ignores duplicated AR records (v2)
  * MINOR: peers: Add traces for peer control messages.
  * BUG/MINOR: threads: Fixes the number of possible cpus report for Mac.
  * MINOR: server: Forbid server definitions in frontend sections
  * MINOR: config: Add failifnotcap() to emit an alert on proxy capabilities
  * BUG/MINOR: init: Use a dynamic buffer to set HAPROXY_CFGFILES env variable</changelog>
  <changelog author="mrueckert@suse.de" date="1614772800">- Update to version 2.3.6+git0.7851701ed:
  * [RELEASE] Released version 2.3.6
  * BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout
  * BUG/MINOR: mux-h2: Fix typo in scheme adjustment
  * DOC: spoe: Add a note about fragmentation support in HAProxy
  * BUG/MEDIUM: spoe: Kill applets if there are pending connections and nbthread &gt; 1
  * BUG/MINOR: connection: Use the client's dst family for adressless servers
  * BUG/MINOR: tcp-act: Don't forget to set the original port for IPv4 set-dst rule
  * BUG/MINOR: http-ana: Only consider dst address to process originalto option
  * BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf()
  * BUG/MINOR: stats: fix compare of no-maint url suffix
  * CLEANUP: muxes: Remove useless if condition in show_fd function
  * BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup()
  * BUG/MEDIUM: resolvers: Reset address for unresolved servers
  * BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records
  * BUG/MINOR: resolvers: new callback to properly handle SRV record errors
  * BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record
  * BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned
  * BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl()
  * BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal
  * BUG/MEDIUM: cli/shutdown sessions: make it thread-safe
  * BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop
  * BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe
  * BUG/MINOR: sample: secure convs that accept base64 string and var name as args
  * MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes
  * BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert"
  * BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok
  * BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line
  * BUG/MINOR: server: Init params before parsing a new server-state line
  * BUG/MINOR: http-rules: Always replace the response status on a return action
  * BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer
  * BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ().
  * DOC: explain the relation between pool-low-conn and tune.idle-pool.shared
  * BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions
  * BUG/MINOR: sample: Always consider zero size string samples as unsafe
  * BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust()
  * BUG/MINOR: checks: properly handle wrapping time in __health_adjust()
  * BUG/MINOR: session: atomically increment the tracked sessions counter
  * BUG/MINOR: server: Remove RMAINT from admin state when loading server state
  * CLEANUP: channel: fix comment in ci_putblk.
  * DOC: tune: explain the origin of block size for ssl.cachesize
  * BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL
  * BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines
  * BUG/MINOR: stats: revert the change on ST_CONVDONE
  * BUG/MEDIUM: config: don't pick unset values from last defaults section
  * CLEANUP: deinit: release global and per-proxy server-state variables on deinit
  * BUG/MINOR: server: Fix server-state-file-name directive
  * BUG/MINOR: backend: hold correctly lock when killing idle conn
  * BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints()
  * BUG/MINOR: server: re-align state file fields number
  * BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state
  * BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors
  * BUG/MINOR: intops: fix mul32hi()'s off-by-one
  * BUILD: ssl: guard SSL_CTX_set_msg_callback with SSL_CTRL_SET_MSG_CALLBACK macro
  * BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro
  * BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro
  * MINOR: check: do not ignore a connection header for http-check send</changelog>
  <changelog author="mrueckert@suse.de" date="1615896000">- Update to version 2.3.7+git0.2d39ce334:
  * [RELEASE] Released version 2.3.7
  * BUG/MINOR: resolvers: Add missing case-insensitive comparisons of DNS hostnames
  * MINOR: resolvers: Don't try to match immediatly renewed ADD items
  * MINOR: resolvers: Use milliseconds for cached items in resolver responses
  * BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set
  * BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks
  * MINOR: resolvers: Directly call srvrq_update_srv_state() when possible
  * MINOR: resolvers: Add function to change the srv status based on SRV resolution
  * MINOR: resolvers: Purge answer items when a SRV resolution triggers an error
  * MINOR: resolvers: Use a function to remove answers attached to a resolution
  * BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete
  * BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item
  * MINOR: resolvers: new function find_srvrq_answer_record()
  * BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item
  * BUG/MEDIUM: resolvers: Don't set an address-less server as UP
  * BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution
  * BUG/MINOR: resolvers: Reset server address on DNS error only on status change
  * BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error
  * Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record"
  * CLEANUP: tcp-rules: add missing actions in the tcp-request error message
  * BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check
  * BUG/MINOR: session: Add some forgotten tests on session's listener
  * BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters
  * BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check
  * BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached
  * BUILD: atomic/arm64: force the register pairs to use in __ha_cas_dw()
  * BUG/MEDIUM: stick-tables: fix ref counter in table entry using multiple http tracksc.
  * OPTIM: task: automatically adjust the default runqueue-depth to the threads
  * MINOR: task: give the scheduler a bit more flexibility in the runqueue size
  * MEDIUM: task: remove the tasks_run_queue counter and have one per thread
  * MEDIUM: ssl: implement xprt_set_used and xprt_set_idle to relax context checks
  * MINOR: xprt: add new xprt_set_idle and xprt_set_used methods
  * MEDIUM: muxes: mark idle conns tasklets with TASK_F_USR1
  * MINOR: task: add an application specific flag to the state: TASK_F_USR1
  * BUG/MEDIUM: ssl: properly remove the TASK_HEAVY flag at end of handshake
  * MINOR: ssl: mark the SSL handshake tasklet as heavy
  * MINOR: task: limit the number of subsequent heavy tasks with flag TASK_HEAVY
  * MEDIUM: backend: use a trylock when trying to grab an idle connection
  * MINOR: pools: double the local pool cache size to 1 MB
  * MEDIUM: pools: add CONFIG_HAP_NO_GLOBAL_POOLS and CONFIG_HAP_GLOBAL_POOLS
  * MEDIUM: streams: do not use the streams lock anymore
  * MINOR: streams: use one list per stream instead of a global one
  * MINOR: cli/streams: make "show sess" dump all streams till the new epoch
  * MINOR: stream: add an "epoch" to figure which streams appeared when
  * MINOR: dynbuf: pass offer_buffers() the number of buffers instead of a threshold
  * MINOR: dynbuf: use regular lists instead of mt_lists for buffer_wait
  * MINOR: dynbuf: make the buffer wait queue per thread
  * OPTIM: lb-leastconn: do not unlink the server if it did not change
  * OPTIM: lb-leastconn: do not take the server lock on take_conn/drop_conn
  * OPTIM: lb-first: do not take the server lock on take_conn/drop_conn
  * MINOR: lb/api: let callers of take_conn/drop_conn tell if they have the lock
  * MINOR: server: move actconns to the per-thread structure
  * OPTIM: server: switch the actconn list to an mt-list
  * MINOR: listener: refine the default MAX_ACCEPT from 64 to 4
  * MINOR: tasks: refine the default run queue depth
  * BUG/MEDIUM: session: NULL dereference possible when accessing the listener
  * MINOR: atomic: implement a more efficient arm64 __ha_cas_dw() using pairs
  * MINOR: atomic: add armv8.1-a atomics variant for cas-dw
  * BUG/MINOR: mt-list: always perform a cpu_relax call on failure
  * REORG: atomic: reimplement pl_cpu_relax() from atomic-ops.h
  * BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode
  * BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring()
  * BUG/MINOR: backend: fix condition for reuse on mode HTTP</changelog>
  <changelog author="mrueckert@suse.de" date="1616673600">- Update to version 2.3.8+git0.e572195c7:
  * [RELEASE] Released version 2.3.8
  * BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters
  * MINOR: tools: make url2ipv4 return the exact number of bytes parsed
  * BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless
  * BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available.
  * CLEANUP: fd: remove unused fd_set_running_excl()
  * BUG/MEDIUM: fd: do not wait on FD removal in fd_delete()
  * MINOR: fd: remove the unneeded running bit from fd_insert()
  * MINOR: fd: make fd_clr_running() return the remaining running mask
  * BUG/MEDIUM: lua: Always init the lua stack before referencing the context
  * BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback
  * MINOR: lua: Slightly improve function dumping the lua traceback
  * BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro
  * BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list"
  * BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable
  * MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua
  * MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master CLI socket
  * BUG/MINOR: protocol: add missing support of dgram unix socket.
  * BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable
  * MINOR: time: also provide a global, monotonic global_now_ms timer
  * BUG/MEDIUM: mux-fcgi: Fix locking of idle_conns lock in the FCGI I/O callback
  * BUG/MINOR: freq_ctr/threads: make use of the last updated global time
  * MINOR: time: export the global_now variable</changelog>
  <changelog author="mrueckert@suse.de" date="1617105600">- Update to version 2.3.9+git1.afb63bc04:
  * BUILD: backend: fix build breakage in idle conn locking fix
  * [RELEASE] Released version 2.3.9
  * BUG/MEDIUM: time: make sure to always initialize the global tick
  * BUG/MINOR: stats: Apply proper styles in HTML status page.
  * BUG/MINOR: payload: Wait for more data if buffer is empty in payload/payload_lv
  * MEDIUM: backend: use a trylock to grab a connection on high FD counts as well
  * BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent</changelog>
  <changelog author="mrueckert@suse.de" date="1619179200">- Update to version 2.3.10+git0.4764f0e4e:
  * [RELEASE] Released version 2.3.10
  * BUG/MEDIUM: peers: re-work refcnt on table to protect against flush
  * BUG/MEDIUM: peers: re-work connection to new process during reload.
  * BUG/MINOR: peers: remove useless table check if initial resync is finished
  * BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data
  * BUG/MINOR: mworker: don't use oldpids[] anymore for reload
  * BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases
  * BUG/MEDIUM: config: fix cpu-map notation with both process and threads
  * BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames
  * BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers
  * BUG/MINOR: server: free srv.lb_nodes in free_server
  * BUG/MINOR: mux-h1: Release idle server H1 connection if data are received
  * BUG/MINOR: logs: Report the true number of retries if there was no connection
  * BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function
  * BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded
  * BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check
  * MINOR: connection: Make bc_http_major compatible with tcp-checks
  * BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections
  * MINOR: logs: Add support of checks as session origin to format lf strings
  * BUG/MINOR: checks: Set missing id to the dummy checks frontend
  * BUG/MEDIUM: threads: Ignore current thread to end its harmless period
  * DOC: ssl: Certificate hot update only works on fronted certificates
  * BUG/MEDIUM: sample: Fix adjusting size in field converter
  * MINOR: No longer rely on deprecated sample fetches for predefined ACLs
  * DOC: clarify that compression works for HTTP/2
  * BUG/MINOR: tools: fix parsing "us" unit for timers
  * CONTRIB: halog: fix issue with array of type char
  * REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken
  * DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options
  * REGTESTS: ssl: "set ssl cert" and multi-certificates bundle
  * BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free
  * BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields
  * BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one
  * BUG/MINOR: ssl: Fix update of default certificate
  * BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS
  * BUG/MINOR: tcp: fix silent-drop workaround for IPv6</changelog>
  <changelog author="mrueckert@suse.de" date="1620993600">- Update to version 2.4.0+git0.6cbbecf09:
  https://www.haproxy.com/blog/announcing-haproxy-2-4/
  for all the details see /usr/share/doc/packages/haproxy/CHANGELOG
- refreshed patches to apply cleanly again
  haproxy-1.6.0-makefile_lib.patch
  haproxy-1.6.0-sec-options.patch
  lua54.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1623931200">- Update to version 2.4.1+git0.1ce7d4925:
  * [RELEASE] Released version 2.4.1
  * BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces
  * BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace
  * MINOR: mux-h2: obey http-ignore-probes during the preface
  * BUG/MINOR: stats: make "show stat typed desc" work again
  * CLEANUP: mux-h2/traces: better align user messages
  * MINOR: mux-h2/trace: report a few connection-level info during h2_init()
  * MINOR: connection: add helper conn_append_debug_info()
  * BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers
  * BUG/MINOR: mux-h1: do not skip the error response on bad requests
  * MINOR: backend: only skip LB when there are actual connections
  * BUG/MAJOR: queue: set SF_ASSIGNED when setting strm-&gt;target on dequeue
  * CLEANUP: global: remove unused definition of stopping_task[]
  * BUG/MINOR: mworker: fix typo in chroot error message
  * BUG/MINOR: ssl: use atomic ops to update global shctx stats
  * BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE
  * BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node
  * BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree
  * BUG/MEDIUM: server: do not forget to generate the dynamic servers ids
  * BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees
  * BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server'
  * BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id
  * DOC: lua: Add a warning about buffers modification in HTTP
  * BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs
  * MEDIUM: resolvers: add a ref between servers and srv request or used SRV record
  * MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item
  * BUG/MINOR: resolvers: answser item list was randomly purged or errors
  * CLEANUP: l7-retries: do not test the buffer before calling b_alloc()
  * BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default
  * BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded
  * CLEANUP: pools: remove now unused seq and pool_free_list
  * BUG/MAJOR: pools: fix possible race with free() in the lockless variant
  * MEDIUM: pools: use a single pool_gc() function for locked and lockless
  * MINOR: pools: call malloc_trim() under thread isolation
  * MINOR: pools: do not maintain the lock during pool_flush()
  * BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location
  * BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush()
  * BUG/MEDIUM: compression: Add a flag to know the filter is still processing data
  * BUG/MEDIUM: compression: Properly get the next block to iterate on payload
  * BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next block
  * BUG/MEDIUM: opentracing: initialization before establishing daemon and/or chroot mode
  * Revert "BUG/MINOR: opentracing: initialization after establishing daemon mode"
  * BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future
  * BUILD: make tune.ssl.keylog available again
  * DOC: use the req.ssl_sni in examples
  * MINOR: errors: allow empty va_args for diag variadic macro
  * BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry
  * DOC/MINOR: move uuid in the configuration to the right alphabetical order
  * BUG/MINOR: vars: Be sure to have a session to get checks variables
  * CLEANUP: http-ana: Remove useless if statement about L7 retries
  * BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree
  * BUG/MINOR: http: Missing calloc return value check in make_arg_list
  * BUG/MINOR: http: Missing calloc return value check while parsing redirect rule
  * BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list
  * BUG/MINOR: compression: Missing calloc return value check in comp_append_type/algo
  * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request rule
  * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request/tcp-response
  * BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy
  * BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare
  * BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture
  * BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine
  * BUG/MINOR: peers: Missing calloc return value check in peers_register_table
  * BUG/MINOR: server: Missing calloc return value check in srv_parse_source
  * DOC: intro: Fix typo in starter guide
  * MINOR: cfgparse: Fail when encountering extra arguments in macro
  * MINOR: http-ana: Perform L7 retries because of status codes in response analyser
  * BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts
  * BUG/MINOR: http-ana: Send the right error if max retries is reached on L7 retry
  * Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers"
  * BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response
  * BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter
  * BUILD/MINOR: opentracing: fixed build when using clang
  * BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'
  * BUG/MEDIUM: ebtree: Invalid read when looking for dup entry</changelog>
  <changelog author="mrueckert@suse.de" date="1625659200">- Update to version 2.4.2+git0.553dee326:
  * [RELEASE] Released version 2.4.2
  * REGTESTS: add http scheme-based normalization test
  * MEDIUM: h2: apply scheme-based normalization on h2 requests
  * MEDIUM: h1-htx: apply scheme-based normalization on h1 requests
  * MEDIUM: http: implement scheme-based normalization
  * MINOR: http: implement http_get_scheme
  * Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules"
  * BUG/MINOR: cli: fix server name output in "show fd"
  * BUG/MEDIUM: sock: make sure to never miss early connection failures
  * DOC: stick-table: add missing documentation about gpt0 stored type
  * BUG/MINOR: peers: fix data_type bit computation more than 32 data_types
  * BUG/MINOR: stick-table: fix several printf sign errors dumping tables
  * DOC: config: use CREATE USER for mysql-check
  * BUG/MEDIUM: resolvers: Make 1st server of a template take part to SRV resolution
  * BUG/MINOR: mqtt: Support empty client ID in CONNECT message
  * BUG/MINOR: mqtt: Fix parser for string with more than 127 characters
  * BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules
  * BUILD: Makefile: fix linkage for Haiku.
  * BUG/MINOR: checks: return correct error code for srv_parse_agent_check
  * MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response()
  * BUG/MINOR: resolvers: Reset server IP when no ip is found in the response
  * BUG/MINOR: resolvers: Always attach server on matching record on resolution
  * CLEANUP: dns: Remove a forgotten debug message
  * DOC: config: Add missing actions in "tcp-request session" documentation
  * MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules
  * REGTESTS: fix maxconn update with agent-check
  * BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check
  * BUG/MINOR: cache: Correctly handle existing-but-empty 'accept-encoding' header
  * BUG/MINOR: server/cli: Fix locking in function processing "set server" command
  * BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task()
  * BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status
  * MINOR: resolvers: Remove server from named_servers tree when removing a SRV item
  * MINOR: resolvers: Clean server in a dedicated function when removing a SRV item
  * BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI
  * BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled
  * BUG/MINOR: server-state: load SRV resolution only if params match the config</changelog>
  <changelog author="mrueckert@suse.de" date="1629201600">- Update to version 2.4.3+git0.4dd5a5a6c:
    CVE-2021-39240 CVE-2021-39241 CVE-2021-39242
    (boo#1189366 boo#1189548 boo#1189549)
  * [RELEASE] Released version 2.4.3
  * REGTESTS: add a test to prevent h2 desync attacks
  * BUG/MEDIUM: h2: give :authority precedence over Host
  * BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header
  * BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it
  * BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax
  * MINOR: http: add a new function http_validate_scheme() to validate a scheme
  * DOC/MINOR: fix typo in management document
  * CLEANUP: assorted typo fixes in the code and comments
  * BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during config check
  * BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued
  * DOC: config: Fix 'http-response send-spoe-group' documentation
  * DOC: Improve the lua documentation
  * BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer
  * BUG/MINOR: buffer: fix buffer_dump() formatting
  * BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one is released
  * MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure
  * ADMIN: dyncookie: implement a simple dynamic cookie calculator
  * MINOR: server: unmark deprecated on enable health/agent cli
  * BUG/MINOR: server: update last_change on maint-&gt;ready transitions too
  * BUG/MINOR: server: remove srv from px list on CLI 'add server' error
  * BUILD: opentracing: fixed build when using pkg-config utility
  * DOC: internals: document the FD takeover process
  * BUG/MINOR: fd: protect fd state harder against a concurrent takeover
  * BUG/MINOR: pollers: always program an update for migrated FDs
  * BUG/MINOR: poll: fix abnormally high skip_fd counter
  * BUG/MINOR: select: fix excess number of dead/skip reported
  * BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before
  * BUG/MEDIUM: connection: close a rare race between idle conn close and takeover
  * BUG/MINOR: connection: Add missing error labels to conn_err_code_str
  * BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames
  * BUG/MINOR: mux-h1: Be sure to swap H1C to splice mode when rcv_pipe() is called
  * BUG/MINOR: mux-h2: Obey dontlognull option during the preface
  * BUG/MINOR: mux-h1: Obey dontlognull option for empty requests
  * BUG/MINOR: systemd: must check the configuration using -Ws
  * BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree
  * BUG/MINOR: check: fix the condition to validate a port-less server
  * BUG/MINOR: stats: Add missing agent stats on servers
  * BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request
  * BUILD/MINOR: memprof fix macOs build.
  * BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs
  * BUG/MEDIUM: mworker: do not register an exit handler if exit is expected
  * BUILD: lua: silence a build warning with TCC
  * BUILD: add detection of missing important CFLAGS
  * BUG/MINOR: ssl: Default-server configuration ignored by server
  * MINOR: mux_h2: define config to disable h2 websocket support
  * BUILD: http_htx: fix ci compilation error with isdigit for Windows</changelog>
  <changelog author="mrueckert@suse.de" date="1631016000">- Update to version 2.4.4+git0.acb1d0bea: CVE-2021-40346 (boo#1189877)
  * [RELEASE] Released version 2.4.4
  * Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive"
  * BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer
  * CLEANUP: htx: remove comments about "must be &lt; 256 MB"
  * BUG/MINOR: config: reject configs using HTTP with bufsize &gt;= 256 MB
  * DOC: configuration: remove wrong tcp-request examples in tcp-response
  * BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser
  * CLEANUP: Add missing include guard to signal.h
  * BUG/MINOR: tools: Fix loop condition in dump_text()
  * BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time
  * BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long
  * MINOR: time: add report_idle() to report process-wide idle time
  * BUG/MINOR: time: fix idle time computation for long sleeps
  * BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords
  * MINOR: compiler: implement an ONLY_ONCE() macro
  * BUG/MINOR: base64: base64urldec() ignores padding in output size check
  * BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec}
  * BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions
  * MINOR: hlua: take the global Lua lock inside a global function
  * REGTESTS: abortonclose: after retries, 503 is expected, not close
  * REGTESTS: http_upgrade: fix incorrect expectation on TCP-&gt;H1-&gt;H2
  * BUG/MEDIUM: h2: match absolute-path not path-absolute for :path</changelog>
  <changelog author="mrueckert@suse.de" date="1633089600">- Update to version 2.4.5+git0.e74a1b34b:
  * [RELEASE] Released version 2.4.5
  * MINOR: tasks: catch TICK_ETERNITY with BUG_ON() in __task_queue()
  * BUG/MINOR: tcp-rules: Stop content rules eval on read error and end-of-input
  * BUG/MINOR: tcpcheck: Don't use arg list for default proxies during parsing
  * MINOR: arg: Be able to forbid unresolved args when building an argument list
  * BUG/MAJOR: lua: use task_wakeup() to properly run a task once
  * BUG/MEDIUM: lua: fix wakeup condition from sleep()
  * MINOR: Makefile: add MEMORY_POOLS to the list of DEBUG_xxx options
  * DOC: peers: fix doc "enable" statement on "peers" sections
  * BUG/MINOR: mux-h1/mux-fcgi: Sanitize TE header to only send "trailers"
  * MINOR: stream-int: Notify mux when the buffer is not stuck when calling rcv_buf
  * BUG/MEDIUM: stream-int: Defrag HTX message in si_cs_recv() if necessary
  * MINOR: htx: Add a function to know if the free space wraps
  * MINOR: htx: Add an HTX flag to know when a message is fragmented
  * MINOR: stream-int: Set CO_RFL transient/persistent flags apart in si_cs_rcv()
  * BUG/MEDIUM: stream: Stop waiting for more data if SI is blocked on RXBLK_ROOM
  * BUG/MEDIUM: stream-int: Notify stream that the mux wants more room to xfer data
  * BUG/MEDIUM: mux-h1: Adjust conditions to ask more space in the channel buffer
  * BUG/MINOR: stats: use refcount to protect dynamic server on dump
  * MINOR: server: return the next srv instance on free_server
  * BUG/MINOR: server: do not use refcount in free_server in stopping mode
  * MINOR: global: define MODE_STOPPING
  * MINOR: server: implement a refcount for dynamic servers
  * BUG/MINOR: http-ana: increment internal_errors counter on response error
  * BUG/MINOR: h1-htx: Fix a typo when request parser is reset
  * BUG/MEDIUM: leastconn: fix rare possibility of divide by zero
  * BUG/MINOR: server: allow 'enable health' only if check configured
  * BUILD: threads: fix -Wundef for _POSIX_PRIORITY_SCHEDULING on libmusl
  * BUILD: halog: fix a -Wundef warning on non-glibc systems
  * BUILD: compiler: fixed a missing test on  defined(__GNUC__)
  * BUILD: fix dragonfly build again on __read_mostly
  * BUG/MINOR: vars: do not talk about global section in CLI errors for set-var
  * BUG/MINOR: vars: truncate the variable name in error reports about scope.
  * BUG/MINOR: vars: properly set the argument parsing context in the expression
  * MINOR: sample: add missing ARGC_ entries
  * BUG/MINOR: vars: improve accuracy of the rules used to check expression validity
  * BUILD: tools: properly guard __GLIBC__ with defined()
  * BUILD: ssl: fix two remaining occurrences of #if USE_OPENSSL
  * BUILD: ssl: next round of build warnings on LIBRESSL_VERSION_NUMBER
  * BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -Wundef
  * IMPORT: slz: silence a build warning with -Wundef
  * BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -Wundef
  * BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -Wundef
  * BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILING
  * MINOR: proc: setting the process to produce a core dump on FreeBSD.
  * MINOR: tools: add FreeBSD support to get_exec_path()
  * BUILD: tools: get the absolute path of the current binary on NetBSD.
  * BUG/MINOR: flt-trace: fix an infinite loop when random-parsing is set
  * BUG/MINOR: cli/payload: do not search for args inside payload
  * BUILD: ist: prevent gcc11 maybe-uninitialized warning on istalloc
  * BUG/MINOR: connection: prevent null deref on mux cleanup task allocation
  * DOC: management: certificate files must be sanitized before injection
  * BUG/MINOR: tcpcheck: Improve LDAP response parsing to fix LDAP check
  * BUG/MAJOR: mux-h1: Don't eval input data if an error was reported
  * MINOR: pools: use mallinfo2() when available instead of mallinfo()
  * MINOR: pools: automatically disable malloc_trim() with external allocators
  * CLEANUP: pools: factor all malloc_trim() calls into trim_all_pools()
  * BUG/MINOR: compat: make sure __WORDSIZE is always defined
  * BUG/MEDIUM: stream-int: Don't block SI on a channel policy if EOI is reached
  * CLEANUP: mux-h1: Remove condition rejecting upgrade requests with payload
  * MINOR: htx: Skip headers with no value when adding a header list to a message
  * BUG/MEDIUM: mux-h1: Remove "Upgrade:" header for requests with payload
  * BUG/MINOR: systemd: ExecStartPre must use -Ws
  * BUG/MINOR: filters: Set right FLT_END analyser depending on channel
  * BUG/MINOR: filters: Always set FLT_END analyser when CF_FLT_ANALYZE flag is set
  * BUG/MEDIUM: http-ana: Reset channels analysers when returning an error
  * BUG/MINOR: stream: Don't release a stream if FLT_END is still registered
  * BUG/MINOR: lua: Don't yield in channel.append() and channel.set()
  * BUG/MINOR: lua: Yield in channel functions only if lua context can yield
  * MINOR: lua: Add a flag on lua context to know the yield capability at run time</changelog>
  <changelog author="mrueckert@suse.de" date="1633348800">- Update to version 2.4.6+git0.d83fd76a1:
  * [RELEASE] Released version 2.4.6
  * BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release</changelog>
  <changelog author="mrueckert@suse.de" date="1633348801">- Update to version 2.4.7+git0.b5e51a5e2:
  * [RELEASE] Released version 2.4.7
  * BUG/MEDIUM: http-ana: Clear request analyzers when applying redirect rule</changelog>
  <changelog author="mrueckert@suse.de" date="1635940800">- Update to version 2.4.8+git0.d1f8d41e0:
  * [RELEASE] Released version 2.4.8
  * SCRIPTS: git-show-backports: re-enable file-based filtering
  * DOC/peers: some grammar fixes for peers 2.1 spec
  * MINOR: stream: Improve dump of bogus streams
  * BUILD/MINOR: cpuset freebsd build fix
  * DOC: config: Fix alphabetical order of fc_* samples
  * BUG/MINOR: sample: fix backend direction flags consecutive to last fix
  * BUG/MEDIUM: sample: Cumulate frontend and backend sample validity flags
  * BUG/MEDIUM: stream-int: Block reads if channel cannot receive more data
  * BUG/MINOR: http: Authorization value can have multiple spaces after the scheme
  * BUG/MEDIUM: http-ana: Drain request data waiting the tarpit timeout expiration
  * MINOR: halog: Add support for extracting captures using -hdr
  * BUG/MINOR: halog: Add missing newlines in die() messages
  * CLEANUP: halog: Use consistent indentation in help()
  * MINOR: halog: Rename -qry to -query
  * DOC: halog: Move the `-qry` parameter into the correct section in help text
  * MINOR: halog: Add -qry parameter allowing to preserve the query string in -uX
  * BUG/MEDIUM: resolvers: Track api calls with a counter to free resolutions
  * BUG/MEDIUM: resolvers: Don't recursively perform requester unlink
  * MEDIUM: resolvers: remove the last occurrences of the "safe" argument
  * MEDIUM: resolvers: use a kill list to preserve the list consistency
  * CLEANUP: resolvers: replace all LIST_DELETE with LIST_DEL_INIT
  * CLEANUP: resolvers: simplify resolv_link_resolution() regarding requesters
  * CLEANUP: always initialize the answer_list
  * CLEANUP: resolvers: do not export resolv_purge_resolution_answer_records()
  * BUG/MEDIUM: mux-h1: Perform a connection shutdown when the h1c is released
  * BUG/MINOR: mux-h1: Save shutdown mode if the shutdown is delayed
  * BUILD: atomic: fix build on mac/arm64
  * BUG/MINOR: backend: fix improper insert in avail tree for always reuse
  * BUILD: fix compilation on NetBSD
  * MINOR: memprof: add one pointer size to the size of allocations
  * MINOR: memprof: report the delta between alloc and free on realloc()
  * BUG/MEDIUM: lua: fix memory leaks with realloc() on non-glibc systems
  * BUG/MINOR: mux-h2: do not prevent from sending a final GOAWAY frame
  * BUG/MINOR: task: do not set TASK_F_USR1 for no reason
  * BUG/MAJOR: buf: fix varint API post- vs pre- increment
  * BUG/MEDIUM: resolvers: always check a valid item in query_list
  * BUILD: resolvers: avoid a possible warning on null-deref
  * BUG/MAJOR: resolvers: add other missing references during resolution removal
  * MINOR: resolvers: merge address and target into a union "data"
  * BUG/MEDIUM: resolvers: use correct storage for the target address
  * BUG/MEDIUM: resolvers: fix truncated TLD consecutive to the API fix
  * MINOR: resolvers: fix the resolv_dn_label_to_str() API about trailing zero
  * BUG/MINOR: resolvers: do not reject host names of length 255 in SRV records
  * BUG/MEDIUM: resolver: make sure to always use the correct hostname length
  * MINOR: resolvers: fix the resolv_str_to_dn_label() API about trailing zero
  * BUG/MAJOR: dns: attempt to lock globaly for msg waiter list instead of use barrier
  * BUG/MAJOR: dns: tcp session can remain attached to a list after a free
  * BUG/MEDIUM: tcpcheck: Properly catch early HTTP parsing errors
  * Revert "CLEANUP: server: always include the storage for SSL settings"
  * BUG/MEDIUM: stream: Keep FLT_END analyzers if a stream detects a channel error
  * BUG/MEDIUM: cpuset: fix cpuset size for FreeBSD
  * BUG/MINOR: sample: Fix 'fix_tag_value' sample when waiting for more data
  * BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back
  * MINOR: initcall: Rename __GLOBL and __GLOBL1.
  * DOC: configuration: add clarification on escaping in keyword arguments
  * BUG/MEDIUM: mux_h2: Handle others remaining read0 cases on partial frames
  * BUG/MEDIUM: sample: properly verify that variables cast to sample
  * MINOR: sample: provide a generic var-to-sample conversion function
  * CLEANUP: sample: uninline sample_conv_var2smp_str()
  * CLEANUP: sample: rename sample_conv_var2smp() to *_sint
  * CLEANUP: server: always include the storage for SSL settings</changelog>
  <changelog author="varkoly@suse.com" date="1646740800">- (bsc#1196408) VUL-0: CVE-2022-0711: haproxy: Denial of service via set-cookie2 header
  o Apply upstream patch:
    0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch</changelog>
  <changelog author="varkoly@suse.com" date="1674043200">- VUL-0: CVE-2023-0056: haproxy: segfault DoS (bsc#1207181)
  o Apply upstream patch:
    0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch</changelog>
</package>
<package pkgid="c65cdfdc1be690c2be4f0d538ced739b129f13b989fa408b8b2af0fafef82cc1" name="haproxy" arch="src">
  <version epoch="0" ver="2.4.8+git0.d1f8d41e0" rel="150400.3.6.1"/>
  <changelog author="mrueckert@suse.de" date="1610107200">- Update to version 2.3.3+git0.9233c2143:
  * [RELEASE] Released version 2.3.3
  * BUG/MINOR: sample: fix concat() converter's corruption with non-string variables
  * DOC: Add maintainers for the Prometheus exporter
  * SCRIPTS: announce-release: fix typo in help message
  * DOC: fix some spelling issues over multiple files
  * MINOR: contrib/prometheus-exporter: export build_info
  * CLEANUP: cfgparse: replace "realloc" with "my_realloc2" to fix to memory leak on error
  * BUILD: Makefile: exclude broken tests by default
  * MINOR: converter: adding support for url_enc
  * BUG/MINOR: srv: do not cleanup idle conns if pool max is null
  * BUG/MINOR: srv: do not init address if backend is disabled
  * SCRIPTS: make announce release support preparing announces before tag exists
  * SCRIPTS: improve announce-release to support different tag and versions
  * BUG/MINOR: stats: Make stat_l variable used to dump a stat line thread local
  * DOC: Improve the message printed when running `make` w/o `TARGET`
  * BUG/MINOR: tcpcheck: Report a L7OK if the last evaluated rule is a send rule
  * BUG/MINOR: cfgparse: Fail if the strdup() for `rule-&gt;be.name` for `use_backend` fails
  * BUG/MINOR: sink: Return an allocation failure in __sink_new if strdup() fails
  * MINOR: atomic: don't use ; to separate instruction on aarch64.
  * BUILD: hpack: hpack-tbl-t.h uses VAR_ARRAY but does not include compiler.h
  * BUG/MEDIUM: mux_h2: Add missing braces in h2_snd_buf()around trace+wakeup
  * DOC: fix "smp_size" vs "sample_size" in "log" directive arguments
  * BUG/MINOR: dns: SRV records ignores duplicated AR records
  * BUILD: ssl: fine guard for SSL_CTX_get0_privatekey call
  * BUILD: plock: remove dead code that causes a warning in gcc 11
  * CONTRIB: debug: address "poll" utility build on non-linux platforms
  * CONTRIB: halog: fix signed/unsigned build warnings on counts and timestamps
  * CONTRIB: halog: mark the has_zero* functions unused
  * CONTRIB: halog: fix build issue caused by %L printf format
  * BUG/MEDIUM: mux-h1: Handle h1_process() failures on a pipelined request
  * BUG/MEDIUM: http-ana: Never for sending data in TUNNEL mode
  * BUG/MINOR: mux-h1: Don't set CS_FL_EOI too early for protocol upgrade requests
  * BUILD: Makefile: have "make clean" destroy .o/.a/.s in contrib subdirs as well
  * BUILD: SSL: fine guard for SSL_CTX_add_server_custom_ext call
  * REGTESTS: make use of HAPROXY_ARGS and pass -dM by default
  * BUG/MEDIUM: ssl/crt-list: bad behavior with "commit ssl cert"
  * BUG/MEDIUM: lb-leastconn: Reposition a server using the right eweight
  * BUG/MINOR: tools: Reject size format not starting by a digit
  * BUG/MINOR: tools: make parse_time_err() more strict on the timer validity
  * MINOR: tcpcheck: Only wait for more payload data on HTTP expect rules
  * BUG/MINOR: tcpcheck: Don't rearm the check timeout on each read
  * BUG/MINOR: http-check: Use right condition to consider HTX message as full
  * DOC: email change of the DeviceAtlas maintainer
  * BUG/MEDIUM: spoa/python: Fixing references to None
  * BUG/MEDIUM: spoa/python: Fixing PyObject_Call positional arguments
  * BUG/MINOR: spoa/python: Cleanup ipaddress objects if initialization fails
  * BUG/MINOR: spoa/python: Cleanup references for failed Module Addobject operations
  * DOC: spoa/python: Fixing typos in comments
  * DOC: spoa/python: Rephrasing memory related error messages
  * DOC: spoa/python: Fixing typo in IP related error messages
  * BUG/MAJOR: spoa/python: Fixing return None
  * MEDIUM: ssl: fatal error with bundle + openssl &lt; 1.1.1
  * MINOR: listener: now use a generic add_listener() function
  * MINOR: listener: automatically set the port when creating listeners
  * MINOR: protocol: add a -&gt;set_port() helper to address families
  * BUG/MINOR: mux-h1: Handle keep-alive timeout for idle frontend connections
  * BUG/MINOR: listener: use sockaddr_in6 for IPv6
  * DOC/MINOR: Fix formatting in Management Guide
  * BUILD/MINOR: haproxy DragonFlyBSD affinity build update.
  * BUG/MAJOR: ring: tcp forward on ring can break the reader counter.
  * BUG/MINOR: lua: warn when registering action, conv, sf, cli or applet multiple times
  * MINOR: cli: add a function to look up a CLI service description
  * MINOR: actions: add a function returning a service pointer from its name
  * MINOR: actions: Export actions lookup functions
  * BUG/MINOR: lua: Some lua init operation are processed unsafe
  * BUG/MINOR: lua: Post init register function are not executed beyond the first one
  * BUG/MINOR: lua: lua-load doesn't check its parameters
  * BUG/MINOR: lua: missing "\n" in error message
  * BUG/MINOR: mux-h2/stats: not all GOAWAY frames are errors
  * BUG/MINOR: mux-h2/stats: make stream/connection proto errors more accurate
  * BUG/MEDIUM: local log format regression.
  * BUG/MEDIUM: task: close a possible data race condition on a tasklet's list link
  * MINOR: task: remove __tasklet_remove_from_tasklet_list()
  * BUG/MEDIUM: lists: Lock the element while we check if it is in a list.
  * MINOR: plock: use an ARMv8 instruction barrier for the pause instruction</changelog>
  <changelog author="mrueckert@suse.de" date="1610539200">- Update to version 2.3.4+git0.10189c965:
  * [RELEASE] Released version 2.3.4
  * MINOR: contrib/prometheus-exporter: use fill_info for process dump
  * MINOR: contrib/prometheus-exporter: avoid connection close header
  * BUG/MINOR: init: enforce strict-limits when using master-worker
  * BUG/MINOR: check: Don't perform any check on servers defined in a frontend
  * BUG/MINOR: sample: Memory leak of sample_expr structure in case of error
  * Revert "BUG/MINOR: dns: SRV records ignores duplicated AR records"
  * MINOR: reg-tests: add base prometheus test
  * BUG/MINOR: reg-tests: fix service dependency script
  * BUG/MINOR: sample: check alloc_trash_chunk return value in concat()
  * MINOR: reg-tests: add a way to add service dependency</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Add lua54.patch to fix building with lua 5.4</changelog>
  <changelog author="mrueckert@suse.de" date="1612612800">- Update to version 2.3.5+git0.5902ad99b:
  * [RELEASE] Released version 2.3.5
  * MINOR: config: Deprecate and ignore tune.chksize global option
  * BUG/MINOR: sock: Unclosed fd in case of connection allocation failure
  * BUG/MEDIUM: mux-h2: do not quit the demux loop before setting END_REACHED
  * BUG/MEDIUM: mux-h2: handle remaining read0 cases
  * BUILD: Makefile: move REGTESTST_TYPE default setting
  * MINOR: cli/show_fd: report local and report ports when known
  * BUILD: ssl: fix build breakage with last commit
  * BUG/MINOR: ssl: do not try to use early data if not configured
  * BUG/MINOR: xxhash: make sure armv6 uses memcpy()
  * BUG/MINOR: mux_h2: fix incorrect stat titles
  * BUG/MEDIUM: ssl: check a connection's status before computing a handshake
  * BUG/MEDIUM: ssl/cli: abort ssl cert is freeing the old store
  * BUG/MINOR: stick-table: Always call smp_fetch_src() with a valid arg list
  * DOC: management: fix "show resolvers" alphabetical ordering
  * MINOR: h1: Raise the chunk size limit up to (2^52 - 1)
  * MINOR: mux-h1/show_fd: report as suspicious an entry with too many calls
  * MINOR: mux-h2/show_fd: report as suspicious an entry with too many calls
  * MINOR: ssl/show_fd: report some FDs as suspicious when possible
  * MINOR: cli/show_fd: report some easily detectable suspicious states
  * MINOR: cli: give the show_fd helpers the ability to report a suspicious entry
  * MINOR: mux-fcgi: make the "show fd" helper also decode the fstrm subscriber when known
  * MINOR: mux-h1: make the "show fd" helper also decode the h1s subscriber when known
  * MINOR: mux-h2: make the "show fd" helper also decode the h2s subscriber when known
  * MINOR: xprt/mux: export all *_io_cb functions so that "show fd" resolves them
  * MINOR: ssl: provide a "show fd" helper to report important SSL information
  * MINOR: xprt: add a new show_fd() helper to complete some "show fd" dumps.
  * MINOR: cli: make "show fd" also report the xprt and xprt_ctx
  * CLEANUP: cli: make "show fd" use a const connection to access other fields
  * CLEANUP: tools: make resolve_sym_name() take a const pointer
  * MINOR: contrib: Make the wireshark peers dissector compile for more distribs.
  * BUG/MINOR: backend: check available list allocation for reuse
  * BUG/MEDIUM: backend: never reuse a connection for tcp mode
  * REORG: backend: simplify conn_backend_get
  * BUG/MEDIUM: session: only retrieve ready idle conn from session
  * BUG/MINOR: ssl: init tmp chunk correctly in ssl_sock_load_sctl_from_file()
  * BUG/MINOR: config: fix leak on proxy.conn_src.bind_hdr_name
  * BUG/MEDIUM: filters/htx: Fix data forwarding when payload length is unknown
  * DOC: Improve documentation of the various hdr() fetches
  * BUILD/MINOR: lua: define _GNU_SOURCE for LLONG_MAX
  * BUG/MEDIUM: mux-h2: fix read0 handling on partial frames
  * BUG/MEDIUM: tcpcheck: Don't destroy connection in the wake callback context
  * BUG/MINOR: mworker: define _GNU_SOURCE for strsignal()
  * BUG/MINOR: mux_h2: missing space between "st" and ".flg" in the "show fd" helper
  * BUG/MINOR: peers: Wrong "new_conn" value for "show peers" CLI command.
  * MINOR: build: discard echoing in help target
  * BUG/MINOR: peers: Possible appctx pointer dereference.
  * BUG/MEDIUM: stats: add missing INF_BUILD_INFO definition
  * BUILD: peers: fix build warning about unused variable
  * BUG/MINOR: dns: SRV records ignores duplicated AR records (v2)
  * MINOR: peers: Add traces for peer control messages.
  * BUG/MINOR: threads: Fixes the number of possible cpus report for Mac.
  * MINOR: server: Forbid server definitions in frontend sections
  * MINOR: config: Add failifnotcap() to emit an alert on proxy capabilities
  * BUG/MINOR: init: Use a dynamic buffer to set HAPROXY_CFGFILES env variable</changelog>
  <changelog author="mrueckert@suse.de" date="1614772800">- Update to version 2.3.6+git0.7851701ed:
  * [RELEASE] Released version 2.3.6
  * BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout
  * BUG/MINOR: mux-h2: Fix typo in scheme adjustment
  * DOC: spoe: Add a note about fragmentation support in HAProxy
  * BUG/MEDIUM: spoe: Kill applets if there are pending connections and nbthread &gt; 1
  * BUG/MINOR: connection: Use the client's dst family for adressless servers
  * BUG/MINOR: tcp-act: Don't forget to set the original port for IPv4 set-dst rule
  * BUG/MINOR: http-ana: Only consider dst address to process originalto option
  * BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf()
  * BUG/MINOR: stats: fix compare of no-maint url suffix
  * CLEANUP: muxes: Remove useless if condition in show_fd function
  * BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup()
  * BUG/MEDIUM: resolvers: Reset address for unresolved servers
  * BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records
  * BUG/MINOR: resolvers: new callback to properly handle SRV record errors
  * BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record
  * BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned
  * BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl()
  * BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal
  * BUG/MEDIUM: cli/shutdown sessions: make it thread-safe
  * BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop
  * BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe
  * BUG/MINOR: sample: secure convs that accept base64 string and var name as args
  * MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes
  * BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert"
  * BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok
  * BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line
  * BUG/MINOR: server: Init params before parsing a new server-state line
  * BUG/MINOR: http-rules: Always replace the response status on a return action
  * BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer
  * BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ().
  * DOC: explain the relation between pool-low-conn and tune.idle-pool.shared
  * BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions
  * BUG/MINOR: sample: Always consider zero size string samples as unsafe
  * BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust()
  * BUG/MINOR: checks: properly handle wrapping time in __health_adjust()
  * BUG/MINOR: session: atomically increment the tracked sessions counter
  * BUG/MINOR: server: Remove RMAINT from admin state when loading server state
  * CLEANUP: channel: fix comment in ci_putblk.
  * DOC: tune: explain the origin of block size for ssl.cachesize
  * BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL
  * BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines
  * BUG/MINOR: stats: revert the change on ST_CONVDONE
  * BUG/MEDIUM: config: don't pick unset values from last defaults section
  * CLEANUP: deinit: release global and per-proxy server-state variables on deinit
  * BUG/MINOR: server: Fix server-state-file-name directive
  * BUG/MINOR: backend: hold correctly lock when killing idle conn
  * BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints()
  * BUG/MINOR: server: re-align state file fields number
  * BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state
  * BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors
  * BUG/MINOR: intops: fix mul32hi()'s off-by-one
  * BUILD: ssl: guard SSL_CTX_set_msg_callback with SSL_CTRL_SET_MSG_CALLBACK macro
  * BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro
  * BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro
  * MINOR: check: do not ignore a connection header for http-check send</changelog>
  <changelog author="mrueckert@suse.de" date="1615896000">- Update to version 2.3.7+git0.2d39ce334:
  * [RELEASE] Released version 2.3.7
  * BUG/MINOR: resolvers: Add missing case-insensitive comparisons of DNS hostnames
  * MINOR: resolvers: Don't try to match immediatly renewed ADD items
  * MINOR: resolvers: Use milliseconds for cached items in resolver responses
  * BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set
  * BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks
  * MINOR: resolvers: Directly call srvrq_update_srv_state() when possible
  * MINOR: resolvers: Add function to change the srv status based on SRV resolution
  * MINOR: resolvers: Purge answer items when a SRV resolution triggers an error
  * MINOR: resolvers: Use a function to remove answers attached to a resolution
  * BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete
  * BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item
  * MINOR: resolvers: new function find_srvrq_answer_record()
  * BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item
  * BUG/MEDIUM: resolvers: Don't set an address-less server as UP
  * BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution
  * BUG/MINOR: resolvers: Reset server address on DNS error only on status change
  * BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error
  * Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record"
  * CLEANUP: tcp-rules: add missing actions in the tcp-request error message
  * BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check
  * BUG/MINOR: session: Add some forgotten tests on session's listener
  * BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters
  * BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check
  * BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached
  * BUILD: atomic/arm64: force the register pairs to use in __ha_cas_dw()
  * BUG/MEDIUM: stick-tables: fix ref counter in table entry using multiple http tracksc.
  * OPTIM: task: automatically adjust the default runqueue-depth to the threads
  * MINOR: task: give the scheduler a bit more flexibility in the runqueue size
  * MEDIUM: task: remove the tasks_run_queue counter and have one per thread
  * MEDIUM: ssl: implement xprt_set_used and xprt_set_idle to relax context checks
  * MINOR: xprt: add new xprt_set_idle and xprt_set_used methods
  * MEDIUM: muxes: mark idle conns tasklets with TASK_F_USR1
  * MINOR: task: add an application specific flag to the state: TASK_F_USR1
  * BUG/MEDIUM: ssl: properly remove the TASK_HEAVY flag at end of handshake
  * MINOR: ssl: mark the SSL handshake tasklet as heavy
  * MINOR: task: limit the number of subsequent heavy tasks with flag TASK_HEAVY
  * MEDIUM: backend: use a trylock when trying to grab an idle connection
  * MINOR: pools: double the local pool cache size to 1 MB
  * MEDIUM: pools: add CONFIG_HAP_NO_GLOBAL_POOLS and CONFIG_HAP_GLOBAL_POOLS
  * MEDIUM: streams: do not use the streams lock anymore
  * MINOR: streams: use one list per stream instead of a global one
  * MINOR: cli/streams: make "show sess" dump all streams till the new epoch
  * MINOR: stream: add an "epoch" to figure which streams appeared when
  * MINOR: dynbuf: pass offer_buffers() the number of buffers instead of a threshold
  * MINOR: dynbuf: use regular lists instead of mt_lists for buffer_wait
  * MINOR: dynbuf: make the buffer wait queue per thread
  * OPTIM: lb-leastconn: do not unlink the server if it did not change
  * OPTIM: lb-leastconn: do not take the server lock on take_conn/drop_conn
  * OPTIM: lb-first: do not take the server lock on take_conn/drop_conn
  * MINOR: lb/api: let callers of take_conn/drop_conn tell if they have the lock
  * MINOR: server: move actconns to the per-thread structure
  * OPTIM: server: switch the actconn list to an mt-list
  * MINOR: listener: refine the default MAX_ACCEPT from 64 to 4
  * MINOR: tasks: refine the default run queue depth
  * BUG/MEDIUM: session: NULL dereference possible when accessing the listener
  * MINOR: atomic: implement a more efficient arm64 __ha_cas_dw() using pairs
  * MINOR: atomic: add armv8.1-a atomics variant for cas-dw
  * BUG/MINOR: mt-list: always perform a cpu_relax call on failure
  * REORG: atomic: reimplement pl_cpu_relax() from atomic-ops.h
  * BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode
  * BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring()
  * BUG/MINOR: backend: fix condition for reuse on mode HTTP</changelog>
  <changelog author="mrueckert@suse.de" date="1616673600">- Update to version 2.3.8+git0.e572195c7:
  * [RELEASE] Released version 2.3.8
  * BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters
  * MINOR: tools: make url2ipv4 return the exact number of bytes parsed
  * BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless
  * BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available.
  * CLEANUP: fd: remove unused fd_set_running_excl()
  * BUG/MEDIUM: fd: do not wait on FD removal in fd_delete()
  * MINOR: fd: remove the unneeded running bit from fd_insert()
  * MINOR: fd: make fd_clr_running() return the remaining running mask
  * BUG/MEDIUM: lua: Always init the lua stack before referencing the context
  * BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback
  * MINOR: lua: Slightly improve function dumping the lua traceback
  * BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro
  * BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list"
  * BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable
  * MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua
  * MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master CLI socket
  * BUG/MINOR: protocol: add missing support of dgram unix socket.
  * BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable
  * MINOR: time: also provide a global, monotonic global_now_ms timer
  * BUG/MEDIUM: mux-fcgi: Fix locking of idle_conns lock in the FCGI I/O callback
  * BUG/MINOR: freq_ctr/threads: make use of the last updated global time
  * MINOR: time: export the global_now variable</changelog>
  <changelog author="mrueckert@suse.de" date="1617105600">- Update to version 2.3.9+git1.afb63bc04:
  * BUILD: backend: fix build breakage in idle conn locking fix
  * [RELEASE] Released version 2.3.9
  * BUG/MEDIUM: time: make sure to always initialize the global tick
  * BUG/MINOR: stats: Apply proper styles in HTML status page.
  * BUG/MINOR: payload: Wait for more data if buffer is empty in payload/payload_lv
  * MEDIUM: backend: use a trylock to grab a connection on high FD counts as well
  * BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent</changelog>
  <changelog author="mrueckert@suse.de" date="1619179200">- Update to version 2.3.10+git0.4764f0e4e:
  * [RELEASE] Released version 2.3.10
  * BUG/MEDIUM: peers: re-work refcnt on table to protect against flush
  * BUG/MEDIUM: peers: re-work connection to new process during reload.
  * BUG/MINOR: peers: remove useless table check if initial resync is finished
  * BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data
  * BUG/MINOR: mworker: don't use oldpids[] anymore for reload
  * BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases
  * BUG/MEDIUM: config: fix cpu-map notation with both process and threads
  * BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames
  * BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers
  * BUG/MINOR: server: free srv.lb_nodes in free_server
  * BUG/MINOR: mux-h1: Release idle server H1 connection if data are received
  * BUG/MINOR: logs: Report the true number of retries if there was no connection
  * BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function
  * BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded
  * BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check
  * MINOR: connection: Make bc_http_major compatible with tcp-checks
  * BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections
  * MINOR: logs: Add support of checks as session origin to format lf strings
  * BUG/MINOR: checks: Set missing id to the dummy checks frontend
  * BUG/MEDIUM: threads: Ignore current thread to end its harmless period
  * DOC: ssl: Certificate hot update only works on fronted certificates
  * BUG/MEDIUM: sample: Fix adjusting size in field converter
  * MINOR: No longer rely on deprecated sample fetches for predefined ACLs
  * DOC: clarify that compression works for HTTP/2
  * BUG/MINOR: tools: fix parsing "us" unit for timers
  * CONTRIB: halog: fix issue with array of type char
  * REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken
  * DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options
  * REGTESTS: ssl: "set ssl cert" and multi-certificates bundle
  * BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free
  * BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields
  * BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one
  * BUG/MINOR: ssl: Fix update of default certificate
  * BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS
  * BUG/MINOR: tcp: fix silent-drop workaround for IPv6</changelog>
  <changelog author="mrueckert@suse.de" date="1620993600">- Update to version 2.4.0+git0.6cbbecf09:
  https://www.haproxy.com/blog/announcing-haproxy-2-4/
  for all the details see /usr/share/doc/packages/haproxy/CHANGELOG
- refreshed patches to apply cleanly again
  haproxy-1.6.0-makefile_lib.patch
  haproxy-1.6.0-sec-options.patch
  lua54.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1623931200">- Update to version 2.4.1+git0.1ce7d4925:
  * [RELEASE] Released version 2.4.1
  * BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces
  * BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace
  * MINOR: mux-h2: obey http-ignore-probes during the preface
  * BUG/MINOR: stats: make "show stat typed desc" work again
  * CLEANUP: mux-h2/traces: better align user messages
  * MINOR: mux-h2/trace: report a few connection-level info during h2_init()
  * MINOR: connection: add helper conn_append_debug_info()
  * BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers
  * BUG/MINOR: mux-h1: do not skip the error response on bad requests
  * MINOR: backend: only skip LB when there are actual connections
  * BUG/MAJOR: queue: set SF_ASSIGNED when setting strm-&gt;target on dequeue
  * CLEANUP: global: remove unused definition of stopping_task[]
  * BUG/MINOR: mworker: fix typo in chroot error message
  * BUG/MINOR: ssl: use atomic ops to update global shctx stats
  * BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE
  * BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node
  * BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree
  * BUG/MEDIUM: server: do not forget to generate the dynamic servers ids
  * BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees
  * BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server'
  * BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id
  * DOC: lua: Add a warning about buffers modification in HTTP
  * BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs
  * MEDIUM: resolvers: add a ref between servers and srv request or used SRV record
  * MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item
  * BUG/MINOR: resolvers: answser item list was randomly purged or errors
  * CLEANUP: l7-retries: do not test the buffer before calling b_alloc()
  * BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default
  * BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded
  * CLEANUP: pools: remove now unused seq and pool_free_list
  * BUG/MAJOR: pools: fix possible race with free() in the lockless variant
  * MEDIUM: pools: use a single pool_gc() function for locked and lockless
  * MINOR: pools: call malloc_trim() under thread isolation
  * MINOR: pools: do not maintain the lock during pool_flush()
  * BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location
  * BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush()
  * BUG/MEDIUM: compression: Add a flag to know the filter is still processing data
  * BUG/MEDIUM: compression: Properly get the next block to iterate on payload
  * BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next block
  * BUG/MEDIUM: opentracing: initialization before establishing daemon and/or chroot mode
  * Revert "BUG/MINOR: opentracing: initialization after establishing daemon mode"
  * BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future
  * BUILD: make tune.ssl.keylog available again
  * DOC: use the req.ssl_sni in examples
  * MINOR: errors: allow empty va_args for diag variadic macro
  * BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry
  * DOC/MINOR: move uuid in the configuration to the right alphabetical order
  * BUG/MINOR: vars: Be sure to have a session to get checks variables
  * CLEANUP: http-ana: Remove useless if statement about L7 retries
  * BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree
  * BUG/MINOR: http: Missing calloc return value check in make_arg_list
  * BUG/MINOR: http: Missing calloc return value check while parsing redirect rule
  * BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list
  * BUG/MINOR: compression: Missing calloc return value check in comp_append_type/algo
  * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request rule
  * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request/tcp-response
  * BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy
  * BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare
  * BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture
  * BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine
  * BUG/MINOR: peers: Missing calloc return value check in peers_register_table
  * BUG/MINOR: server: Missing calloc return value check in srv_parse_source
  * DOC: intro: Fix typo in starter guide
  * MINOR: cfgparse: Fail when encountering extra arguments in macro
  * MINOR: http-ana: Perform L7 retries because of status codes in response analyser
  * BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts
  * BUG/MINOR: http-ana: Send the right error if max retries is reached on L7 retry
  * Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers"
  * BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response
  * BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter
  * BUILD/MINOR: opentracing: fixed build when using clang
  * BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'
  * BUG/MEDIUM: ebtree: Invalid read when looking for dup entry</changelog>
  <changelog author="mrueckert@suse.de" date="1625659200">- Update to version 2.4.2+git0.553dee326:
  * [RELEASE] Released version 2.4.2
  * REGTESTS: add http scheme-based normalization test
  * MEDIUM: h2: apply scheme-based normalization on h2 requests
  * MEDIUM: h1-htx: apply scheme-based normalization on h1 requests
  * MEDIUM: http: implement scheme-based normalization
  * MINOR: http: implement http_get_scheme
  * Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules"
  * BUG/MINOR: cli: fix server name output in "show fd"
  * BUG/MEDIUM: sock: make sure to never miss early connection failures
  * DOC: stick-table: add missing documentation about gpt0 stored type
  * BUG/MINOR: peers: fix data_type bit computation more than 32 data_types
  * BUG/MINOR: stick-table: fix several printf sign errors dumping tables
  * DOC: config: use CREATE USER for mysql-check
  * BUG/MEDIUM: resolvers: Make 1st server of a template take part to SRV resolution
  * BUG/MINOR: mqtt: Support empty client ID in CONNECT message
  * BUG/MINOR: mqtt: Fix parser for string with more than 127 characters
  * BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules
  * BUILD: Makefile: fix linkage for Haiku.
  * BUG/MINOR: checks: return correct error code for srv_parse_agent_check
  * MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response()
  * BUG/MINOR: resolvers: Reset server IP when no ip is found in the response
  * BUG/MINOR: resolvers: Always attach server on matching record on resolution
  * CLEANUP: dns: Remove a forgotten debug message
  * DOC: config: Add missing actions in "tcp-request session" documentation
  * MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules
  * REGTESTS: fix maxconn update with agent-check
  * BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check
  * BUG/MINOR: cache: Correctly handle existing-but-empty 'accept-encoding' header
  * BUG/MINOR: server/cli: Fix locking in function processing "set server" command
  * BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task()
  * BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status
  * MINOR: resolvers: Remove server from named_servers tree when removing a SRV item
  * MINOR: resolvers: Clean server in a dedicated function when removing a SRV item
  * BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI
  * BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled
  * BUG/MINOR: server-state: load SRV resolution only if params match the config</changelog>
  <changelog author="mrueckert@suse.de" date="1629201600">- Update to version 2.4.3+git0.4dd5a5a6c:
    CVE-2021-39240 CVE-2021-39241 CVE-2021-39242
    (boo#1189366 boo#1189548 boo#1189549)
  * [RELEASE] Released version 2.4.3
  * REGTESTS: add a test to prevent h2 desync attacks
  * BUG/MEDIUM: h2: give :authority precedence over Host
  * BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header
  * BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it
  * BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax
  * MINOR: http: add a new function http_validate_scheme() to validate a scheme
  * DOC/MINOR: fix typo in management document
  * CLEANUP: assorted typo fixes in the code and comments
  * BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during config check
  * BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued
  * DOC: config: Fix 'http-response send-spoe-group' documentation
  * DOC: Improve the lua documentation
  * BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer
  * BUG/MINOR: buffer: fix buffer_dump() formatting
  * BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one is released
  * MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure
  * ADMIN: dyncookie: implement a simple dynamic cookie calculator
  * MINOR: server: unmark deprecated on enable health/agent cli
  * BUG/MINOR: server: update last_change on maint-&gt;ready transitions too
  * BUG/MINOR: server: remove srv from px list on CLI 'add server' error
  * BUILD: opentracing: fixed build when using pkg-config utility
  * DOC: internals: document the FD takeover process
  * BUG/MINOR: fd: protect fd state harder against a concurrent takeover
  * BUG/MINOR: pollers: always program an update for migrated FDs
  * BUG/MINOR: poll: fix abnormally high skip_fd counter
  * BUG/MINOR: select: fix excess number of dead/skip reported
  * BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before
  * BUG/MEDIUM: connection: close a rare race between idle conn close and takeover
  * BUG/MINOR: connection: Add missing error labels to conn_err_code_str
  * BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames
  * BUG/MINOR: mux-h1: Be sure to swap H1C to splice mode when rcv_pipe() is called
  * BUG/MINOR: mux-h2: Obey dontlognull option during the preface
  * BUG/MINOR: mux-h1: Obey dontlognull option for empty requests
  * BUG/MINOR: systemd: must check the configuration using -Ws
  * BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree
  * BUG/MINOR: check: fix the condition to validate a port-less server
  * BUG/MINOR: stats: Add missing agent stats on servers
  * BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request
  * BUILD/MINOR: memprof fix macOs build.
  * BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs
  * BUG/MEDIUM: mworker: do not register an exit handler if exit is expected
  * BUILD: lua: silence a build warning with TCC
  * BUILD: add detection of missing important CFLAGS
  * BUG/MINOR: ssl: Default-server configuration ignored by server
  * MINOR: mux_h2: define config to disable h2 websocket support
  * BUILD: http_htx: fix ci compilation error with isdigit for Windows</changelog>
  <changelog author="mrueckert@suse.de" date="1631016000">- Update to version 2.4.4+git0.acb1d0bea: CVE-2021-40346 (boo#1189877)
  * [RELEASE] Released version 2.4.4
  * Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive"
  * BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer
  * CLEANUP: htx: remove comments about "must be &lt; 256 MB"
  * BUG/MINOR: config: reject configs using HTTP with bufsize &gt;= 256 MB
  * DOC: configuration: remove wrong tcp-request examples in tcp-response
  * BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser
  * CLEANUP: Add missing include guard to signal.h
  * BUG/MINOR: tools: Fix loop condition in dump_text()
  * BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time
  * BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long
  * MINOR: time: add report_idle() to report process-wide idle time
  * BUG/MINOR: time: fix idle time computation for long sleeps
  * BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords
  * MINOR: compiler: implement an ONLY_ONCE() macro
  * BUG/MINOR: base64: base64urldec() ignores padding in output size check
  * BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec}
  * BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions
  * MINOR: hlua: take the global Lua lock inside a global function
  * REGTESTS: abortonclose: after retries, 503 is expected, not close
  * REGTESTS: http_upgrade: fix incorrect expectation on TCP-&gt;H1-&gt;H2
  * BUG/MEDIUM: h2: match absolute-path not path-absolute for :path</changelog>
  <changelog author="mrueckert@suse.de" date="1633089600">- Update to version 2.4.5+git0.e74a1b34b:
  * [RELEASE] Released version 2.4.5
  * MINOR: tasks: catch TICK_ETERNITY with BUG_ON() in __task_queue()
  * BUG/MINOR: tcp-rules: Stop content rules eval on read error and end-of-input
  * BUG/MINOR: tcpcheck: Don't use arg list for default proxies during parsing
  * MINOR: arg: Be able to forbid unresolved args when building an argument list
  * BUG/MAJOR: lua: use task_wakeup() to properly run a task once
  * BUG/MEDIUM: lua: fix wakeup condition from sleep()
  * MINOR: Makefile: add MEMORY_POOLS to the list of DEBUG_xxx options
  * DOC: peers: fix doc "enable" statement on "peers" sections
  * BUG/MINOR: mux-h1/mux-fcgi: Sanitize TE header to only send "trailers"
  * MINOR: stream-int: Notify mux when the buffer is not stuck when calling rcv_buf
  * BUG/MEDIUM: stream-int: Defrag HTX message in si_cs_recv() if necessary
  * MINOR: htx: Add a function to know if the free space wraps
  * MINOR: htx: Add an HTX flag to know when a message is fragmented
  * MINOR: stream-int: Set CO_RFL transient/persistent flags apart in si_cs_rcv()
  * BUG/MEDIUM: stream: Stop waiting for more data if SI is blocked on RXBLK_ROOM
  * BUG/MEDIUM: stream-int: Notify stream that the mux wants more room to xfer data
  * BUG/MEDIUM: mux-h1: Adjust conditions to ask more space in the channel buffer
  * BUG/MINOR: stats: use refcount to protect dynamic server on dump
  * MINOR: server: return the next srv instance on free_server
  * BUG/MINOR: server: do not use refcount in free_server in stopping mode
  * MINOR: global: define MODE_STOPPING
  * MINOR: server: implement a refcount for dynamic servers
  * BUG/MINOR: http-ana: increment internal_errors counter on response error
  * BUG/MINOR: h1-htx: Fix a typo when request parser is reset
  * BUG/MEDIUM: leastconn: fix rare possibility of divide by zero
  * BUG/MINOR: server: allow 'enable health' only if check configured
  * BUILD: threads: fix -Wundef for _POSIX_PRIORITY_SCHEDULING on libmusl
  * BUILD: halog: fix a -Wundef warning on non-glibc systems
  * BUILD: compiler: fixed a missing test on  defined(__GNUC__)
  * BUILD: fix dragonfly build again on __read_mostly
  * BUG/MINOR: vars: do not talk about global section in CLI errors for set-var
  * BUG/MINOR: vars: truncate the variable name in error reports about scope.
  * BUG/MINOR: vars: properly set the argument parsing context in the expression
  * MINOR: sample: add missing ARGC_ entries
  * BUG/MINOR: vars: improve accuracy of the rules used to check expression validity
  * BUILD: tools: properly guard __GLIBC__ with defined()
  * BUILD: ssl: fix two remaining occurrences of #if USE_OPENSSL
  * BUILD: ssl: next round of build warnings on LIBRESSL_VERSION_NUMBER
  * BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -Wundef
  * IMPORT: slz: silence a build warning with -Wundef
  * BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -Wundef
  * BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -Wundef
  * BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILING
  * MINOR: proc: setting the process to produce a core dump on FreeBSD.
  * MINOR: tools: add FreeBSD support to get_exec_path()
  * BUILD: tools: get the absolute path of the current binary on NetBSD.
  * BUG/MINOR: flt-trace: fix an infinite loop when random-parsing is set
  * BUG/MINOR: cli/payload: do not search for args inside payload
  * BUILD: ist: prevent gcc11 maybe-uninitialized warning on istalloc
  * BUG/MINOR: connection: prevent null deref on mux cleanup task allocation
  * DOC: management: certificate files must be sanitized before injection
  * BUG/MINOR: tcpcheck: Improve LDAP response parsing to fix LDAP check
  * BUG/MAJOR: mux-h1: Don't eval input data if an error was reported
  * MINOR: pools: use mallinfo2() when available instead of mallinfo()
  * MINOR: pools: automatically disable malloc_trim() with external allocators
  * CLEANUP: pools: factor all malloc_trim() calls into trim_all_pools()
  * BUG/MINOR: compat: make sure __WORDSIZE is always defined
  * BUG/MEDIUM: stream-int: Don't block SI on a channel policy if EOI is reached
  * CLEANUP: mux-h1: Remove condition rejecting upgrade requests with payload
  * MINOR: htx: Skip headers with no value when adding a header list to a message
  * BUG/MEDIUM: mux-h1: Remove "Upgrade:" header for requests with payload
  * BUG/MINOR: systemd: ExecStartPre must use -Ws
  * BUG/MINOR: filters: Set right FLT_END analyser depending on channel
  * BUG/MINOR: filters: Always set FLT_END analyser when CF_FLT_ANALYZE flag is set
  * BUG/MEDIUM: http-ana: Reset channels analysers when returning an error
  * BUG/MINOR: stream: Don't release a stream if FLT_END is still registered
  * BUG/MINOR: lua: Don't yield in channel.append() and channel.set()
  * BUG/MINOR: lua: Yield in channel functions only if lua context can yield
  * MINOR: lua: Add a flag on lua context to know the yield capability at run time</changelog>
  <changelog author="mrueckert@suse.de" date="1633348800">- Update to version 2.4.6+git0.d83fd76a1:
  * [RELEASE] Released version 2.4.6
  * BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release</changelog>
  <changelog author="mrueckert@suse.de" date="1633348801">- Update to version 2.4.7+git0.b5e51a5e2:
  * [RELEASE] Released version 2.4.7
  * BUG/MEDIUM: http-ana: Clear request analyzers when applying redirect rule</changelog>
  <changelog author="mrueckert@suse.de" date="1635940800">- Update to version 2.4.8+git0.d1f8d41e0:
  * [RELEASE] Released version 2.4.8
  * SCRIPTS: git-show-backports: re-enable file-based filtering
  * DOC/peers: some grammar fixes for peers 2.1 spec
  * MINOR: stream: Improve dump of bogus streams
  * BUILD/MINOR: cpuset freebsd build fix
  * DOC: config: Fix alphabetical order of fc_* samples
  * BUG/MINOR: sample: fix backend direction flags consecutive to last fix
  * BUG/MEDIUM: sample: Cumulate frontend and backend sample validity flags
  * BUG/MEDIUM: stream-int: Block reads if channel cannot receive more data
  * BUG/MINOR: http: Authorization value can have multiple spaces after the scheme
  * BUG/MEDIUM: http-ana: Drain request data waiting the tarpit timeout expiration
  * MINOR: halog: Add support for extracting captures using -hdr
  * BUG/MINOR: halog: Add missing newlines in die() messages
  * CLEANUP: halog: Use consistent indentation in help()
  * MINOR: halog: Rename -qry to -query
  * DOC: halog: Move the `-qry` parameter into the correct section in help text
  * MINOR: halog: Add -qry parameter allowing to preserve the query string in -uX
  * BUG/MEDIUM: resolvers: Track api calls with a counter to free resolutions
  * BUG/MEDIUM: resolvers: Don't recursively perform requester unlink
  * MEDIUM: resolvers: remove the last occurrences of the "safe" argument
  * MEDIUM: resolvers: use a kill list to preserve the list consistency
  * CLEANUP: resolvers: replace all LIST_DELETE with LIST_DEL_INIT
  * CLEANUP: resolvers: simplify resolv_link_resolution() regarding requesters
  * CLEANUP: always initialize the answer_list
  * CLEANUP: resolvers: do not export resolv_purge_resolution_answer_records()
  * BUG/MEDIUM: mux-h1: Perform a connection shutdown when the h1c is released
  * BUG/MINOR: mux-h1: Save shutdown mode if the shutdown is delayed
  * BUILD: atomic: fix build on mac/arm64
  * BUG/MINOR: backend: fix improper insert in avail tree for always reuse
  * BUILD: fix compilation on NetBSD
  * MINOR: memprof: add one pointer size to the size of allocations
  * MINOR: memprof: report the delta between alloc and free on realloc()
  * BUG/MEDIUM: lua: fix memory leaks with realloc() on non-glibc systems
  * BUG/MINOR: mux-h2: do not prevent from sending a final GOAWAY frame
  * BUG/MINOR: task: do not set TASK_F_USR1 for no reason
  * BUG/MAJOR: buf: fix varint API post- vs pre- increment
  * BUG/MEDIUM: resolvers: always check a valid item in query_list
  * BUILD: resolvers: avoid a possible warning on null-deref
  * BUG/MAJOR: resolvers: add other missing references during resolution removal
  * MINOR: resolvers: merge address and target into a union "data"
  * BUG/MEDIUM: resolvers: use correct storage for the target address
  * BUG/MEDIUM: resolvers: fix truncated TLD consecutive to the API fix
  * MINOR: resolvers: fix the resolv_dn_label_to_str() API about trailing zero
  * BUG/MINOR: resolvers: do not reject host names of length 255 in SRV records
  * BUG/MEDIUM: resolver: make sure to always use the correct hostname length
  * MINOR: resolvers: fix the resolv_str_to_dn_label() API about trailing zero
  * BUG/MAJOR: dns: attempt to lock globaly for msg waiter list instead of use barrier
  * BUG/MAJOR: dns: tcp session can remain attached to a list after a free
  * BUG/MEDIUM: tcpcheck: Properly catch early HTTP parsing errors
  * Revert "CLEANUP: server: always include the storage for SSL settings"
  * BUG/MEDIUM: stream: Keep FLT_END analyzers if a stream detects a channel error
  * BUG/MEDIUM: cpuset: fix cpuset size for FreeBSD
  * BUG/MINOR: sample: Fix 'fix_tag_value' sample when waiting for more data
  * BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back
  * MINOR: initcall: Rename __GLOBL and __GLOBL1.
  * DOC: configuration: add clarification on escaping in keyword arguments
  * BUG/MEDIUM: mux_h2: Handle others remaining read0 cases on partial frames
  * BUG/MEDIUM: sample: properly verify that variables cast to sample
  * MINOR: sample: provide a generic var-to-sample conversion function
  * CLEANUP: sample: uninline sample_conv_var2smp_str()
  * CLEANUP: sample: rename sample_conv_var2smp() to *_sint
  * CLEANUP: server: always include the storage for SSL settings</changelog>
  <changelog author="varkoly@suse.com" date="1646740800">- (bsc#1196408) VUL-0: CVE-2022-0711: haproxy: Denial of service via set-cookie2 header
  o Apply upstream patch:
    0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch</changelog>
  <changelog author="varkoly@suse.com" date="1674043200">- VUL-0: CVE-2023-0056: haproxy: segfault DoS (bsc#1207181)
  o Apply upstream patch:
    0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch</changelog>
</package>
<package pkgid="44ca6034ea65afc9b6c048beb85a3c066b93da189b762bc57fb164507d7c9cc3" name="haproxy" arch="x86_64">
  <version epoch="0" ver="2.4.8+git0.d1f8d41e0" rel="150400.3.6.1"/>
  <changelog author="mrueckert@suse.de" date="1610107200">- Update to version 2.3.3+git0.9233c2143:
  * [RELEASE] Released version 2.3.3
  * BUG/MINOR: sample: fix concat() converter's corruption with non-string variables
  * DOC: Add maintainers for the Prometheus exporter
  * SCRIPTS: announce-release: fix typo in help message
  * DOC: fix some spelling issues over multiple files
  * MINOR: contrib/prometheus-exporter: export build_info
  * CLEANUP: cfgparse: replace "realloc" with "my_realloc2" to fix to memory leak on error
  * BUILD: Makefile: exclude broken tests by default
  * MINOR: converter: adding support for url_enc
  * BUG/MINOR: srv: do not cleanup idle conns if pool max is null
  * BUG/MINOR: srv: do not init address if backend is disabled
  * SCRIPTS: make announce release support preparing announces before tag exists
  * SCRIPTS: improve announce-release to support different tag and versions
  * BUG/MINOR: stats: Make stat_l variable used to dump a stat line thread local
  * DOC: Improve the message printed when running `make` w/o `TARGET`
  * BUG/MINOR: tcpcheck: Report a L7OK if the last evaluated rule is a send rule
  * BUG/MINOR: cfgparse: Fail if the strdup() for `rule-&gt;be.name` for `use_backend` fails
  * BUG/MINOR: sink: Return an allocation failure in __sink_new if strdup() fails
  * MINOR: atomic: don't use ; to separate instruction on aarch64.
  * BUILD: hpack: hpack-tbl-t.h uses VAR_ARRAY but does not include compiler.h
  * BUG/MEDIUM: mux_h2: Add missing braces in h2_snd_buf()around trace+wakeup
  * DOC: fix "smp_size" vs "sample_size" in "log" directive arguments
  * BUG/MINOR: dns: SRV records ignores duplicated AR records
  * BUILD: ssl: fine guard for SSL_CTX_get0_privatekey call
  * BUILD: plock: remove dead code that causes a warning in gcc 11
  * CONTRIB: debug: address "poll" utility build on non-linux platforms
  * CONTRIB: halog: fix signed/unsigned build warnings on counts and timestamps
  * CONTRIB: halog: mark the has_zero* functions unused
  * CONTRIB: halog: fix build issue caused by %L printf format
  * BUG/MEDIUM: mux-h1: Handle h1_process() failures on a pipelined request
  * BUG/MEDIUM: http-ana: Never for sending data in TUNNEL mode
  * BUG/MINOR: mux-h1: Don't set CS_FL_EOI too early for protocol upgrade requests
  * BUILD: Makefile: have "make clean" destroy .o/.a/.s in contrib subdirs as well
  * BUILD: SSL: fine guard for SSL_CTX_add_server_custom_ext call
  * REGTESTS: make use of HAPROXY_ARGS and pass -dM by default
  * BUG/MEDIUM: ssl/crt-list: bad behavior with "commit ssl cert"
  * BUG/MEDIUM: lb-leastconn: Reposition a server using the right eweight
  * BUG/MINOR: tools: Reject size format not starting by a digit
  * BUG/MINOR: tools: make parse_time_err() more strict on the timer validity
  * MINOR: tcpcheck: Only wait for more payload data on HTTP expect rules
  * BUG/MINOR: tcpcheck: Don't rearm the check timeout on each read
  * BUG/MINOR: http-check: Use right condition to consider HTX message as full
  * DOC: email change of the DeviceAtlas maintainer
  * BUG/MEDIUM: spoa/python: Fixing references to None
  * BUG/MEDIUM: spoa/python: Fixing PyObject_Call positional arguments
  * BUG/MINOR: spoa/python: Cleanup ipaddress objects if initialization fails
  * BUG/MINOR: spoa/python: Cleanup references for failed Module Addobject operations
  * DOC: spoa/python: Fixing typos in comments
  * DOC: spoa/python: Rephrasing memory related error messages
  * DOC: spoa/python: Fixing typo in IP related error messages
  * BUG/MAJOR: spoa/python: Fixing return None
  * MEDIUM: ssl: fatal error with bundle + openssl &lt; 1.1.1
  * MINOR: listener: now use a generic add_listener() function
  * MINOR: listener: automatically set the port when creating listeners
  * MINOR: protocol: add a -&gt;set_port() helper to address families
  * BUG/MINOR: mux-h1: Handle keep-alive timeout for idle frontend connections
  * BUG/MINOR: listener: use sockaddr_in6 for IPv6
  * DOC/MINOR: Fix formatting in Management Guide
  * BUILD/MINOR: haproxy DragonFlyBSD affinity build update.
  * BUG/MAJOR: ring: tcp forward on ring can break the reader counter.
  * BUG/MINOR: lua: warn when registering action, conv, sf, cli or applet multiple times
  * MINOR: cli: add a function to look up a CLI service description
  * MINOR: actions: add a function returning a service pointer from its name
  * MINOR: actions: Export actions lookup functions
  * BUG/MINOR: lua: Some lua init operation are processed unsafe
  * BUG/MINOR: lua: Post init register function are not executed beyond the first one
  * BUG/MINOR: lua: lua-load doesn't check its parameters
  * BUG/MINOR: lua: missing "\n" in error message
  * BUG/MINOR: mux-h2/stats: not all GOAWAY frames are errors
  * BUG/MINOR: mux-h2/stats: make stream/connection proto errors more accurate
  * BUG/MEDIUM: local log format regression.
  * BUG/MEDIUM: task: close a possible data race condition on a tasklet's list link
  * MINOR: task: remove __tasklet_remove_from_tasklet_list()
  * BUG/MEDIUM: lists: Lock the element while we check if it is in a list.
  * MINOR: plock: use an ARMv8 instruction barrier for the pause instruction</changelog>
  <changelog author="mrueckert@suse.de" date="1610539200">- Update to version 2.3.4+git0.10189c965:
  * [RELEASE] Released version 2.3.4
  * MINOR: contrib/prometheus-exporter: use fill_info for process dump
  * MINOR: contrib/prometheus-exporter: avoid connection close header
  * BUG/MINOR: init: enforce strict-limits when using master-worker
  * BUG/MINOR: check: Don't perform any check on servers defined in a frontend
  * BUG/MINOR: sample: Memory leak of sample_expr structure in case of error
  * Revert "BUG/MINOR: dns: SRV records ignores duplicated AR records"
  * MINOR: reg-tests: add base prometheus test
  * BUG/MINOR: reg-tests: fix service dependency script
  * BUG/MINOR: sample: check alloc_trash_chunk return value in concat()
  * MINOR: reg-tests: add a way to add service dependency</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Add lua54.patch to fix building with lua 5.4</changelog>
  <changelog author="mrueckert@suse.de" date="1612612800">- Update to version 2.3.5+git0.5902ad99b:
  * [RELEASE] Released version 2.3.5
  * MINOR: config: Deprecate and ignore tune.chksize global option
  * BUG/MINOR: sock: Unclosed fd in case of connection allocation failure
  * BUG/MEDIUM: mux-h2: do not quit the demux loop before setting END_REACHED
  * BUG/MEDIUM: mux-h2: handle remaining read0 cases
  * BUILD: Makefile: move REGTESTST_TYPE default setting
  * MINOR: cli/show_fd: report local and report ports when known
  * BUILD: ssl: fix build breakage with last commit
  * BUG/MINOR: ssl: do not try to use early data if not configured
  * BUG/MINOR: xxhash: make sure armv6 uses memcpy()
  * BUG/MINOR: mux_h2: fix incorrect stat titles
  * BUG/MEDIUM: ssl: check a connection's status before computing a handshake
  * BUG/MEDIUM: ssl/cli: abort ssl cert is freeing the old store
  * BUG/MINOR: stick-table: Always call smp_fetch_src() with a valid arg list
  * DOC: management: fix "show resolvers" alphabetical ordering
  * MINOR: h1: Raise the chunk size limit up to (2^52 - 1)
  * MINOR: mux-h1/show_fd: report as suspicious an entry with too many calls
  * MINOR: mux-h2/show_fd: report as suspicious an entry with too many calls
  * MINOR: ssl/show_fd: report some FDs as suspicious when possible
  * MINOR: cli/show_fd: report some easily detectable suspicious states
  * MINOR: cli: give the show_fd helpers the ability to report a suspicious entry
  * MINOR: mux-fcgi: make the "show fd" helper also decode the fstrm subscriber when known
  * MINOR: mux-h1: make the "show fd" helper also decode the h1s subscriber when known
  * MINOR: mux-h2: make the "show fd" helper also decode the h2s subscriber when known
  * MINOR: xprt/mux: export all *_io_cb functions so that "show fd" resolves them
  * MINOR: ssl: provide a "show fd" helper to report important SSL information
  * MINOR: xprt: add a new show_fd() helper to complete some "show fd" dumps.
  * MINOR: cli: make "show fd" also report the xprt and xprt_ctx
  * CLEANUP: cli: make "show fd" use a const connection to access other fields
  * CLEANUP: tools: make resolve_sym_name() take a const pointer
  * MINOR: contrib: Make the wireshark peers dissector compile for more distribs.
  * BUG/MINOR: backend: check available list allocation for reuse
  * BUG/MEDIUM: backend: never reuse a connection for tcp mode
  * REORG: backend: simplify conn_backend_get
  * BUG/MEDIUM: session: only retrieve ready idle conn from session
  * BUG/MINOR: ssl: init tmp chunk correctly in ssl_sock_load_sctl_from_file()
  * BUG/MINOR: config: fix leak on proxy.conn_src.bind_hdr_name
  * BUG/MEDIUM: filters/htx: Fix data forwarding when payload length is unknown
  * DOC: Improve documentation of the various hdr() fetches
  * BUILD/MINOR: lua: define _GNU_SOURCE for LLONG_MAX
  * BUG/MEDIUM: mux-h2: fix read0 handling on partial frames
  * BUG/MEDIUM: tcpcheck: Don't destroy connection in the wake callback context
  * BUG/MINOR: mworker: define _GNU_SOURCE for strsignal()
  * BUG/MINOR: mux_h2: missing space between "st" and ".flg" in the "show fd" helper
  * BUG/MINOR: peers: Wrong "new_conn" value for "show peers" CLI command.
  * MINOR: build: discard echoing in help target
  * BUG/MINOR: peers: Possible appctx pointer dereference.
  * BUG/MEDIUM: stats: add missing INF_BUILD_INFO definition
  * BUILD: peers: fix build warning about unused variable
  * BUG/MINOR: dns: SRV records ignores duplicated AR records (v2)
  * MINOR: peers: Add traces for peer control messages.
  * BUG/MINOR: threads: Fixes the number of possible cpus report for Mac.
  * MINOR: server: Forbid server definitions in frontend sections
  * MINOR: config: Add failifnotcap() to emit an alert on proxy capabilities
  * BUG/MINOR: init: Use a dynamic buffer to set HAPROXY_CFGFILES env variable</changelog>
  <changelog author="mrueckert@suse.de" date="1614772800">- Update to version 2.3.6+git0.7851701ed:
  * [RELEASE] Released version 2.3.6
  * BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout
  * BUG/MINOR: mux-h2: Fix typo in scheme adjustment
  * DOC: spoe: Add a note about fragmentation support in HAProxy
  * BUG/MEDIUM: spoe: Kill applets if there are pending connections and nbthread &gt; 1
  * BUG/MINOR: connection: Use the client's dst family for adressless servers
  * BUG/MINOR: tcp-act: Don't forget to set the original port for IPv4 set-dst rule
  * BUG/MINOR: http-ana: Only consider dst address to process originalto option
  * BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf()
  * BUG/MINOR: stats: fix compare of no-maint url suffix
  * CLEANUP: muxes: Remove useless if condition in show_fd function
  * BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup()
  * BUG/MEDIUM: resolvers: Reset address for unresolved servers
  * BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records
  * BUG/MINOR: resolvers: new callback to properly handle SRV record errors
  * BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record
  * BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned
  * BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl()
  * BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal
  * BUG/MEDIUM: cli/shutdown sessions: make it thread-safe
  * BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop
  * BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe
  * BUG/MINOR: sample: secure convs that accept base64 string and var name as args
  * MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes
  * BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert"
  * BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok
  * BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line
  * BUG/MINOR: server: Init params before parsing a new server-state line
  * BUG/MINOR: http-rules: Always replace the response status on a return action
  * BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer
  * BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ().
  * DOC: explain the relation between pool-low-conn and tune.idle-pool.shared
  * BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions
  * BUG/MINOR: sample: Always consider zero size string samples as unsafe
  * BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust()
  * BUG/MINOR: checks: properly handle wrapping time in __health_adjust()
  * BUG/MINOR: session: atomically increment the tracked sessions counter
  * BUG/MINOR: server: Remove RMAINT from admin state when loading server state
  * CLEANUP: channel: fix comment in ci_putblk.
  * DOC: tune: explain the origin of block size for ssl.cachesize
  * BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL
  * BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines
  * BUG/MINOR: stats: revert the change on ST_CONVDONE
  * BUG/MEDIUM: config: don't pick unset values from last defaults section
  * CLEANUP: deinit: release global and per-proxy server-state variables on deinit
  * BUG/MINOR: server: Fix server-state-file-name directive
  * BUG/MINOR: backend: hold correctly lock when killing idle conn
  * BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints()
  * BUG/MINOR: server: re-align state file fields number
  * BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state
  * BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors
  * BUG/MINOR: intops: fix mul32hi()'s off-by-one
  * BUILD: ssl: guard SSL_CTX_set_msg_callback with SSL_CTRL_SET_MSG_CALLBACK macro
  * BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro
  * BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro
  * MINOR: check: do not ignore a connection header for http-check send</changelog>
  <changelog author="mrueckert@suse.de" date="1615896000">- Update to version 2.3.7+git0.2d39ce334:
  * [RELEASE] Released version 2.3.7
  * BUG/MINOR: resolvers: Add missing case-insensitive comparisons of DNS hostnames
  * MINOR: resolvers: Don't try to match immediatly renewed ADD items
  * MINOR: resolvers: Use milliseconds for cached items in resolver responses
  * BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set
  * BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks
  * MINOR: resolvers: Directly call srvrq_update_srv_state() when possible
  * MINOR: resolvers: Add function to change the srv status based on SRV resolution
  * MINOR: resolvers: Purge answer items when a SRV resolution triggers an error
  * MINOR: resolvers: Use a function to remove answers attached to a resolution
  * BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete
  * BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item
  * MINOR: resolvers: new function find_srvrq_answer_record()
  * BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item
  * BUG/MEDIUM: resolvers: Don't set an address-less server as UP
  * BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution
  * BUG/MINOR: resolvers: Reset server address on DNS error only on status change
  * BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error
  * Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record"
  * CLEANUP: tcp-rules: add missing actions in the tcp-request error message
  * BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check
  * BUG/MINOR: session: Add some forgotten tests on session's listener
  * BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters
  * BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check
  * BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached
  * BUILD: atomic/arm64: force the register pairs to use in __ha_cas_dw()
  * BUG/MEDIUM: stick-tables: fix ref counter in table entry using multiple http tracksc.
  * OPTIM: task: automatically adjust the default runqueue-depth to the threads
  * MINOR: task: give the scheduler a bit more flexibility in the runqueue size
  * MEDIUM: task: remove the tasks_run_queue counter and have one per thread
  * MEDIUM: ssl: implement xprt_set_used and xprt_set_idle to relax context checks
  * MINOR: xprt: add new xprt_set_idle and xprt_set_used methods
  * MEDIUM: muxes: mark idle conns tasklets with TASK_F_USR1
  * MINOR: task: add an application specific flag to the state: TASK_F_USR1
  * BUG/MEDIUM: ssl: properly remove the TASK_HEAVY flag at end of handshake
  * MINOR: ssl: mark the SSL handshake tasklet as heavy
  * MINOR: task: limit the number of subsequent heavy tasks with flag TASK_HEAVY
  * MEDIUM: backend: use a trylock when trying to grab an idle connection
  * MINOR: pools: double the local pool cache size to 1 MB
  * MEDIUM: pools: add CONFIG_HAP_NO_GLOBAL_POOLS and CONFIG_HAP_GLOBAL_POOLS
  * MEDIUM: streams: do not use the streams lock anymore
  * MINOR: streams: use one list per stream instead of a global one
  * MINOR: cli/streams: make "show sess" dump all streams till the new epoch
  * MINOR: stream: add an "epoch" to figure which streams appeared when
  * MINOR: dynbuf: pass offer_buffers() the number of buffers instead of a threshold
  * MINOR: dynbuf: use regular lists instead of mt_lists for buffer_wait
  * MINOR: dynbuf: make the buffer wait queue per thread
  * OPTIM: lb-leastconn: do not unlink the server if it did not change
  * OPTIM: lb-leastconn: do not take the server lock on take_conn/drop_conn
  * OPTIM: lb-first: do not take the server lock on take_conn/drop_conn
  * MINOR: lb/api: let callers of take_conn/drop_conn tell if they have the lock
  * MINOR: server: move actconns to the per-thread structure
  * OPTIM: server: switch the actconn list to an mt-list
  * MINOR: listener: refine the default MAX_ACCEPT from 64 to 4
  * MINOR: tasks: refine the default run queue depth
  * BUG/MEDIUM: session: NULL dereference possible when accessing the listener
  * MINOR: atomic: implement a more efficient arm64 __ha_cas_dw() using pairs
  * MINOR: atomic: add armv8.1-a atomics variant for cas-dw
  * BUG/MINOR: mt-list: always perform a cpu_relax call on failure
  * REORG: atomic: reimplement pl_cpu_relax() from atomic-ops.h
  * BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode
  * BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring()
  * BUG/MINOR: backend: fix condition for reuse on mode HTTP</changelog>
  <changelog author="mrueckert@suse.de" date="1616673600">- Update to version 2.3.8+git0.e572195c7:
  * [RELEASE] Released version 2.3.8
  * BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters
  * MINOR: tools: make url2ipv4 return the exact number of bytes parsed
  * BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless
  * BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available.
  * CLEANUP: fd: remove unused fd_set_running_excl()
  * BUG/MEDIUM: fd: do not wait on FD removal in fd_delete()
  * MINOR: fd: remove the unneeded running bit from fd_insert()
  * MINOR: fd: make fd_clr_running() return the remaining running mask
  * BUG/MEDIUM: lua: Always init the lua stack before referencing the context
  * BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback
  * MINOR: lua: Slightly improve function dumping the lua traceback
  * BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro
  * BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list"
  * BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable
  * MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua
  * MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master CLI socket
  * BUG/MINOR: protocol: add missing support of dgram unix socket.
  * BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable
  * MINOR: time: also provide a global, monotonic global_now_ms timer
  * BUG/MEDIUM: mux-fcgi: Fix locking of idle_conns lock in the FCGI I/O callback
  * BUG/MINOR: freq_ctr/threads: make use of the last updated global time
  * MINOR: time: export the global_now variable</changelog>
  <changelog author="mrueckert@suse.de" date="1617105600">- Update to version 2.3.9+git1.afb63bc04:
  * BUILD: backend: fix build breakage in idle conn locking fix
  * [RELEASE] Released version 2.3.9
  * BUG/MEDIUM: time: make sure to always initialize the global tick
  * BUG/MINOR: stats: Apply proper styles in HTML status page.
  * BUG/MINOR: payload: Wait for more data if buffer is empty in payload/payload_lv
  * MEDIUM: backend: use a trylock to grab a connection on high FD counts as well
  * BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent</changelog>
  <changelog author="mrueckert@suse.de" date="1619179200">- Update to version 2.3.10+git0.4764f0e4e:
  * [RELEASE] Released version 2.3.10
  * BUG/MEDIUM: peers: re-work refcnt on table to protect against flush
  * BUG/MEDIUM: peers: re-work connection to new process during reload.
  * BUG/MINOR: peers: remove useless table check if initial resync is finished
  * BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data
  * BUG/MINOR: mworker: don't use oldpids[] anymore for reload
  * BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases
  * BUG/MEDIUM: config: fix cpu-map notation with both process and threads
  * BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames
  * BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers
  * BUG/MINOR: server: free srv.lb_nodes in free_server
  * BUG/MINOR: mux-h1: Release idle server H1 connection if data are received
  * BUG/MINOR: logs: Report the true number of retries if there was no connection
  * BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function
  * BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded
  * BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check
  * MINOR: connection: Make bc_http_major compatible with tcp-checks
  * BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections
  * MINOR: logs: Add support of checks as session origin to format lf strings
  * BUG/MINOR: checks: Set missing id to the dummy checks frontend
  * BUG/MEDIUM: threads: Ignore current thread to end its harmless period
  * DOC: ssl: Certificate hot update only works on fronted certificates
  * BUG/MEDIUM: sample: Fix adjusting size in field converter
  * MINOR: No longer rely on deprecated sample fetches for predefined ACLs
  * DOC: clarify that compression works for HTTP/2
  * BUG/MINOR: tools: fix parsing "us" unit for timers
  * CONTRIB: halog: fix issue with array of type char
  * REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken
  * DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options
  * REGTESTS: ssl: "set ssl cert" and multi-certificates bundle
  * BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free
  * BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields
  * BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one
  * BUG/MINOR: ssl: Fix update of default certificate
  * BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS
  * BUG/MINOR: tcp: fix silent-drop workaround for IPv6</changelog>
  <changelog author="mrueckert@suse.de" date="1620993600">- Update to version 2.4.0+git0.6cbbecf09:
  https://www.haproxy.com/blog/announcing-haproxy-2-4/
  for all the details see /usr/share/doc/packages/haproxy/CHANGELOG
- refreshed patches to apply cleanly again
  haproxy-1.6.0-makefile_lib.patch
  haproxy-1.6.0-sec-options.patch
  lua54.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1623931200">- Update to version 2.4.1+git0.1ce7d4925:
  * [RELEASE] Released version 2.4.1
  * BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces
  * BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace
  * MINOR: mux-h2: obey http-ignore-probes during the preface
  * BUG/MINOR: stats: make "show stat typed desc" work again
  * CLEANUP: mux-h2/traces: better align user messages
  * MINOR: mux-h2/trace: report a few connection-level info during h2_init()
  * MINOR: connection: add helper conn_append_debug_info()
  * BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers
  * BUG/MINOR: mux-h1: do not skip the error response on bad requests
  * MINOR: backend: only skip LB when there are actual connections
  * BUG/MAJOR: queue: set SF_ASSIGNED when setting strm-&gt;target on dequeue
  * CLEANUP: global: remove unused definition of stopping_task[]
  * BUG/MINOR: mworker: fix typo in chroot error message
  * BUG/MINOR: ssl: use atomic ops to update global shctx stats
  * BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE
  * BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node
  * BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree
  * BUG/MEDIUM: server: do not forget to generate the dynamic servers ids
  * BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees
  * BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server'
  * BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id
  * DOC: lua: Add a warning about buffers modification in HTTP
  * BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs
  * MEDIUM: resolvers: add a ref between servers and srv request or used SRV record
  * MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item
  * BUG/MINOR: resolvers: answser item list was randomly purged or errors
  * CLEANUP: l7-retries: do not test the buffer before calling b_alloc()
  * BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default
  * BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded
  * CLEANUP: pools: remove now unused seq and pool_free_list
  * BUG/MAJOR: pools: fix possible race with free() in the lockless variant
  * MEDIUM: pools: use a single pool_gc() function for locked and lockless
  * MINOR: pools: call malloc_trim() under thread isolation
  * MINOR: pools: do not maintain the lock during pool_flush()
  * BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location
  * BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush()
  * BUG/MEDIUM: compression: Add a flag to know the filter is still processing data
  * BUG/MEDIUM: compression: Properly get the next block to iterate on payload
  * BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next block
  * BUG/MEDIUM: opentracing: initialization before establishing daemon and/or chroot mode
  * Revert "BUG/MINOR: opentracing: initialization after establishing daemon mode"
  * BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future
  * BUILD: make tune.ssl.keylog available again
  * DOC: use the req.ssl_sni in examples
  * MINOR: errors: allow empty va_args for diag variadic macro
  * BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry
  * DOC/MINOR: move uuid in the configuration to the right alphabetical order
  * BUG/MINOR: vars: Be sure to have a session to get checks variables
  * CLEANUP: http-ana: Remove useless if statement about L7 retries
  * BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree
  * BUG/MINOR: http: Missing calloc return value check in make_arg_list
  * BUG/MINOR: http: Missing calloc return value check while parsing redirect rule
  * BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list
  * BUG/MINOR: compression: Missing calloc return value check in comp_append_type/algo
  * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request rule
  * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request/tcp-response
  * BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy
  * BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare
  * BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture
  * BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine
  * BUG/MINOR: peers: Missing calloc return value check in peers_register_table
  * BUG/MINOR: server: Missing calloc return value check in srv_parse_source
  * DOC: intro: Fix typo in starter guide
  * MINOR: cfgparse: Fail when encountering extra arguments in macro
  * MINOR: http-ana: Perform L7 retries because of status codes in response analyser
  * BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts
  * BUG/MINOR: http-ana: Send the right error if max retries is reached on L7 retry
  * Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers"
  * BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response
  * BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter
  * BUILD/MINOR: opentracing: fixed build when using clang
  * BUG/MAJOR: server: prevent deadlock when using 'set maxconn server'
  * BUG/MEDIUM: ebtree: Invalid read when looking for dup entry</changelog>
  <changelog author="mrueckert@suse.de" date="1625659200">- Update to version 2.4.2+git0.553dee326:
  * [RELEASE] Released version 2.4.2
  * REGTESTS: add http scheme-based normalization test
  * MEDIUM: h2: apply scheme-based normalization on h2 requests
  * MEDIUM: h1-htx: apply scheme-based normalization on h1 requests
  * MEDIUM: http: implement scheme-based normalization
  * MINOR: http: implement http_get_scheme
  * Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules"
  * BUG/MINOR: cli: fix server name output in "show fd"
  * BUG/MEDIUM: sock: make sure to never miss early connection failures
  * DOC: stick-table: add missing documentation about gpt0 stored type
  * BUG/MINOR: peers: fix data_type bit computation more than 32 data_types
  * BUG/MINOR: stick-table: fix several printf sign errors dumping tables
  * DOC: config: use CREATE USER for mysql-check
  * BUG/MEDIUM: resolvers: Make 1st server of a template take part to SRV resolution
  * BUG/MINOR: mqtt: Support empty client ID in CONNECT message
  * BUG/MINOR: mqtt: Fix parser for string with more than 127 characters
  * BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules
  * BUILD: Makefile: fix linkage for Haiku.
  * BUG/MINOR: checks: return correct error code for srv_parse_agent_check
  * MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response()
  * BUG/MINOR: resolvers: Reset server IP when no ip is found in the response
  * BUG/MINOR: resolvers: Always attach server on matching record on resolution
  * CLEANUP: dns: Remove a forgotten debug message
  * DOC: config: Add missing actions in "tcp-request session" documentation
  * MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules
  * REGTESTS: fix maxconn update with agent-check
  * BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check
  * BUG/MINOR: cache: Correctly handle existing-but-empty 'accept-encoding' header
  * BUG/MINOR: server/cli: Fix locking in function processing "set server" command
  * BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task()
  * BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status
  * MINOR: resolvers: Remove server from named_servers tree when removing a SRV item
  * MINOR: resolvers: Clean server in a dedicated function when removing a SRV item
  * BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI
  * BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled
  * BUG/MINOR: server-state: load SRV resolution only if params match the config</changelog>
  <changelog author="mrueckert@suse.de" date="1629201600">- Update to version 2.4.3+git0.4dd5a5a6c:
    CVE-2021-39240 CVE-2021-39241 CVE-2021-39242
    (boo#1189366 boo#1189548 boo#1189549)
  * [RELEASE] Released version 2.4.3
  * REGTESTS: add a test to prevent h2 desync attacks
  * BUG/MEDIUM: h2: give :authority precedence over Host
  * BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header
  * BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it
  * BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax
  * MINOR: http: add a new function http_validate_scheme() to validate a scheme
  * DOC/MINOR: fix typo in management document
  * CLEANUP: assorted typo fixes in the code and comments
  * BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during config check
  * BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued
  * DOC: config: Fix 'http-response send-spoe-group' documentation
  * DOC: Improve the lua documentation
  * BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer
  * BUG/MINOR: buffer: fix buffer_dump() formatting
  * BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one is released
  * MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure
  * ADMIN: dyncookie: implement a simple dynamic cookie calculator
  * MINOR: server: unmark deprecated on enable health/agent cli
  * BUG/MINOR: server: update last_change on maint-&gt;ready transitions too
  * BUG/MINOR: server: remove srv from px list on CLI 'add server' error
  * BUILD: opentracing: fixed build when using pkg-config utility
  * DOC: internals: document the FD takeover process
  * BUG/MINOR: fd: protect fd state harder against a concurrent takeover
  * BUG/MINOR: pollers: always program an update for migrated FDs
  * BUG/MINOR: poll: fix abnormally high skip_fd counter
  * BUG/MINOR: select: fix excess number of dead/skip reported
  * BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before
  * BUG/MEDIUM: connection: close a rare race between idle conn close and takeover
  * BUG/MINOR: connection: Add missing error labels to conn_err_code_str
  * BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames
  * BUG/MINOR: mux-h1: Be sure to swap H1C to splice mode when rcv_pipe() is called
  * BUG/MINOR: mux-h2: Obey dontlognull option during the preface
  * BUG/MINOR: mux-h1: Obey dontlognull option for empty requests
  * BUG/MINOR: systemd: must check the configuration using -Ws
  * BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree
  * BUG/MINOR: check: fix the condition to validate a port-less server
  * BUG/MINOR: stats: Add missing agent stats on servers
  * BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request
  * BUILD/MINOR: memprof fix macOs build.
  * BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs
  * BUG/MEDIUM: mworker: do not register an exit handler if exit is expected
  * BUILD: lua: silence a build warning with TCC
  * BUILD: add detection of missing important CFLAGS
  * BUG/MINOR: ssl: Default-server configuration ignored by server
  * MINOR: mux_h2: define config to disable h2 websocket support
  * BUILD: http_htx: fix ci compilation error with isdigit for Windows</changelog>
  <changelog author="mrueckert@suse.de" date="1631016000">- Update to version 2.4.4+git0.acb1d0bea: CVE-2021-40346 (boo#1189877)
  * [RELEASE] Released version 2.4.4
  * Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive"
  * BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer
  * CLEANUP: htx: remove comments about "must be &lt; 256 MB"
  * BUG/MINOR: config: reject configs using HTTP with bufsize &gt;= 256 MB
  * DOC: configuration: remove wrong tcp-request examples in tcp-response
  * BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser
  * CLEANUP: Add missing include guard to signal.h
  * BUG/MINOR: tools: Fix loop condition in dump_text()
  * BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time
  * BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long
  * MINOR: time: add report_idle() to report process-wide idle time
  * BUG/MINOR: time: fix idle time computation for long sleeps
  * BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords
  * MINOR: compiler: implement an ONLY_ONCE() macro
  * BUG/MINOR: base64: base64urldec() ignores padding in output size check
  * BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec}
  * BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions
  * MINOR: hlua: take the global Lua lock inside a global function
  * REGTESTS: abortonclose: after retries, 503 is expected, not close
  * REGTESTS: http_upgrade: fix incorrect expectation on TCP-&gt;H1-&gt;H2
  * BUG/MEDIUM: h2: match absolute-path not path-absolute for :path</changelog>
  <changelog author="mrueckert@suse.de" date="1633089600">- Update to version 2.4.5+git0.e74a1b34b:
  * [RELEASE] Released version 2.4.5
  * MINOR: tasks: catch TICK_ETERNITY with BUG_ON() in __task_queue()
  * BUG/MINOR: tcp-rules: Stop content rules eval on read error and end-of-input
  * BUG/MINOR: tcpcheck: Don't use arg list for default proxies during parsing
  * MINOR: arg: Be able to forbid unresolved args when building an argument list
  * BUG/MAJOR: lua: use task_wakeup() to properly run a task once
  * BUG/MEDIUM: lua: fix wakeup condition from sleep()
  * MINOR: Makefile: add MEMORY_POOLS to the list of DEBUG_xxx options
  * DOC: peers: fix doc "enable" statement on "peers" sections
  * BUG/MINOR: mux-h1/mux-fcgi: Sanitize TE header to only send "trailers"
  * MINOR: stream-int: Notify mux when the buffer is not stuck when calling rcv_buf
  * BUG/MEDIUM: stream-int: Defrag HTX message in si_cs_recv() if necessary
  * MINOR: htx: Add a function to know if the free space wraps
  * MINOR: htx: Add an HTX flag to know when a message is fragmented
  * MINOR: stream-int: Set CO_RFL transient/persistent flags apart in si_cs_rcv()
  * BUG/MEDIUM: stream: Stop waiting for more data if SI is blocked on RXBLK_ROOM
  * BUG/MEDIUM: stream-int: Notify stream that the mux wants more room to xfer data
  * BUG/MEDIUM: mux-h1: Adjust conditions to ask more space in the channel buffer
  * BUG/MINOR: stats: use refcount to protect dynamic server on dump
  * MINOR: server: return the next srv instance on free_server
  * BUG/MINOR: server: do not use refcount in free_server in stopping mode
  * MINOR: global: define MODE_STOPPING
  * MINOR: server: implement a refcount for dynamic servers
  * BUG/MINOR: http-ana: increment internal_errors counter on response error
  * BUG/MINOR: h1-htx: Fix a typo when request parser is reset
  * BUG/MEDIUM: leastconn: fix rare possibility of divide by zero
  * BUG/MINOR: server: allow 'enable health' only if check configured
  * BUILD: threads: fix -Wundef for _POSIX_PRIORITY_SCHEDULING on libmusl
  * BUILD: halog: fix a -Wundef warning on non-glibc systems
  * BUILD: compiler: fixed a missing test on  defined(__GNUC__)
  * BUILD: fix dragonfly build again on __read_mostly
  * BUG/MINOR: vars: do not talk about global section in CLI errors for set-var
  * BUG/MINOR: vars: truncate the variable name in error reports about scope.
  * BUG/MINOR: vars: properly set the argument parsing context in the expression
  * MINOR: sample: add missing ARGC_ entries
  * BUG/MINOR: vars: improve accuracy of the rules used to check expression validity
  * BUILD: tools: properly guard __GLIBC__ with defined()
  * BUILD: ssl: fix two remaining occurrences of #if USE_OPENSSL
  * BUILD: ssl: next round of build warnings on LIBRESSL_VERSION_NUMBER
  * BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -Wundef
  * IMPORT: slz: silence a build warning with -Wundef
  * BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -Wundef
  * BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -Wundef
  * BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILING
  * MINOR: proc: setting the process to produce a core dump on FreeBSD.
  * MINOR: tools: add FreeBSD support to get_exec_path()
  * BUILD: tools: get the absolute path of the current binary on NetBSD.
  * BUG/MINOR: flt-trace: fix an infinite loop when random-parsing is set
  * BUG/MINOR: cli/payload: do not search for args inside payload
  * BUILD: ist: prevent gcc11 maybe-uninitialized warning on istalloc
  * BUG/MINOR: connection: prevent null deref on mux cleanup task allocation
  * DOC: management: certificate files must be sanitized before injection
  * BUG/MINOR: tcpcheck: Improve LDAP response parsing to fix LDAP check
  * BUG/MAJOR: mux-h1: Don't eval input data if an error was reported
  * MINOR: pools: use mallinfo2() when available instead of mallinfo()
  * MINOR: pools: automatically disable malloc_trim() with external allocators
  * CLEANUP: pools: factor all malloc_trim() calls into trim_all_pools()
  * BUG/MINOR: compat: make sure __WORDSIZE is always defined
  * BUG/MEDIUM: stream-int: Don't block SI on a channel policy if EOI is reached
  * CLEANUP: mux-h1: Remove condition rejecting upgrade requests with payload
  * MINOR: htx: Skip headers with no value when adding a header list to a message
  * BUG/MEDIUM: mux-h1: Remove "Upgrade:" header for requests with payload
  * BUG/MINOR: systemd: ExecStartPre must use -Ws
  * BUG/MINOR: filters: Set right FLT_END analyser depending on channel
  * BUG/MINOR: filters: Always set FLT_END analyser when CF_FLT_ANALYZE flag is set
  * BUG/MEDIUM: http-ana: Reset channels analysers when returning an error
  * BUG/MINOR: stream: Don't release a stream if FLT_END is still registered
  * BUG/MINOR: lua: Don't yield in channel.append() and channel.set()
  * BUG/MINOR: lua: Yield in channel functions only if lua context can yield
  * MINOR: lua: Add a flag on lua context to know the yield capability at run time</changelog>
  <changelog author="mrueckert@suse.de" date="1633348800">- Update to version 2.4.6+git0.d83fd76a1:
  * [RELEASE] Released version 2.4.6
  * BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release</changelog>
  <changelog author="mrueckert@suse.de" date="1633348801">- Update to version 2.4.7+git0.b5e51a5e2:
  * [RELEASE] Released version 2.4.7
  * BUG/MEDIUM: http-ana: Clear request analyzers when applying redirect rule</changelog>
  <changelog author="mrueckert@suse.de" date="1635940800">- Update to version 2.4.8+git0.d1f8d41e0:
  * [RELEASE] Released version 2.4.8
  * SCRIPTS: git-show-backports: re-enable file-based filtering
  * DOC/peers: some grammar fixes for peers 2.1 spec
  * MINOR: stream: Improve dump of bogus streams
  * BUILD/MINOR: cpuset freebsd build fix
  * DOC: config: Fix alphabetical order of fc_* samples
  * BUG/MINOR: sample: fix backend direction flags consecutive to last fix
  * BUG/MEDIUM: sample: Cumulate frontend and backend sample validity flags
  * BUG/MEDIUM: stream-int: Block reads if channel cannot receive more data
  * BUG/MINOR: http: Authorization value can have multiple spaces after the scheme
  * BUG/MEDIUM: http-ana: Drain request data waiting the tarpit timeout expiration
  * MINOR: halog: Add support for extracting captures using -hdr
  * BUG/MINOR: halog: Add missing newlines in die() messages
  * CLEANUP: halog: Use consistent indentation in help()
  * MINOR: halog: Rename -qry to -query
  * DOC: halog: Move the `-qry` parameter into the correct section in help text
  * MINOR: halog: Add -qry parameter allowing to preserve the query string in -uX
  * BUG/MEDIUM: resolvers: Track api calls with a counter to free resolutions
  * BUG/MEDIUM: resolvers: Don't recursively perform requester unlink
  * MEDIUM: resolvers: remove the last occurrences of the "safe" argument
  * MEDIUM: resolvers: use a kill list to preserve the list consistency
  * CLEANUP: resolvers: replace all LIST_DELETE with LIST_DEL_INIT
  * CLEANUP: resolvers: simplify resolv_link_resolution() regarding requesters
  * CLEANUP: always initialize the answer_list
  * CLEANUP: resolvers: do not export resolv_purge_resolution_answer_records()
  * BUG/MEDIUM: mux-h1: Perform a connection shutdown when the h1c is released
  * BUG/MINOR: mux-h1: Save shutdown mode if the shutdown is delayed
  * BUILD: atomic: fix build on mac/arm64
  * BUG/MINOR: backend: fix improper insert in avail tree for always reuse
  * BUILD: fix compilation on NetBSD
  * MINOR: memprof: add one pointer size to the size of allocations
  * MINOR: memprof: report the delta between alloc and free on realloc()
  * BUG/MEDIUM: lua: fix memory leaks with realloc() on non-glibc systems
  * BUG/MINOR: mux-h2: do not prevent from sending a final GOAWAY frame
  * BUG/MINOR: task: do not set TASK_F_USR1 for no reason
  * BUG/MAJOR: buf: fix varint API post- vs pre- increment
  * BUG/MEDIUM: resolvers: always check a valid item in query_list
  * BUILD: resolvers: avoid a possible warning on null-deref
  * BUG/MAJOR: resolvers: add other missing references during resolution removal
  * MINOR: resolvers: merge address and target into a union "data"
  * BUG/MEDIUM: resolvers: use correct storage for the target address
  * BUG/MEDIUM: resolvers: fix truncated TLD consecutive to the API fix
  * MINOR: resolvers: fix the resolv_dn_label_to_str() API about trailing zero
  * BUG/MINOR: resolvers: do not reject host names of length 255 in SRV records
  * BUG/MEDIUM: resolver: make sure to always use the correct hostname length
  * MINOR: resolvers: fix the resolv_str_to_dn_label() API about trailing zero
  * BUG/MAJOR: dns: attempt to lock globaly for msg waiter list instead of use barrier
  * BUG/MAJOR: dns: tcp session can remain attached to a list after a free
  * BUG/MEDIUM: tcpcheck: Properly catch early HTTP parsing errors
  * Revert "CLEANUP: server: always include the storage for SSL settings"
  * BUG/MEDIUM: stream: Keep FLT_END analyzers if a stream detects a channel error
  * BUG/MEDIUM: cpuset: fix cpuset size for FreeBSD
  * BUG/MINOR: sample: Fix 'fix_tag_value' sample when waiting for more data
  * BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back
  * MINOR: initcall: Rename __GLOBL and __GLOBL1.
  * DOC: configuration: add clarification on escaping in keyword arguments
  * BUG/MEDIUM: mux_h2: Handle others remaining read0 cases on partial frames
  * BUG/MEDIUM: sample: properly verify that variables cast to sample
  * MINOR: sample: provide a generic var-to-sample conversion function
  * CLEANUP: sample: uninline sample_conv_var2smp_str()
  * CLEANUP: sample: rename sample_conv_var2smp() to *_sint
  * CLEANUP: server: always include the storage for SSL settings</changelog>
  <changelog author="varkoly@suse.com" date="1646740800">- (bsc#1196408) VUL-0: CVE-2022-0711: haproxy: Denial of service via set-cookie2 header
  o Apply upstream patch:
    0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch</changelog>
  <changelog author="varkoly@suse.com" date="1674043200">- VUL-0: CVE-2023-0056: haproxy: segfault DoS (bsc#1207181)
  o Apply upstream patch:
    0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch</changelog>
</package>
<package pkgid="58c507892f06b9ad0822e4e78f78265ca77116b8cd4656dedb0b18bc193f4d8e" name="hwdata" arch="noarch">
  <version epoch="0" ver="0.365" rel="150000.3.54.1"/>
  <changelog author="mpluskal@suse.com" date="1617710400">- Update to version 0.346:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1620302400">- Update to version 0.347 (bsc#1185697):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1622635200">- Update to version 0.348 (bsc#1186749):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1625745600">- Update to version 0.349 (bsc#1187948):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1627992000">- Update to version 0.350 (bsc#1189005):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1630584000">- Update to version 0.351 (bsc#1190091):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1633521600">- Update to version 0.352 (bsc#1191375):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version 0.353 (bsc#1192587):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1638878400">- Update to version 0.354:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1641384000">- Update to version 0.355 (bsc#1194338):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1644321600">- Update to version 0.356:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1646740800">- Update to version 0.357 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1650369600">- Update to version 0.358 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1652270400">- Update to version 0.359:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1654084800">- Update to version 0.360 (bsc#1200110):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="dmueller@suse.com" date="1657540800">- update to 0.361:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1663156800">- update to 0.362:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1665662400">- update to 0.363:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1668513600">- update to 0.364:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1670328000">- update to 0.365:
  + Updated pci, usb and vendor ids.</changelog>
</package>
<package pkgid="96a61b1c8e204ff8f285a8b5413267366c4d16019bb686151e9b78701fc920ac" name="hwdata" arch="src">
  <version epoch="0" ver="0.365" rel="150000.3.54.1"/>
  <changelog author="mpluskal@suse.com" date="1617710400">- Update to version 0.346:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1620302400">- Update to version 0.347 (bsc#1185697):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1622635200">- Update to version 0.348 (bsc#1186749):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1625745600">- Update to version 0.349 (bsc#1187948):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1627992000">- Update to version 0.350 (bsc#1189005):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1630584000">- Update to version 0.351 (bsc#1190091):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1633521600">- Update to version 0.352 (bsc#1191375):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version 0.353 (bsc#1192587):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1638878400">- Update to version 0.354:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1641384000">- Update to version 0.355 (bsc#1194338):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1644321600">- Update to version 0.356:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1646740800">- Update to version 0.357 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1650369600">- Update to version 0.358 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1652270400">- Update to version 0.359:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1654084800">- Update to version 0.360 (bsc#1200110):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="dmueller@suse.com" date="1657540800">- update to 0.361:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1663156800">- update to 0.362:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1665662400">- update to 0.363:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1668513600">- update to 0.364:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1670328000">- update to 0.365:
  + Updated pci, usb and vendor ids.</changelog>
</package>
<package pkgid="e81a1ee5457c555a071ff7ef53e2c6ce3a3a6b235fe6f173ab73e62b6f189715" name="hwinfo" arch="aarch64">
  <version epoch="0" ver="21.84" rel="150400.3.9.1"/>
  <changelog author="wfeldt@opensuse.org" date="1563537600">- merge gh#openSUSE/hwinfo#81
- fix DASD detection (bsc#1136475)
- don't include bcache devices
- 21.67</changelog>
  <changelog author="mliska@suse.cz" date="1564747200">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1579003200">- merge gh#openSUSE/hwinfo#84
- the /sbin/udevadm compat symlink is gone
- 21.68</changelog>
  <changelog author="dimstar@opensuse.org" date="1579780800">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1585051200">- merge gh#openSUSE/hwinfo#85
- fix xen detection (bsc#1167561)
- add link to cpuid doc
- 21.69</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587470400">- merge gh#openSUSE/hwinfo#86
- update pci and usb ids (bsc#1169682)
- fix compiler warnings
- 21.70</changelog>
  <changelog author="wfeldt@opensuse.org" date="1605873600">- merge gh#openSUSE/hwinfo#89
- rework network device detection on aarch64 (bsc#1177600,
  bsc#1177261)
- 21.71</changelog>
  <changelog author="wfeldt@opensuse.org" date="1611748800">- merge gh#openSUSE/hwinfo#92
- improve getting video mode info (bsc#1181101)
- try harder to break out of infinite I/O loops
- 21.72</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618315200">- merge gh#openSUSE/hwinfo#95
- don't rely on select() updating its timeout arg (bsc#1184339)
- 21.73</changelog>
  <changelog author="wfeldt@opensuse.org" date="1621339200">- merge gh#openSUSE/hwinfo#98
- update pci and usb ids
- 21.74</changelog>
  <changelog author="wfeldt@opensuse.org" date="1625227200">- merge gh#openSUSE/hwinfo#100
- recognize loongarch64 architecture
- 21.75</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627041600">- merge gh#openSUSE/hwinfo#104
- Fix timezone issue in SOURCE_DATE_EPOCH code
- 21.76</changelog>
  <changelog author="wfeldt@opensuse.org" date="1633089600">- merge gh#openSUSE/hwinfo#105
- Use license file from gnu.org
- Fix spelling
- Add missing final newline
- Trim excess whitespace
- Simple maintenance improvements
- 21.77</changelog>
  <changelog author="wfeldt@opensuse.org" date="1636632000">- merge gh#openSUSE/hwinfo#106
- Always read numerical 32bit serial number from EDID header.
  Override this with ASCII serial number from display descriptor,
  if available.
- Display numerical 32bit serial number for monitors without serial
  number display descriptor
- 21.78</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639483200">- merge gh#openSUSE/hwinfo#108
- Donot close the open tray after read_cdrom_info.
- Donot close the open tray after read.
- 21.79</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639742400">- merge gh#openSUSE/hwinfo#109
- fix logic around cdrom detection
- 21.80</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649851200">- merge gh#openSUSE/hwinfo#112
- fix bug in determining serial console device name (bsc#1198043)
- 21.81</changelog>
  <changelog author="wfeldt@opensuse.org" date="1655985600">- merge gh#openSUSE/hwinfo#113
- Keep NVMe's namespace output consistency when
  nvme_core.multipath=1 (bsc#1199948)
- 21.82</changelog>
  <changelog author="wfeldt@opensuse.org" date="1659700800">- merge gh#openSUSE/hwinfo#115
- improve treatment of NVME devices (bsc#1200975)
- fix compiler warnings
- 21.83</changelog>
  <changelog author="wfeldt@opensuse.org" date="1673265600">- merge gh#openSUSE/hwinfo#127
- create xen usb controller device if necessary (bsc#1204294)
- 21.84</changelog>
</package>
<package pkgid="f093ebaeda5f1755562a558fbb1a2cede3158d2c0ace7fed404e879b85a3f800" name="hwinfo" arch="src">
  <version epoch="0" ver="21.84" rel="150400.3.9.1"/>
  <changelog author="wfeldt@opensuse.org" date="1563537600">- merge gh#openSUSE/hwinfo#81
- fix DASD detection (bsc#1136475)
- don't include bcache devices
- 21.67</changelog>
  <changelog author="mliska@suse.cz" date="1564747200">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1579003200">- merge gh#openSUSE/hwinfo#84
- the /sbin/udevadm compat symlink is gone
- 21.68</changelog>
  <changelog author="dimstar@opensuse.org" date="1579780800">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1585051200">- merge gh#openSUSE/hwinfo#85
- fix xen detection (bsc#1167561)
- add link to cpuid doc
- 21.69</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587470400">- merge gh#openSUSE/hwinfo#86
- update pci and usb ids (bsc#1169682)
- fix compiler warnings
- 21.70</changelog>
  <changelog author="wfeldt@opensuse.org" date="1605873600">- merge gh#openSUSE/hwinfo#89
- rework network device detection on aarch64 (bsc#1177600,
  bsc#1177261)
- 21.71</changelog>
  <changelog author="wfeldt@opensuse.org" date="1611748800">- merge gh#openSUSE/hwinfo#92
- improve getting video mode info (bsc#1181101)
- try harder to break out of infinite I/O loops
- 21.72</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618315200">- merge gh#openSUSE/hwinfo#95
- don't rely on select() updating its timeout arg (bsc#1184339)
- 21.73</changelog>
  <changelog author="wfeldt@opensuse.org" date="1621339200">- merge gh#openSUSE/hwinfo#98
- update pci and usb ids
- 21.74</changelog>
  <changelog author="wfeldt@opensuse.org" date="1625227200">- merge gh#openSUSE/hwinfo#100
- recognize loongarch64 architecture
- 21.75</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627041600">- merge gh#openSUSE/hwinfo#104
- Fix timezone issue in SOURCE_DATE_EPOCH code
- 21.76</changelog>
  <changelog author="wfeldt@opensuse.org" date="1633089600">- merge gh#openSUSE/hwinfo#105
- Use license file from gnu.org
- Fix spelling
- Add missing final newline
- Trim excess whitespace
- Simple maintenance improvements
- 21.77</changelog>
  <changelog author="wfeldt@opensuse.org" date="1636632000">- merge gh#openSUSE/hwinfo#106
- Always read numerical 32bit serial number from EDID header.
  Override this with ASCII serial number from display descriptor,
  if available.
- Display numerical 32bit serial number for monitors without serial
  number display descriptor
- 21.78</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639483200">- merge gh#openSUSE/hwinfo#108
- Donot close the open tray after read_cdrom_info.
- Donot close the open tray after read.
- 21.79</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639742400">- merge gh#openSUSE/hwinfo#109
- fix logic around cdrom detection
- 21.80</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649851200">- merge gh#openSUSE/hwinfo#112
- fix bug in determining serial console device name (bsc#1198043)
- 21.81</changelog>
  <changelog author="wfeldt@opensuse.org" date="1655985600">- merge gh#openSUSE/hwinfo#113
- Keep NVMe's namespace output consistency when
  nvme_core.multipath=1 (bsc#1199948)
- 21.82</changelog>
  <changelog author="wfeldt@opensuse.org" date="1659700800">- merge gh#openSUSE/hwinfo#115
- improve treatment of NVME devices (bsc#1200975)
- fix compiler warnings
- 21.83</changelog>
  <changelog author="wfeldt@opensuse.org" date="1673265600">- merge gh#openSUSE/hwinfo#127
- create xen usb controller device if necessary (bsc#1204294)
- 21.84</changelog>
</package>
<package pkgid="73b1f29206caf2974e07c5683624af65aeeea0d7aea536bc131af2db84ca5167" name="hwinfo" arch="x86_64">
  <version epoch="0" ver="21.84" rel="150400.3.9.1"/>
  <changelog author="wfeldt@opensuse.org" date="1563537600">- merge gh#openSUSE/hwinfo#81
- fix DASD detection (bsc#1136475)
- don't include bcache devices
- 21.67</changelog>
  <changelog author="mliska@suse.cz" date="1564747200">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1579003200">- merge gh#openSUSE/hwinfo#84
- the /sbin/udevadm compat symlink is gone
- 21.68</changelog>
  <changelog author="dimstar@opensuse.org" date="1579780800">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1585051200">- merge gh#openSUSE/hwinfo#85
- fix xen detection (bsc#1167561)
- add link to cpuid doc
- 21.69</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587470400">- merge gh#openSUSE/hwinfo#86
- update pci and usb ids (bsc#1169682)
- fix compiler warnings
- 21.70</changelog>
  <changelog author="wfeldt@opensuse.org" date="1605873600">- merge gh#openSUSE/hwinfo#89
- rework network device detection on aarch64 (bsc#1177600,
  bsc#1177261)
- 21.71</changelog>
  <changelog author="wfeldt@opensuse.org" date="1611748800">- merge gh#openSUSE/hwinfo#92
- improve getting video mode info (bsc#1181101)
- try harder to break out of infinite I/O loops
- 21.72</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618315200">- merge gh#openSUSE/hwinfo#95
- don't rely on select() updating its timeout arg (bsc#1184339)
- 21.73</changelog>
  <changelog author="wfeldt@opensuse.org" date="1621339200">- merge gh#openSUSE/hwinfo#98
- update pci and usb ids
- 21.74</changelog>
  <changelog author="wfeldt@opensuse.org" date="1625227200">- merge gh#openSUSE/hwinfo#100
- recognize loongarch64 architecture
- 21.75</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627041600">- merge gh#openSUSE/hwinfo#104
- Fix timezone issue in SOURCE_DATE_EPOCH code
- 21.76</changelog>
  <changelog author="wfeldt@opensuse.org" date="1633089600">- merge gh#openSUSE/hwinfo#105
- Use license file from gnu.org
- Fix spelling
- Add missing final newline
- Trim excess whitespace
- Simple maintenance improvements
- 21.77</changelog>
  <changelog author="wfeldt@opensuse.org" date="1636632000">- merge gh#openSUSE/hwinfo#106
- Always read numerical 32bit serial number from EDID header.
  Override this with ASCII serial number from display descriptor,
  if available.
- Display numerical 32bit serial number for monitors without serial
  number display descriptor
- 21.78</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639483200">- merge gh#openSUSE/hwinfo#108
- Donot close the open tray after read_cdrom_info.
- Donot close the open tray after read.
- 21.79</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639742400">- merge gh#openSUSE/hwinfo#109
- fix logic around cdrom detection
- 21.80</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649851200">- merge gh#openSUSE/hwinfo#112
- fix bug in determining serial console device name (bsc#1198043)
- 21.81</changelog>
  <changelog author="wfeldt@opensuse.org" date="1655985600">- merge gh#openSUSE/hwinfo#113
- Keep NVMe's namespace output consistency when
  nvme_core.multipath=1 (bsc#1199948)
- 21.82</changelog>
  <changelog author="wfeldt@opensuse.org" date="1659700800">- merge gh#openSUSE/hwinfo#115
- improve treatment of NVME devices (bsc#1200975)
- fix compiler warnings
- 21.83</changelog>
  <changelog author="wfeldt@opensuse.org" date="1673265600">- merge gh#openSUSE/hwinfo#127
- create xen usb controller device if necessary (bsc#1204294)
- 21.84</changelog>
</package>
<package pkgid="8da415adb6e4b4fc760912bfa8d7e43794ece7d805d4a1990f53493a21693185" name="hyper-v" arch="src">
  <version epoch="0" ver="8" rel="150200.14.8.1"/>
  <changelog author="ohering@suse.de" date="1416916800">- introduce -n/--no-daemon option (fate#317533)</changelog>
  <changelog author="ohering@suse.de" date="1418817600">- Start hv_kvp_daemon after network-online.target (bnc#910353)
- ignore ENOBUFS and ENOMEM in the KVP daemon
- vssdaemon: skip all filesystems mounted readonly (bnc#909864)
- vssdaemon: report freeze errors</changelog>
  <changelog author="ohering@suse.de" date="1421064000">- Check return value of setsockopt call
- Improve error logging in VSS daemon.
- Check return value of poll call
- Properly pack the data for file copy functionality
- make struct hv_do_fcopy match Hyper-V host messages</changelog>
  <changelog author="ohering@suse.de" date="1429185600">- Add runlevel script for fcopy daemon in SLE11 (bnc#926534)</changelog>
  <changelog author="ohering@suse.de" date="1430395200">- hv: hypervvssd: call endmntent before call setmntent again
- remove unused bytes_written from kvp_update_file()
- address compiler warnings for hv_kvp_daemon.c
- kvp_daemon: make IPv6-only-injection work
- address compiler warnings for hv_fcopy_daemon.c
- do not add redundant '/' in hv_start_fcopy()</changelog>
  <changelog author="ohering@suse.de" date="1442577600">- add a python script lsvmbus to list VMBus devices (fate#315887)</changelog>
  <changelog author="ohering@suse.de" date="1462363200">- add Conflicts with kernel &lt; 4.2 (fate#320485)
- vss: fix the write()'s argument: error -&gt; vss_msg
- remove repeated HV_FCOPY string
- report ENOSPC errors in hv_fcopy_daemon
- fcopy: full handshake support
- vss: full handshake support
- vss: use misc char device to communicate with kernel
- kvp: use misc char device to communicate with kernel</changelog>
  <changelog author="ohering@suse.de" date="1498651200">- Check VSS daemon is listening before a hot backup (bnc#1029693)
- fix a compile warning in snprintf
- kvp: ensure kvp device fd is closed on exec
- lsvmbus: add pci pass-through UUID</changelog>
  <changelog author="ohering@suse.de" date="1515412800">- update buffer handling in hv_fcopy_daemon
- remove unnecessary header files and netlink related code
- Avoid reading past allocated blocks from KVP file (bnc#1087658)
- fix snprintf warning in kvp_daemon
- properly handle long paths
- kvp: configurable external scripts path
- vss: Thaw the filesystem and continue if freeze call has timed out
- vss: Skip freezing filesystems backed by loop</changelog>
  <changelog author="ohering@suse.de" date="1526990400">- Update lsvmbus interpreter from env(1) to python3(1) (bsc#1093910)</changelog>
  <changelog author="schwab@suse.de" date="1533211200">- hyper-v.tools.hv.hv_vss_daemon.c: Include &lt;sys/sysmacros.h&gt; for major</changelog>
  <changelog author="ohering@suse.de" date="1537876800">- vss: fix loop device detection (07136793)
- Fix IP reporting by KVP daemon with SRIOV (4ba63412)
- Fix a bug in the key delete code (86503bd3)
- fix compiler warnings about major/target_fname (1330fc35)
- PRIVATE hyper-v.compare-with-upstream.sh</changelog>
  <changelog author="ohering@suse.de" date="1539000000">- Update lsvmbus interpreter from python3(1) to python(1)
  because SLE12 lacks python3 support (bsc#1093910)</changelog>
  <changelog author="ohering@suse.de" date="1539086400">- fcopy: set 'error' in case an unknown operation was requested (c2d68afb)</changelog>
  <changelog author="ohering@suse.de" date="1574856000">- async name resolution in kvp_daemon (bsc#1100758)
- kvp: eliminate 'may be used uninitialized' warning (89eb4d8d)
- fix typos in toolchain (2d35c660)
- fixed Python pep8/flake8 warnings for lsvmbus (5912e791)
- Replace GPLv2 boilerplate/reference with SPDX (43aa3132)
- Fix a warning of buffer overflow with gcc 8.0.1 (4fcba780)</changelog>
  <changelog author="ohering@suse.de" date="1575028800">- Update lsvmbus interpreter from python(1) to python3(1) again
  because only SLE12 lacked proper python3 support (bsc#1093910)</changelog>
  <changelog author="ohering@suse.de" date="1582200000">- Revert previous non-upstream change for async name resolution
  Just use gethostname via hyper-v.kvp.gethostname.patch (bsc#1100758)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1595419200">- Enable build on aarch64</changelog>
  <changelog author="ohering@suse.de" date="1595419201">- Remove dependency to network-online.target now that gethostname
  is used in kvp_daemon (bsc#1174443, bsc#1174444)
- Reopen the devices if read() or write() returns errors (9fc3c01a)
- Use either python2 or python3 for lsvmbus (bsc#1093910)
- Remove sysv init scripts</changelog>
  <changelog author="ohering@suse.de" date="1597924800">- Allow daemon restart again (bsc#1116957)
  Since some time the kernel moved from netlink sockets to char
  devices, which is supposed to handle a connection reopen for the
  kernel&lt;-&gt;daemon interface</changelog>
</package>
<package pkgid="767187bad20b34fa26b19b745d0474c039d15dd53e7149169707bb441c0595ff" name="hyper-v" arch="x86_64">
  <version epoch="0" ver="8" rel="150200.14.8.1"/>
  <changelog author="ohering@suse.de" date="1416916800">- introduce -n/--no-daemon option (fate#317533)</changelog>
  <changelog author="ohering@suse.de" date="1418817600">- Start hv_kvp_daemon after network-online.target (bnc#910353)
- ignore ENOBUFS and ENOMEM in the KVP daemon
- vssdaemon: skip all filesystems mounted readonly (bnc#909864)
- vssdaemon: report freeze errors</changelog>
  <changelog author="ohering@suse.de" date="1421064000">- Check return value of setsockopt call
- Improve error logging in VSS daemon.
- Check return value of poll call
- Properly pack the data for file copy functionality
- make struct hv_do_fcopy match Hyper-V host messages</changelog>
  <changelog author="ohering@suse.de" date="1429185600">- Add runlevel script for fcopy daemon in SLE11 (bnc#926534)</changelog>
  <changelog author="ohering@suse.de" date="1430395200">- hv: hypervvssd: call endmntent before call setmntent again
- remove unused bytes_written from kvp_update_file()
- address compiler warnings for hv_kvp_daemon.c
- kvp_daemon: make IPv6-only-injection work
- address compiler warnings for hv_fcopy_daemon.c
- do not add redundant '/' in hv_start_fcopy()</changelog>
  <changelog author="ohering@suse.de" date="1442577600">- add a python script lsvmbus to list VMBus devices (fate#315887)</changelog>
  <changelog author="ohering@suse.de" date="1462363200">- add Conflicts with kernel &lt; 4.2 (fate#320485)
- vss: fix the write()'s argument: error -&gt; vss_msg
- remove repeated HV_FCOPY string
- report ENOSPC errors in hv_fcopy_daemon
- fcopy: full handshake support
- vss: full handshake support
- vss: use misc char device to communicate with kernel
- kvp: use misc char device to communicate with kernel</changelog>
  <changelog author="ohering@suse.de" date="1498651200">- Check VSS daemon is listening before a hot backup (bnc#1029693)
- fix a compile warning in snprintf
- kvp: ensure kvp device fd is closed on exec
- lsvmbus: add pci pass-through UUID</changelog>
  <changelog author="ohering@suse.de" date="1515412800">- update buffer handling in hv_fcopy_daemon
- remove unnecessary header files and netlink related code
- Avoid reading past allocated blocks from KVP file (bnc#1087658)
- fix snprintf warning in kvp_daemon
- properly handle long paths
- kvp: configurable external scripts path
- vss: Thaw the filesystem and continue if freeze call has timed out
- vss: Skip freezing filesystems backed by loop</changelog>
  <changelog author="ohering@suse.de" date="1526990400">- Update lsvmbus interpreter from env(1) to python3(1) (bsc#1093910)</changelog>
  <changelog author="schwab@suse.de" date="1533211200">- hyper-v.tools.hv.hv_vss_daemon.c: Include &lt;sys/sysmacros.h&gt; for major</changelog>
  <changelog author="ohering@suse.de" date="1537876800">- vss: fix loop device detection (07136793)
- Fix IP reporting by KVP daemon with SRIOV (4ba63412)
- Fix a bug in the key delete code (86503bd3)
- fix compiler warnings about major/target_fname (1330fc35)
- PRIVATE hyper-v.compare-with-upstream.sh</changelog>
  <changelog author="ohering@suse.de" date="1539000000">- Update lsvmbus interpreter from python3(1) to python(1)
  because SLE12 lacks python3 support (bsc#1093910)</changelog>
  <changelog author="ohering@suse.de" date="1539086400">- fcopy: set 'error' in case an unknown operation was requested (c2d68afb)</changelog>
  <changelog author="ohering@suse.de" date="1574856000">- async name resolution in kvp_daemon (bsc#1100758)
- kvp: eliminate 'may be used uninitialized' warning (89eb4d8d)
- fix typos in toolchain (2d35c660)
- fixed Python pep8/flake8 warnings for lsvmbus (5912e791)
- Replace GPLv2 boilerplate/reference with SPDX (43aa3132)
- Fix a warning of buffer overflow with gcc 8.0.1 (4fcba780)</changelog>
  <changelog author="ohering@suse.de" date="1575028800">- Update lsvmbus interpreter from python(1) to python3(1) again
  because only SLE12 lacked proper python3 support (bsc#1093910)</changelog>
  <changelog author="ohering@suse.de" date="1582200000">- Revert previous non-upstream change for async name resolution
  Just use gethostname via hyper-v.kvp.gethostname.patch (bsc#1100758)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1595419200">- Enable build on aarch64</changelog>
  <changelog author="ohering@suse.de" date="1595419201">- Remove dependency to network-online.target now that gethostname
  is used in kvp_daemon (bsc#1174443, bsc#1174444)
- Reopen the devices if read() or write() returns errors (9fc3c01a)
- Use either python2 or python3 for lsvmbus (bsc#1093910)
- Remove sysv init scripts</changelog>
  <changelog author="ohering@suse.de" date="1597924800">- Allow daemon restart again (bsc#1116957)
  Since some time the kernel moved from netlink sockets to char
  devices, which is supposed to handle a connection reopen for the
  kernel&lt;-&gt;daemon interface</changelog>
</package>
<package pkgid="988fc34140db1874f8a042cd505110a582d240135dbdfc05aaafba49fdac238c" name="ipset" arch="aarch64">
  <version epoch="0" ver="7.15" rel="150400.12.3.2"/>
  <changelog author="jengelh@inai.de" date="1505649600">- Update to new upstream release 6.33
  * Report if the option is supported by a newer kernel release
- Add ipset-6.33-export-func.diff</changelog>
  <changelog author="jengelh@inai.de" date="1506168000">- Update to new upstream release 6.34
  * Reset state after a command failed, when multiple ones
    are issued.
  * Handle padding attribute properly in userspace.
  * Test to check the fix to add an IPv4 range containing more
    than 2^31 addresses.
- Remove ipset-6.33-export-func.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1515240000">- Update to new upstream release 6.35
  * Userspace revision handling is reworked
  * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked
  * Missing nfnl_lock()/nfnl_unlock() is added to
    ip_set_net_exit()
  * netfilter: ipset: add resched points during set listing
  * Fix "don't update counters" mode when counters used at the
    matching
  * netfilter: ipset: Fix race between dump and swap</changelog>
  <changelog author="jengelh@inai.de" date="1516622400">- Add 0001-build-do-install-libipset-args.h.patch [boo#1077037].</changelog>
  <changelog author="jengelh@inai.de" date="1520078400">- Update to new upstream release 6.36
  * Adding a IPv4 range x.x.x.x?255.255.255.255 could lead to
    memory exhaustion, which has been fixed.
- Drop 0001-build-do-install-libipset-args.h.patch (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1523361600">- Update to new upstream release 6.38
  * Fix parsing service names for ports.</changelog>
  <changelog author="jengelh@inai.de" date="1540900800">- Update to new upstream release 7.0
  * A new internal protocol version between the kernel and
    userspace is used. This is required in order to support two
    new functions and the extendend LIST operation, which makes
    possible to run ipset in every case entirely over netlink,
    without the need to use getsockopt().
  * The userspace library was reworked so it can be embedded
    without calling the binary.</changelog>
  <changelog author="suse+build@de-korte.org" date="1542715200">- Add ipset-file.diff [boo#1116432].</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Update to new upstream release 7.1
  * Correct the manpage about the sort option
  * Implement sorting for hash types in the ipset tool
  * Fix to list/save into file specified by option
- Remove ipset-file.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1560168000">- Update to new upstream release 7.2
  * ipset: Fix memory accounting for hash types on resize</changelog>
  <changelog author="jengelh@inai.de" date="1566216000">- Update to new upstream release 7.3
  * Fix rename concurrency with listing, which can result broken
    list/save results.
  * ipset: Copy the right MAC address in bitmap:ip,mac and
    hash:ip,mac sets.
  * ipset: Actually allow destination MAC address for hash:ip,mac
    sets too.</changelog>
  <changelog author="jengelh@inai.de" date="1572609600">- Update to release 7.4
  * Wildcard support for the "hash:net,iface" type.</changelog>
  <changelog author="jengelh@inai.de" date="1578657600">- Update to release 7.5
  * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO
    is present.
  * netfilter: xt_set: Do not restrict --map-set to the
    mangle table.</changelog>
  <changelog author="jengelh@inai.de" date="1582545600">- Update to release 7.6
  * Add checking system_power_efficient_wq in the source tree.</changelog>
  <changelog author="jengelh@inai.de" date="1605787200">- Update to release 7.9
  * Enable memory accounting for ipset allocations
  * Expose the initval hash parameter to userspace
  * Add bucketsize parameter to all hash types
  * Support the -exist flag with the destroy command</changelog>
  <changelog author="jengelh@inai.de" date="1608465600">- Update to release 7.10
  * Fix shift-out-of-bounds in htable_bits()</changelog>
  <changelog author="jengelh@inai.de" date="1613736000">- Update to release 7.11
  * Argument parsing buffer overflow in ipset_parse_argv fixed</changelog>
  <changelog author="jengelh@inai.de" date="1627473600">- Update to release 7.14
  * Allow specifying protocols by number
  * Limit the maximum range of consecutive elements to add/delete</changelog>
  <changelog author="info@paolostivanin.com" date="1628078400">- Update to release 7.15
  * netfilter: ipset: Fix maximal range check in
    hash_ipportnet4_uadt()</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667563200">- Tumbleweed is not affected by the following SLE issues:
  bsc#1122853</changelog>
</package>
<package pkgid="a5c090849b11a1940f334dbe30e449a57e32e725e4e709ca664c053e2addd74b" name="ipset" arch="ppc64le">
  <version epoch="0" ver="7.15" rel="150400.12.3.2"/>
  <changelog author="jengelh@inai.de" date="1505649600">- Update to new upstream release 6.33
  * Report if the option is supported by a newer kernel release
- Add ipset-6.33-export-func.diff</changelog>
  <changelog author="jengelh@inai.de" date="1506168000">- Update to new upstream release 6.34
  * Reset state after a command failed, when multiple ones
    are issued.
  * Handle padding attribute properly in userspace.
  * Test to check the fix to add an IPv4 range containing more
    than 2^31 addresses.
- Remove ipset-6.33-export-func.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1515240000">- Update to new upstream release 6.35
  * Userspace revision handling is reworked
  * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked
  * Missing nfnl_lock()/nfnl_unlock() is added to
    ip_set_net_exit()
  * netfilter: ipset: add resched points during set listing
  * Fix "don't update counters" mode when counters used at the
    matching
  * netfilter: ipset: Fix race between dump and swap</changelog>
  <changelog author="jengelh@inai.de" date="1516622400">- Add 0001-build-do-install-libipset-args.h.patch [boo#1077037].</changelog>
  <changelog author="jengelh@inai.de" date="1520078400">- Update to new upstream release 6.36
  * Adding a IPv4 range x.x.x.x?255.255.255.255 could lead to
    memory exhaustion, which has been fixed.
- Drop 0001-build-do-install-libipset-args.h.patch (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1523361600">- Update to new upstream release 6.38
  * Fix parsing service names for ports.</changelog>
  <changelog author="jengelh@inai.de" date="1540900800">- Update to new upstream release 7.0
  * A new internal protocol version between the kernel and
    userspace is used. This is required in order to support two
    new functions and the extendend LIST operation, which makes
    possible to run ipset in every case entirely over netlink,
    without the need to use getsockopt().
  * The userspace library was reworked so it can be embedded
    without calling the binary.</changelog>
  <changelog author="suse+build@de-korte.org" date="1542715200">- Add ipset-file.diff [boo#1116432].</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Update to new upstream release 7.1
  * Correct the manpage about the sort option
  * Implement sorting for hash types in the ipset tool
  * Fix to list/save into file specified by option
- Remove ipset-file.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1560168000">- Update to new upstream release 7.2
  * ipset: Fix memory accounting for hash types on resize</changelog>
  <changelog author="jengelh@inai.de" date="1566216000">- Update to new upstream release 7.3
  * Fix rename concurrency with listing, which can result broken
    list/save results.
  * ipset: Copy the right MAC address in bitmap:ip,mac and
    hash:ip,mac sets.
  * ipset: Actually allow destination MAC address for hash:ip,mac
    sets too.</changelog>
  <changelog author="jengelh@inai.de" date="1572609600">- Update to release 7.4
  * Wildcard support for the "hash:net,iface" type.</changelog>
  <changelog author="jengelh@inai.de" date="1578657600">- Update to release 7.5
  * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO
    is present.
  * netfilter: xt_set: Do not restrict --map-set to the
    mangle table.</changelog>
  <changelog author="jengelh@inai.de" date="1582545600">- Update to release 7.6
  * Add checking system_power_efficient_wq in the source tree.</changelog>
  <changelog author="jengelh@inai.de" date="1605787200">- Update to release 7.9
  * Enable memory accounting for ipset allocations
  * Expose the initval hash parameter to userspace
  * Add bucketsize parameter to all hash types
  * Support the -exist flag with the destroy command</changelog>
  <changelog author="jengelh@inai.de" date="1608465600">- Update to release 7.10
  * Fix shift-out-of-bounds in htable_bits()</changelog>
  <changelog author="jengelh@inai.de" date="1613736000">- Update to release 7.11
  * Argument parsing buffer overflow in ipset_parse_argv fixed</changelog>
  <changelog author="jengelh@inai.de" date="1627473600">- Update to release 7.14
  * Allow specifying protocols by number
  * Limit the maximum range of consecutive elements to add/delete</changelog>
  <changelog author="info@paolostivanin.com" date="1628078400">- Update to release 7.15
  * netfilter: ipset: Fix maximal range check in
    hash_ipportnet4_uadt()</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667563200">- Tumbleweed is not affected by the following SLE issues:
  bsc#1122853</changelog>
</package>
<package pkgid="61077855e7d725827e6977fd98390291a46822d2ef60be40ee3b2f845a9fd88c" name="ipset" arch="s390x">
  <version epoch="0" ver="7.15" rel="150400.12.3.2"/>
  <changelog author="jengelh@inai.de" date="1505649600">- Update to new upstream release 6.33
  * Report if the option is supported by a newer kernel release
- Add ipset-6.33-export-func.diff</changelog>
  <changelog author="jengelh@inai.de" date="1506168000">- Update to new upstream release 6.34
  * Reset state after a command failed, when multiple ones
    are issued.
  * Handle padding attribute properly in userspace.
  * Test to check the fix to add an IPv4 range containing more
    than 2^31 addresses.
- Remove ipset-6.33-export-func.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1515240000">- Update to new upstream release 6.35
  * Userspace revision handling is reworked
  * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked
  * Missing nfnl_lock()/nfnl_unlock() is added to
    ip_set_net_exit()
  * netfilter: ipset: add resched points during set listing
  * Fix "don't update counters" mode when counters used at the
    matching
  * netfilter: ipset: Fix race between dump and swap</changelog>
  <changelog author="jengelh@inai.de" date="1516622400">- Add 0001-build-do-install-libipset-args.h.patch [boo#1077037].</changelog>
  <changelog author="jengelh@inai.de" date="1520078400">- Update to new upstream release 6.36
  * Adding a IPv4 range x.x.x.x?255.255.255.255 could lead to
    memory exhaustion, which has been fixed.
- Drop 0001-build-do-install-libipset-args.h.patch (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1523361600">- Update to new upstream release 6.38
  * Fix parsing service names for ports.</changelog>
  <changelog author="jengelh@inai.de" date="1540900800">- Update to new upstream release 7.0
  * A new internal protocol version between the kernel and
    userspace is used. This is required in order to support two
    new functions and the extendend LIST operation, which makes
    possible to run ipset in every case entirely over netlink,
    without the need to use getsockopt().
  * The userspace library was reworked so it can be embedded
    without calling the binary.</changelog>
  <changelog author="suse+build@de-korte.org" date="1542715200">- Add ipset-file.diff [boo#1116432].</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Update to new upstream release 7.1
  * Correct the manpage about the sort option
  * Implement sorting for hash types in the ipset tool
  * Fix to list/save into file specified by option
- Remove ipset-file.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1560168000">- Update to new upstream release 7.2
  * ipset: Fix memory accounting for hash types on resize</changelog>
  <changelog author="jengelh@inai.de" date="1566216000">- Update to new upstream release 7.3
  * Fix rename concurrency with listing, which can result broken
    list/save results.
  * ipset: Copy the right MAC address in bitmap:ip,mac and
    hash:ip,mac sets.
  * ipset: Actually allow destination MAC address for hash:ip,mac
    sets too.</changelog>
  <changelog author="jengelh@inai.de" date="1572609600">- Update to release 7.4
  * Wildcard support for the "hash:net,iface" type.</changelog>
  <changelog author="jengelh@inai.de" date="1578657600">- Update to release 7.5
  * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO
    is present.
  * netfilter: xt_set: Do not restrict --map-set to the
    mangle table.</changelog>
  <changelog author="jengelh@inai.de" date="1582545600">- Update to release 7.6
  * Add checking system_power_efficient_wq in the source tree.</changelog>
  <changelog author="jengelh@inai.de" date="1605787200">- Update to release 7.9
  * Enable memory accounting for ipset allocations
  * Expose the initval hash parameter to userspace
  * Add bucketsize parameter to all hash types
  * Support the -exist flag with the destroy command</changelog>
  <changelog author="jengelh@inai.de" date="1608465600">- Update to release 7.10
  * Fix shift-out-of-bounds in htable_bits()</changelog>
  <changelog author="jengelh@inai.de" date="1613736000">- Update to release 7.11
  * Argument parsing buffer overflow in ipset_parse_argv fixed</changelog>
  <changelog author="jengelh@inai.de" date="1627473600">- Update to release 7.14
  * Allow specifying protocols by number
  * Limit the maximum range of consecutive elements to add/delete</changelog>
  <changelog author="info@paolostivanin.com" date="1628078400">- Update to release 7.15
  * netfilter: ipset: Fix maximal range check in
    hash_ipportnet4_uadt()</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667563200">- Tumbleweed is not affected by the following SLE issues:
  bsc#1122853</changelog>
</package>
<package pkgid="c648e01ee27f3bbb2933a4ab7aa01ff9949900482242d403ad33429cd25b97fd" name="ipset" arch="src">
  <version epoch="0" ver="7.15" rel="150400.12.3.2"/>
  <changelog author="jengelh@inai.de" date="1505649600">- Update to new upstream release 6.33
  * Report if the option is supported by a newer kernel release
- Add ipset-6.33-export-func.diff</changelog>
  <changelog author="jengelh@inai.de" date="1506168000">- Update to new upstream release 6.34
  * Reset state after a command failed, when multiple ones
    are issued.
  * Handle padding attribute properly in userspace.
  * Test to check the fix to add an IPv4 range containing more
    than 2^31 addresses.
- Remove ipset-6.33-export-func.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1515240000">- Update to new upstream release 6.35
  * Userspace revision handling is reworked
  * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked
  * Missing nfnl_lock()/nfnl_unlock() is added to
    ip_set_net_exit()
  * netfilter: ipset: add resched points during set listing
  * Fix "don't update counters" mode when counters used at the
    matching
  * netfilter: ipset: Fix race between dump and swap</changelog>
  <changelog author="jengelh@inai.de" date="1516622400">- Add 0001-build-do-install-libipset-args.h.patch [boo#1077037].</changelog>
  <changelog author="jengelh@inai.de" date="1520078400">- Update to new upstream release 6.36
  * Adding a IPv4 range x.x.x.x?255.255.255.255 could lead to
    memory exhaustion, which has been fixed.
- Drop 0001-build-do-install-libipset-args.h.patch (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1523361600">- Update to new upstream release 6.38
  * Fix parsing service names for ports.</changelog>
  <changelog author="jengelh@inai.de" date="1540900800">- Update to new upstream release 7.0
  * A new internal protocol version between the kernel and
    userspace is used. This is required in order to support two
    new functions and the extendend LIST operation, which makes
    possible to run ipset in every case entirely over netlink,
    without the need to use getsockopt().
  * The userspace library was reworked so it can be embedded
    without calling the binary.</changelog>
  <changelog author="suse+build@de-korte.org" date="1542715200">- Add ipset-file.diff [boo#1116432].</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Update to new upstream release 7.1
  * Correct the manpage about the sort option
  * Implement sorting for hash types in the ipset tool
  * Fix to list/save into file specified by option
- Remove ipset-file.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1560168000">- Update to new upstream release 7.2
  * ipset: Fix memory accounting for hash types on resize</changelog>
  <changelog author="jengelh@inai.de" date="1566216000">- Update to new upstream release 7.3
  * Fix rename concurrency with listing, which can result broken
    list/save results.
  * ipset: Copy the right MAC address in bitmap:ip,mac and
    hash:ip,mac sets.
  * ipset: Actually allow destination MAC address for hash:ip,mac
    sets too.</changelog>
  <changelog author="jengelh@inai.de" date="1572609600">- Update to release 7.4
  * Wildcard support for the "hash:net,iface" type.</changelog>
  <changelog author="jengelh@inai.de" date="1578657600">- Update to release 7.5
  * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO
    is present.
  * netfilter: xt_set: Do not restrict --map-set to the
    mangle table.</changelog>
  <changelog author="jengelh@inai.de" date="1582545600">- Update to release 7.6
  * Add checking system_power_efficient_wq in the source tree.</changelog>
  <changelog author="jengelh@inai.de" date="1605787200">- Update to release 7.9
  * Enable memory accounting for ipset allocations
  * Expose the initval hash parameter to userspace
  * Add bucketsize parameter to all hash types
  * Support the -exist flag with the destroy command</changelog>
  <changelog author="jengelh@inai.de" date="1608465600">- Update to release 7.10
  * Fix shift-out-of-bounds in htable_bits()</changelog>
  <changelog author="jengelh@inai.de" date="1613736000">- Update to release 7.11
  * Argument parsing buffer overflow in ipset_parse_argv fixed</changelog>
  <changelog author="jengelh@inai.de" date="1627473600">- Update to release 7.14
  * Allow specifying protocols by number
  * Limit the maximum range of consecutive elements to add/delete</changelog>
  <changelog author="info@paolostivanin.com" date="1628078400">- Update to release 7.15
  * netfilter: ipset: Fix maximal range check in
    hash_ipportnet4_uadt()</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667563200">- Tumbleweed is not affected by the following SLE issues:
  bsc#1122853</changelog>
</package>
<package pkgid="d28a5ba3e572d97557b159e154c8342d5afe9e4c0310c9b9b1a4bfc0201c8c40" name="ipset" arch="x86_64">
  <version epoch="0" ver="7.15" rel="150400.12.3.2"/>
  <changelog author="jengelh@inai.de" date="1505649600">- Update to new upstream release 6.33
  * Report if the option is supported by a newer kernel release
- Add ipset-6.33-export-func.diff</changelog>
  <changelog author="jengelh@inai.de" date="1506168000">- Update to new upstream release 6.34
  * Reset state after a command failed, when multiple ones
    are issued.
  * Handle padding attribute properly in userspace.
  * Test to check the fix to add an IPv4 range containing more
    than 2^31 addresses.
- Remove ipset-6.33-export-func.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1515240000">- Update to new upstream release 6.35
  * Userspace revision handling is reworked
  * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked
  * Missing nfnl_lock()/nfnl_unlock() is added to
    ip_set_net_exit()
  * netfilter: ipset: add resched points during set listing
  * Fix "don't update counters" mode when counters used at the
    matching
  * netfilter: ipset: Fix race between dump and swap</changelog>
  <changelog author="jengelh@inai.de" date="1516622400">- Add 0001-build-do-install-libipset-args.h.patch [boo#1077037].</changelog>
  <changelog author="jengelh@inai.de" date="1520078400">- Update to new upstream release 6.36
  * Adding a IPv4 range x.x.x.x?255.255.255.255 could lead to
    memory exhaustion, which has been fixed.
- Drop 0001-build-do-install-libipset-args.h.patch (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1523361600">- Update to new upstream release 6.38
  * Fix parsing service names for ports.</changelog>
  <changelog author="jengelh@inai.de" date="1540900800">- Update to new upstream release 7.0
  * A new internal protocol version between the kernel and
    userspace is used. This is required in order to support two
    new functions and the extendend LIST operation, which makes
    possible to run ipset in every case entirely over netlink,
    without the need to use getsockopt().
  * The userspace library was reworked so it can be embedded
    without calling the binary.</changelog>
  <changelog author="suse+build@de-korte.org" date="1542715200">- Add ipset-file.diff [boo#1116432].</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Update to new upstream release 7.1
  * Correct the manpage about the sort option
  * Implement sorting for hash types in the ipset tool
  * Fix to list/save into file specified by option
- Remove ipset-file.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1560168000">- Update to new upstream release 7.2
  * ipset: Fix memory accounting for hash types on resize</changelog>
  <changelog author="jengelh@inai.de" date="1566216000">- Update to new upstream release 7.3
  * Fix rename concurrency with listing, which can result broken
    list/save results.
  * ipset: Copy the right MAC address in bitmap:ip,mac and
    hash:ip,mac sets.
  * ipset: Actually allow destination MAC address for hash:ip,mac
    sets too.</changelog>
  <changelog author="jengelh@inai.de" date="1572609600">- Update to release 7.4
  * Wildcard support for the "hash:net,iface" type.</changelog>
  <changelog author="jengelh@inai.de" date="1578657600">- Update to release 7.5
  * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO
    is present.
  * netfilter: xt_set: Do not restrict --map-set to the
    mangle table.</changelog>
  <changelog author="jengelh@inai.de" date="1582545600">- Update to release 7.6
  * Add checking system_power_efficient_wq in the source tree.</changelog>
  <changelog author="jengelh@inai.de" date="1605787200">- Update to release 7.9
  * Enable memory accounting for ipset allocations
  * Expose the initval hash parameter to userspace
  * Add bucketsize parameter to all hash types
  * Support the -exist flag with the destroy command</changelog>
  <changelog author="jengelh@inai.de" date="1608465600">- Update to release 7.10
  * Fix shift-out-of-bounds in htable_bits()</changelog>
  <changelog author="jengelh@inai.de" date="1613736000">- Update to release 7.11
  * Argument parsing buffer overflow in ipset_parse_argv fixed</changelog>
  <changelog author="jengelh@inai.de" date="1627473600">- Update to release 7.14
  * Allow specifying protocols by number
  * Limit the maximum range of consecutive elements to add/delete</changelog>
  <changelog author="info@paolostivanin.com" date="1628078400">- Update to release 7.15
  * netfilter: ipset: Fix maximal range check in
    hash_ipportnet4_uadt()</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667563200">- Tumbleweed is not affected by the following SLE issues:
  bsc#1122853</changelog>
</package>
<package pkgid="fe718adf9a62afda1a99109bdcbf8b60f742fcb52284d1187d15798b853ae4d9" name="iputils" arch="aarch64">
  <version epoch="0" ver="20211215" rel="150400.3.3.2"/>
  <changelog author="pvorel@suse.cz" date="1558699200">- Update to version s20190515 (includes changes s20190324)
  * s20190324: 189 commits since s20180629 that include changing build
    system from autotools to meson, added rarpd and rdisc systemd service
    files, many fixes
  * s20190515 bugfix release (6 commits)
- User visible change: arping and clockdiff are moved from /usr/sbin
  to /usr/bin (respect upstream path)
- Backport patch 0001-build-sys-doc-Fix-the-dependency-on-xsltproc.patch
  (fixing build system)
- Add workaround patch meson-remove-setcap-setuid.sh.patch
- Remove 0001-tracepath-Fix-copying-input-IPv6-address.patch
  (included in s20190324 release)
- Refresh old patches (iputils-ping-interrupt.diff, iputils-sec-ping-unblock.diff)
- Changes caused by upstream switching to meson build system (drop sed build dependency)
- Added locales
- Fix typos</changelog>
  <changelog author="pvorel@suse.cz" date="1560513600">- Add patch ping-Fix-unwanted-bell-on-unreachable-address.patch (boo#1135118)</changelog>
  <changelog author="pvorel@suse.cz" date="1562760000">- Update to version s20190709
- Removed patches included in this upstream release:
  ping-Fix-unwanted-bell-on-unreachable-address.patch
  0001-build-sys-doc-Fix-the-dependency-on-xsltproc.patch
  meson-remove-setcap-setuid.sh.patch
- Add libcap-progs as a build dependency (setcap is needed)</changelog>
  <changelog author="pvorel@suse.cz" date="1564142400">- Set caps for clockdiff (boo#1140994), based on change in permissions package
  https://github.com/openSUSE/permissions/commit/5da6a81e38bb74f2090d73208b1a0101a0c5b73b
- With new permissions package both clockdiff and ping have capabilities
  cap_net_raw+p instead of cap_net_raw+ep (boo#1140993), also ping6 does not
  try to set permissions on links (boo#1140991)
- Pass -DNO_SETCAP_OR_SUID=true (don't run setcap via distro script
  build-aux/setcap-setuid.sh, we set capabilities with rpm)</changelog>
  <changelog author="mwilck@suse.com" date="1566302400">- Fix arping -D problem (bsc#1146440)
  * added arping-revert-partially-fix-sent-vs-received-package.patch
  (upstream commit 18f14be)</changelog>
  <changelog author="pvorel@suse.cz" date="1567771200">- Fix arping -w problem (https://github.com/iputils/iputils/issues/211)
  * added arping-fix-f-quit-on-first-reply-regression.patch
  (upstream commit 1df5350)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1594555200">- remove unneeded libidn build dependency (boo#1174049)</changelog>
  <changelog author="pvorel@suse.cz" date="1597406400">- Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff)
  Although not documented, they both belong to bsc#674304. Fix from 2011 was
  resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on
  start-up.") [1], released in s20121112.
- Use %autosetup -p1</changelog>
  <changelog author="pvorel@suse.cz" date="1598270400">- Update to version s20200821
  https://github.com/iputils/iputils/releases/tag/s20200821
- Remove BuildRequires libopenssl-devel (added md5 implementation thus not needed)
- Remove patches from this release
  (arping-revert-partially-fix-sent-vs-received-package.patch,
  arping-fix-f-quit-on-first-reply-regression.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1602072000">- No longer invoke permissions macros for ping. It now uses ICMP_PROTO sockets
  (bsc#1174504).</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="dimstar@opensuse.org" date="1603108800">- Reference meson's build subdirectory as %_vpath_builddir, to
  line up with meson's structure.</changelog>
  <changelog author="pvorel@suse.cz" date="1612267200">- Update to version 20210202
  https://github.com/iputils/iputils/releases/tag/20210202
- Version scheme change: dropped leading 's', update that change</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1615896000">- Binaries were found to be not optimized or built
  with proper %optflags.</changelog>
  <changelog author="pvorel@suse.cz" date="1626955200">- Update to version 20210722
  https://github.com/iputils/iputils/releases/tag/20210722
- Use rarpd.service from upstream (removes PrivateUsers=yes, which fixes broken
  start of the service, adds DynamicUser=yes for more security)
- Add BuildRequires:  iproute2 (required for running tests)</changelog>
  <changelog author="jsegitz@suse.com" date="1632312000">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_rdisc.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="pvorel@suse.cz" date="1639569600">- Update to version 20211215
  https://github.com/iputils/iputils/releases/tag/20211215
- rarpd and rdisc are going to be removed in next release
  (https://github.com/iputils/iputils/issues/363)
  therefore don't pack it since this release
- Drop harden_rdisc.service.patch, which was 1) merged upstream
  4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs")
  for all services
  2) we don't build rdisc since this release</changelog>
  <changelog author="pgajdos@suse.com" date="1643112000">- temporarily reintroduce rarpd and rdisc tools to get them into
  15sp4 [jsc#SLE-23521]</changelog>
  <changelog author="pvorel@suse.cz" date="1667908800">- Backport 2 fixes for bsc#1203957:
  0001-ping-Add-SA_RESTART-to-sa_flags.patch
  0002-ping-Make-ping_rts-struct-static.patch</changelog>
</package>
<package pkgid="f48090f67359bad646f557416e6f8cbbb261a60c24f4a3b959b799d678acc935" name="iputils" arch="src">
  <version epoch="0" ver="20211215" rel="150400.3.3.2"/>
  <changelog author="pvorel@suse.cz" date="1558699200">- Update to version s20190515 (includes changes s20190324)
  * s20190324: 189 commits since s20180629 that include changing build
    system from autotools to meson, added rarpd and rdisc systemd service
    files, many fixes
  * s20190515 bugfix release (6 commits)
- User visible change: arping and clockdiff are moved from /usr/sbin
  to /usr/bin (respect upstream path)
- Backport patch 0001-build-sys-doc-Fix-the-dependency-on-xsltproc.patch
  (fixing build system)
- Add workaround patch meson-remove-setcap-setuid.sh.patch
- Remove 0001-tracepath-Fix-copying-input-IPv6-address.patch
  (included in s20190324 release)
- Refresh old patches (iputils-ping-interrupt.diff, iputils-sec-ping-unblock.diff)
- Changes caused by upstream switching to meson build system (drop sed build dependency)
- Added locales
- Fix typos</changelog>
  <changelog author="pvorel@suse.cz" date="1560513600">- Add patch ping-Fix-unwanted-bell-on-unreachable-address.patch (boo#1135118)</changelog>
  <changelog author="pvorel@suse.cz" date="1562760000">- Update to version s20190709
- Removed patches included in this upstream release:
  ping-Fix-unwanted-bell-on-unreachable-address.patch
  0001-build-sys-doc-Fix-the-dependency-on-xsltproc.patch
  meson-remove-setcap-setuid.sh.patch
- Add libcap-progs as a build dependency (setcap is needed)</changelog>
  <changelog author="pvorel@suse.cz" date="1564142400">- Set caps for clockdiff (boo#1140994), based on change in permissions package
  https://github.com/openSUSE/permissions/commit/5da6a81e38bb74f2090d73208b1a0101a0c5b73b
- With new permissions package both clockdiff and ping have capabilities
  cap_net_raw+p instead of cap_net_raw+ep (boo#1140993), also ping6 does not
  try to set permissions on links (boo#1140991)
- Pass -DNO_SETCAP_OR_SUID=true (don't run setcap via distro script
  build-aux/setcap-setuid.sh, we set capabilities with rpm)</changelog>
  <changelog author="mwilck@suse.com" date="1566302400">- Fix arping -D problem (bsc#1146440)
  * added arping-revert-partially-fix-sent-vs-received-package.patch
  (upstream commit 18f14be)</changelog>
  <changelog author="pvorel@suse.cz" date="1567771200">- Fix arping -w problem (https://github.com/iputils/iputils/issues/211)
  * added arping-fix-f-quit-on-first-reply-regression.patch
  (upstream commit 1df5350)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1594555200">- remove unneeded libidn build dependency (boo#1174049)</changelog>
  <changelog author="pvorel@suse.cz" date="1597406400">- Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff)
  Although not documented, they both belong to bsc#674304. Fix from 2011 was
  resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on
  start-up.") [1], released in s20121112.
- Use %autosetup -p1</changelog>
  <changelog author="pvorel@suse.cz" date="1598270400">- Update to version s20200821
  https://github.com/iputils/iputils/releases/tag/s20200821
- Remove BuildRequires libopenssl-devel (added md5 implementation thus not needed)
- Remove patches from this release
  (arping-revert-partially-fix-sent-vs-received-package.patch,
  arping-fix-f-quit-on-first-reply-regression.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1602072000">- No longer invoke permissions macros for ping. It now uses ICMP_PROTO sockets
  (bsc#1174504).</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="dimstar@opensuse.org" date="1603108800">- Reference meson's build subdirectory as %_vpath_builddir, to
  line up with meson's structure.</changelog>
  <changelog author="pvorel@suse.cz" date="1612267200">- Update to version 20210202
  https://github.com/iputils/iputils/releases/tag/20210202
- Version scheme change: dropped leading 's', update that change</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1615896000">- Binaries were found to be not optimized or built
  with proper %optflags.</changelog>
  <changelog author="pvorel@suse.cz" date="1626955200">- Update to version 20210722
  https://github.com/iputils/iputils/releases/tag/20210722
- Use rarpd.service from upstream (removes PrivateUsers=yes, which fixes broken
  start of the service, adds DynamicUser=yes for more security)
- Add BuildRequires:  iproute2 (required for running tests)</changelog>
  <changelog author="jsegitz@suse.com" date="1632312000">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_rdisc.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="pvorel@suse.cz" date="1639569600">- Update to version 20211215
  https://github.com/iputils/iputils/releases/tag/20211215
- rarpd and rdisc are going to be removed in next release
  (https://github.com/iputils/iputils/issues/363)
  therefore don't pack it since this release
- Drop harden_rdisc.service.patch, which was 1) merged upstream
  4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs")
  for all services
  2) we don't build rdisc since this release</changelog>
  <changelog author="pgajdos@suse.com" date="1643112000">- temporarily reintroduce rarpd and rdisc tools to get them into
  15sp4 [jsc#SLE-23521]</changelog>
  <changelog author="pvorel@suse.cz" date="1667908800">- Backport 2 fixes for bsc#1203957:
  0001-ping-Add-SA_RESTART-to-sa_flags.patch
  0002-ping-Make-ping_rts-struct-static.patch</changelog>
</package>
<package pkgid="eabc9bc884f6357154cc5b85093611776ecf75aa98619e19b4b30a951bbb3356" name="iputils" arch="x86_64">
  <version epoch="0" ver="20211215" rel="150400.3.3.2"/>
  <changelog author="pvorel@suse.cz" date="1558699200">- Update to version s20190515 (includes changes s20190324)
  * s20190324: 189 commits since s20180629 that include changing build
    system from autotools to meson, added rarpd and rdisc systemd service
    files, many fixes
  * s20190515 bugfix release (6 commits)
- User visible change: arping and clockdiff are moved from /usr/sbin
  to /usr/bin (respect upstream path)
- Backport patch 0001-build-sys-doc-Fix-the-dependency-on-xsltproc.patch
  (fixing build system)
- Add workaround patch meson-remove-setcap-setuid.sh.patch
- Remove 0001-tracepath-Fix-copying-input-IPv6-address.patch
  (included in s20190324 release)
- Refresh old patches (iputils-ping-interrupt.diff, iputils-sec-ping-unblock.diff)
- Changes caused by upstream switching to meson build system (drop sed build dependency)
- Added locales
- Fix typos</changelog>
  <changelog author="pvorel@suse.cz" date="1560513600">- Add patch ping-Fix-unwanted-bell-on-unreachable-address.patch (boo#1135118)</changelog>
  <changelog author="pvorel@suse.cz" date="1562760000">- Update to version s20190709
- Removed patches included in this upstream release:
  ping-Fix-unwanted-bell-on-unreachable-address.patch
  0001-build-sys-doc-Fix-the-dependency-on-xsltproc.patch
  meson-remove-setcap-setuid.sh.patch
- Add libcap-progs as a build dependency (setcap is needed)</changelog>
  <changelog author="pvorel@suse.cz" date="1564142400">- Set caps for clockdiff (boo#1140994), based on change in permissions package
  https://github.com/openSUSE/permissions/commit/5da6a81e38bb74f2090d73208b1a0101a0c5b73b
- With new permissions package both clockdiff and ping have capabilities
  cap_net_raw+p instead of cap_net_raw+ep (boo#1140993), also ping6 does not
  try to set permissions on links (boo#1140991)
- Pass -DNO_SETCAP_OR_SUID=true (don't run setcap via distro script
  build-aux/setcap-setuid.sh, we set capabilities with rpm)</changelog>
  <changelog author="mwilck@suse.com" date="1566302400">- Fix arping -D problem (bsc#1146440)
  * added arping-revert-partially-fix-sent-vs-received-package.patch
  (upstream commit 18f14be)</changelog>
  <changelog author="pvorel@suse.cz" date="1567771200">- Fix arping -w problem (https://github.com/iputils/iputils/issues/211)
  * added arping-fix-f-quit-on-first-reply-regression.patch
  (upstream commit 1df5350)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1594555200">- remove unneeded libidn build dependency (boo#1174049)</changelog>
  <changelog author="pvorel@suse.cz" date="1597406400">- Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff)
  Although not documented, they both belong to bsc#674304. Fix from 2011 was
  resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on
  start-up.") [1], released in s20121112.
- Use %autosetup -p1</changelog>
  <changelog author="pvorel@suse.cz" date="1598270400">- Update to version s20200821
  https://github.com/iputils/iputils/releases/tag/s20200821
- Remove BuildRequires libopenssl-devel (added md5 implementation thus not needed)
- Remove patches from this release
  (arping-revert-partially-fix-sent-vs-received-package.patch,
  arping-fix-f-quit-on-first-reply-regression.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1602072000">- No longer invoke permissions macros for ping. It now uses ICMP_PROTO sockets
  (bsc#1174504).</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="dimstar@opensuse.org" date="1603108800">- Reference meson's build subdirectory as %_vpath_builddir, to
  line up with meson's structure.</changelog>
  <changelog author="pvorel@suse.cz" date="1612267200">- Update to version 20210202
  https://github.com/iputils/iputils/releases/tag/20210202
- Version scheme change: dropped leading 's', update that change</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1615896000">- Binaries were found to be not optimized or built
  with proper %optflags.</changelog>
  <changelog author="pvorel@suse.cz" date="1626955200">- Update to version 20210722
  https://github.com/iputils/iputils/releases/tag/20210722
- Use rarpd.service from upstream (removes PrivateUsers=yes, which fixes broken
  start of the service, adds DynamicUser=yes for more security)
- Add BuildRequires:  iproute2 (required for running tests)</changelog>
  <changelog author="jsegitz@suse.com" date="1632312000">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_rdisc.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="pvorel@suse.cz" date="1639569600">- Update to version 20211215
  https://github.com/iputils/iputils/releases/tag/20211215
- rarpd and rdisc are going to be removed in next release
  (https://github.com/iputils/iputils/issues/363)
  therefore don't pack it since this release
- Drop harden_rdisc.service.patch, which was 1) merged upstream
  4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs")
  for all services
  2) we don't build rdisc since this release</changelog>
  <changelog author="pgajdos@suse.com" date="1643112000">- temporarily reintroduce rarpd and rdisc tools to get them into
  15sp4 [jsc#SLE-23521]</changelog>
  <changelog author="pvorel@suse.cz" date="1667908800">- Backport 2 fixes for bsc#1203957:
  0001-ping-Add-SA_RESTART-to-sa_flags.patch
  0002-ping-Make-ping_rts-struct-static.patch</changelog>
</package>
<package pkgid="ce96d6ce372af3a6b26e84ec43aa3b14bf8e75f6198135260e8f185e0c11c2a6" name="irqbalance" arch="aarch64">
  <version epoch="0" ver="1.8.0.18.git+2435e8d" rel="150400.3.5.1"/>
  <changelog author="fschnizlein@suse.com" date="1488369600">- Remove superfluous comment out man package packing</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="egotthold@suse.com" date="1538395200">- Removed aarch64-compile-fixes.patch because it is mainline now.
- Update to version 1.4.0:
  * Fixed an erroneous calculation of min_load that restricted candidates to a
    subset of objects
  * Fixed powerpc hotplug detection
  * Cleaned up syslog target dependency
  * Added some self test infrastructure (via make check)
- Update to version 1.3.0
  * New features in this release:
    optimization of platform device irq detection
    Added sample udev rules to trigger irq rescans on device add/remove
    Made irqbalance ui an optional compile component
    Added support for Intel CoD
    Add -v | --version option to command line
  * Bug fixes in this release:
    Misc compiler warning fixes and spelling errors
    Compilation error fix on aarch64
    Compilation error fix when using clang in c99 mode
    Unused variable cleanup
    Lots of memory leak cleanup in irqbalance-ui
    Prevent irqbalance from running in a container
    Fix irq affinity assignment in some cases to wrong numa node
    Fix oneshot mode
    exclude legacy irq 255
  * Deprecations:
    without-glib2 is removed, we just need it enough that we can't dummy it up
    anymore</changelog>
  <changelog author="trenn@suse.de" date="1538654400">- Allow compilation with SLE-12 and before by:
  * removing -std=C99 Latest compiler version does not complain
  anymore, SLE12 SPx and before did.
  * Fix a possible buffer overflow compiler warning
  A fix_buffer_overflow_compiler.patch</changelog>
  <changelog author="trenn@suse.de" date="1561982400">- Update to version 1.6.0 (b47eea84cbb93f533b0cba2f1aa):
  * fix balancing when numa information isn't available
  * Refine document about IRQBALANCE_BANNED_CPUS
  * Fix string truncation issues detected by GCC 8
  * fix socket path creation
  * Update document for option --banmod and --deepestcache
  * Fix ambiguous parsing of *node* entries in /sys.
  * procinterrupts: check xen-dyn-event more flexible
  * misc: Add an example for policy script
  * policyscript: ignore non-executable files when specifying a directory
  remove because already mainline:
  D fix_buffer_overflow_compiler.patch</changelog>
  <changelog author="jengelh@inai.de" date="1562500800">- Use noun phrase in summaries.</changelog>
  <changelog author="trenn@suse.de" date="1562846400">- Add git hash tag and date in version as source is derived from
  master/HEAD branch. Thanks to namtrac.
  This is done via _service file.
  Also add an example how to get back to a stable release version
- Update to latest git master version:
  git commit f7fdebbaa4dbc27fcdeb7</changelog>
  <changelog author="kukuk@suse.com" date="1587643200">- Use fillup_prereq macro
- Move ui into sub-package to get minimal core much smaller</changelog>
  <changelog author="fvogt@suse.com" date="1587729600">- Package COPYING and README.md
- Add some deps for the -ui subpackage</changelog>
  <changelog author="trenn@suse.de" date="1590494400">- Update to latest git HEAD version 0348a3b.
  There has been no version update for quite some time, but some
  restructuring and fixes we want to have included.
  D install-man-pages.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Corrected mis-spelling (wrong CamelCase) of "EnvironmentFile"
  in misc/irqbalance.service
  [bsc#1172665, Correct-capitalizing-in-service-file.patch]</changelog>
  <changelog author="dmueller@suse.com" date="1597579200">- update to 1.7.0:
  * Strlen checking for IRQBALANCE_BANNED_CPU env var
  * Typo cleanup in SOCKET_TMPFS
  * consolidation of numa node creation on non-numa systems
  * fix uninitialized use of package_mask in affinity setup
  * use num_online_cpus instead of core_count
  * fix a null ptr crash in do_one_cpu
  * make list searching common from glib
  * fix a calloc parameter bug
  * remove some unused variables
  * use g_list_free_full
  * remove redundant call to free_cl_opts
  * fix some resource leaks in main()
  * fix some use after free issues in check_for_irq_ban
  * fix resource leaks in irqballance-ui, and in add_one_node
- remove Correct-capitalizing-in-service-file.patch: upstream</changelog>
  <changelog author="trenn@suse.de" date="1615377600">- Update to version 1.7.0+git20210222.9db8d5c:
  * ui: fix cpu/irq menu off by one
  * fix uint64_t printf format (use PRIu64)
  * Also fetch node info for non-PCI devices
  * Add hot pull method for irqbalance
  * Add log for hotplug appropriately
  * add irq hotplug feature for irqbalance
  * Remove some unused constant macros in constants.h
  * Add a deprecation notice for IRQBALANCE_BANNED_CPUS
  * Add IRQBALANCE_BANNED_CPULIST to env file
  * log correctly for isolated and nohz_full cpus
  * Update README.md
  * Add some examples for IRQBALANCE_BANNED_CPUS
  * Adjust how we determine if a cpu is online
  * activate_mapping: activate only online CPUs
  * add env variable to ban cpus using cpulist syntax
  * put arg parsing detail into parse_command_line()
  * Updating configure script to version 1.7.0
  * Add strlen checking for IRQBALANCE_BANNED_CPUS
  * remove redundant "/" in SOCKET_TMPFS
  * Fix typo in service unit file
  * arm64: Add irq aff change check For aarch64, the PPIs format in /proc/interrputs can be parsed and add to interrupt db, and next, the number of interrupts is counted and used to calculate the load. Finally these interrupts maybe scheduled between the NUMA domains.
  * Correct typos in irqbalance.c
  * free cpu_ban_string when the next request come
  * improve irq migrate rule to avoid high irq load
  * make the option 'V' closer to the option with no arg</changelog>
  <changelog author="trenn@suse.de" date="1618315200">- Add _service file pointing to github sources
  A _service
- Update to version 1.8.0:
  * Add return value check of opendir in do_one_cpu
  * Hotplug may occur again during sleep, so wait until there is no hotplug</changelog>
  <changelog author="trenn@suse.de" date="1626091200">- Update to version 1.8.0.8.gbd5aaf5 (jsc#SLE-17697):
  * Fix comma typo in ui.c
  * drop NoNewPrivs from irqbalance service
  * remove no existing irq in banned_irqs
  * Fix compile issue with none AARCH64 builds
  * Fix irqbalance cannot obtain the full name of irq
- Enhance _service magic and add git hashtag to version</changelog>
  <changelog author="trenn@suse.de" date="1628683200">- Update to version 1.8.0.14.ga7f8148:
  * irqbalance: Check validity of numa_node
  * configure.ac: use pkg-config to find numa
  * Disable the communication socket when UI is disabled
- Use %{?systemd_ordering} instead of %{?systemd_requires}</changelog>
  <changelog author="trenn@suse.de" date="1630411200">- Update to version 1.8.0.18.git+2435e8d.obscpio:
  * fix unsigned integer subtraction sign overflow
- Make git hash in version better visable .git+&lt;githash&gt;</changelog>
  <changelog author="trenn@suse.de" date="1631102400">- Fixes integrated mainline:
  * bsc#1119461
  * bsc#1138190
  * bsc#1154905
  * bsc#1178477 bsc#1183405 (removed patches due to mainline integration):
    procinterrupts-check-xen-dyn-event-more-flexible.patch
  * bsc#1182254 bsc#1156315 (removed patches due to mainline integration):
    fix-ambiguous-parsing-of-node-entries-in-sys.patch
  * bsc#1183157
    also-fetch-node-info-for-non-PCI-devices.patch</changelog>
  <changelog author="trenn@suse.de" date="1631102401">- Update to version 1.8.0.18.git+2435e8d:
  * fix unsigned integer subtraction sign overflow
  * fix opendir fails in check_platform_device
  * irqbalance: Check validity of numa_node
  * configure.ac: use pkg-config to find numa
  * Disable the communication socket when UI is disabled
  * Fix comma typo in ui.c
  * drop NoNewPrivs from irqbalance service
  * remove no existing irq in banned_irqs
  * Fix compile issue with none AARCH64 builds</changelog>
  <changelog author="trenn@suse.de" date="1669032000">- Add mainline fixes (bnc#1204962, bsc#1206661):
  A    irqbalance-properly-check-if-irq-is-banned.patch
  A    get-irq-module-relationship-from-sys-bus-pci-driver.patch
  A    irqbalance-ui-skip-in-parse_setup-to-avoid-coredump.patch
  A    Fix-uninitialized-variable.patch</changelog>
</package>
<package pkgid="f5497a76f7c1a730c962e3e34d2579187032b3eb896d4ed7d8fcc1e2f4c6bc7a" name="irqbalance" arch="src">
  <version epoch="0" ver="1.8.0.18.git+2435e8d" rel="150400.3.5.1"/>
  <changelog author="fschnizlein@suse.com" date="1488369600">- Remove superfluous comment out man package packing</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="egotthold@suse.com" date="1538395200">- Removed aarch64-compile-fixes.patch because it is mainline now.
- Update to version 1.4.0:
  * Fixed an erroneous calculation of min_load that restricted candidates to a
    subset of objects
  * Fixed powerpc hotplug detection
  * Cleaned up syslog target dependency
  * Added some self test infrastructure (via make check)
- Update to version 1.3.0
  * New features in this release:
    optimization of platform device irq detection
    Added sample udev rules to trigger irq rescans on device add/remove
    Made irqbalance ui an optional compile component
    Added support for Intel CoD
    Add -v | --version option to command line
  * Bug fixes in this release:
    Misc compiler warning fixes and spelling errors
    Compilation error fix on aarch64
    Compilation error fix when using clang in c99 mode
    Unused variable cleanup
    Lots of memory leak cleanup in irqbalance-ui
    Prevent irqbalance from running in a container
    Fix irq affinity assignment in some cases to wrong numa node
    Fix oneshot mode
    exclude legacy irq 255
  * Deprecations:
    without-glib2 is removed, we just need it enough that we can't dummy it up
    anymore</changelog>
  <changelog author="trenn@suse.de" date="1538654400">- Allow compilation with SLE-12 and before by:
  * removing -std=C99 Latest compiler version does not complain
  anymore, SLE12 SPx and before did.
  * Fix a possible buffer overflow compiler warning
  A fix_buffer_overflow_compiler.patch</changelog>
  <changelog author="trenn@suse.de" date="1561982400">- Update to version 1.6.0 (b47eea84cbb93f533b0cba2f1aa):
  * fix balancing when numa information isn't available
  * Refine document about IRQBALANCE_BANNED_CPUS
  * Fix string truncation issues detected by GCC 8
  * fix socket path creation
  * Update document for option --banmod and --deepestcache
  * Fix ambiguous parsing of *node* entries in /sys.
  * procinterrupts: check xen-dyn-event more flexible
  * misc: Add an example for policy script
  * policyscript: ignore non-executable files when specifying a directory
  remove because already mainline:
  D fix_buffer_overflow_compiler.patch</changelog>
  <changelog author="jengelh@inai.de" date="1562500800">- Use noun phrase in summaries.</changelog>
  <changelog author="trenn@suse.de" date="1562846400">- Add git hash tag and date in version as source is derived from
  master/HEAD branch. Thanks to namtrac.
  This is done via _service file.
  Also add an example how to get back to a stable release version
- Update to latest git master version:
  git commit f7fdebbaa4dbc27fcdeb7</changelog>
  <changelog author="kukuk@suse.com" date="1587643200">- Use fillup_prereq macro
- Move ui into sub-package to get minimal core much smaller</changelog>
  <changelog author="fvogt@suse.com" date="1587729600">- Package COPYING and README.md
- Add some deps for the -ui subpackage</changelog>
  <changelog author="trenn@suse.de" date="1590494400">- Update to latest git HEAD version 0348a3b.
  There has been no version update for quite some time, but some
  restructuring and fixes we want to have included.
  D install-man-pages.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Corrected mis-spelling (wrong CamelCase) of "EnvironmentFile"
  in misc/irqbalance.service
  [bsc#1172665, Correct-capitalizing-in-service-file.patch]</changelog>
  <changelog author="dmueller@suse.com" date="1597579200">- update to 1.7.0:
  * Strlen checking for IRQBALANCE_BANNED_CPU env var
  * Typo cleanup in SOCKET_TMPFS
  * consolidation of numa node creation on non-numa systems
  * fix uninitialized use of package_mask in affinity setup
  * use num_online_cpus instead of core_count
  * fix a null ptr crash in do_one_cpu
  * make list searching common from glib
  * fix a calloc parameter bug
  * remove some unused variables
  * use g_list_free_full
  * remove redundant call to free_cl_opts
  * fix some resource leaks in main()
  * fix some use after free issues in check_for_irq_ban
  * fix resource leaks in irqballance-ui, and in add_one_node
- remove Correct-capitalizing-in-service-file.patch: upstream</changelog>
  <changelog author="trenn@suse.de" date="1615377600">- Update to version 1.7.0+git20210222.9db8d5c:
  * ui: fix cpu/irq menu off by one
  * fix uint64_t printf format (use PRIu64)
  * Also fetch node info for non-PCI devices
  * Add hot pull method for irqbalance
  * Add log for hotplug appropriately
  * add irq hotplug feature for irqbalance
  * Remove some unused constant macros in constants.h
  * Add a deprecation notice for IRQBALANCE_BANNED_CPUS
  * Add IRQBALANCE_BANNED_CPULIST to env file
  * log correctly for isolated and nohz_full cpus
  * Update README.md
  * Add some examples for IRQBALANCE_BANNED_CPUS
  * Adjust how we determine if a cpu is online
  * activate_mapping: activate only online CPUs
  * add env variable to ban cpus using cpulist syntax
  * put arg parsing detail into parse_command_line()
  * Updating configure script to version 1.7.0
  * Add strlen checking for IRQBALANCE_BANNED_CPUS
  * remove redundant "/" in SOCKET_TMPFS
  * Fix typo in service unit file
  * arm64: Add irq aff change check For aarch64, the PPIs format in /proc/interrputs can be parsed and add to interrupt db, and next, the number of interrupts is counted and used to calculate the load. Finally these interrupts maybe scheduled between the NUMA domains.
  * Correct typos in irqbalance.c
  * free cpu_ban_string when the next request come
  * improve irq migrate rule to avoid high irq load
  * make the option 'V' closer to the option with no arg</changelog>
  <changelog author="trenn@suse.de" date="1618315200">- Add _service file pointing to github sources
  A _service
- Update to version 1.8.0:
  * Add return value check of opendir in do_one_cpu
  * Hotplug may occur again during sleep, so wait until there is no hotplug</changelog>
  <changelog author="trenn@suse.de" date="1626091200">- Update to version 1.8.0.8.gbd5aaf5 (jsc#SLE-17697):
  * Fix comma typo in ui.c
  * drop NoNewPrivs from irqbalance service
  * remove no existing irq in banned_irqs
  * Fix compile issue with none AARCH64 builds
  * Fix irqbalance cannot obtain the full name of irq
- Enhance _service magic and add git hashtag to version</changelog>
  <changelog author="trenn@suse.de" date="1628683200">- Update to version 1.8.0.14.ga7f8148:
  * irqbalance: Check validity of numa_node
  * configure.ac: use pkg-config to find numa
  * Disable the communication socket when UI is disabled
- Use %{?systemd_ordering} instead of %{?systemd_requires}</changelog>
  <changelog author="trenn@suse.de" date="1630411200">- Update to version 1.8.0.18.git+2435e8d.obscpio:
  * fix unsigned integer subtraction sign overflow
- Make git hash in version better visable .git+&lt;githash&gt;</changelog>
  <changelog author="trenn@suse.de" date="1631102400">- Fixes integrated mainline:
  * bsc#1119461
  * bsc#1138190
  * bsc#1154905
  * bsc#1178477 bsc#1183405 (removed patches due to mainline integration):
    procinterrupts-check-xen-dyn-event-more-flexible.patch
  * bsc#1182254 bsc#1156315 (removed patches due to mainline integration):
    fix-ambiguous-parsing-of-node-entries-in-sys.patch
  * bsc#1183157
    also-fetch-node-info-for-non-PCI-devices.patch</changelog>
  <changelog author="trenn@suse.de" date="1631102401">- Update to version 1.8.0.18.git+2435e8d:
  * fix unsigned integer subtraction sign overflow
  * fix opendir fails in check_platform_device
  * irqbalance: Check validity of numa_node
  * configure.ac: use pkg-config to find numa
  * Disable the communication socket when UI is disabled
  * Fix comma typo in ui.c
  * drop NoNewPrivs from irqbalance service
  * remove no existing irq in banned_irqs
  * Fix compile issue with none AARCH64 builds</changelog>
  <changelog author="trenn@suse.de" date="1669032000">- Add mainline fixes (bnc#1204962, bsc#1206661):
  A    irqbalance-properly-check-if-irq-is-banned.patch
  A    get-irq-module-relationship-from-sys-bus-pci-driver.patch
  A    irqbalance-ui-skip-in-parse_setup-to-avoid-coredump.patch
  A    Fix-uninitialized-variable.patch</changelog>
</package>
<package pkgid="24bbdfb58a0917d3931196e87706d3feb94d44a4f436d344686ef60dcbb9611c" name="irqbalance" arch="x86_64">
  <version epoch="0" ver="1.8.0.18.git+2435e8d" rel="150400.3.5.1"/>
  <changelog author="fschnizlein@suse.com" date="1488369600">- Remove superfluous comment out man package packing</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="egotthold@suse.com" date="1538395200">- Removed aarch64-compile-fixes.patch because it is mainline now.
- Update to version 1.4.0:
  * Fixed an erroneous calculation of min_load that restricted candidates to a
    subset of objects
  * Fixed powerpc hotplug detection
  * Cleaned up syslog target dependency
  * Added some self test infrastructure (via make check)
- Update to version 1.3.0
  * New features in this release:
    optimization of platform device irq detection
    Added sample udev rules to trigger irq rescans on device add/remove
    Made irqbalance ui an optional compile component
    Added support for Intel CoD
    Add -v | --version option to command line
  * Bug fixes in this release:
    Misc compiler warning fixes and spelling errors
    Compilation error fix on aarch64
    Compilation error fix when using clang in c99 mode
    Unused variable cleanup
    Lots of memory leak cleanup in irqbalance-ui
    Prevent irqbalance from running in a container
    Fix irq affinity assignment in some cases to wrong numa node
    Fix oneshot mode
    exclude legacy irq 255
  * Deprecations:
    without-glib2 is removed, we just need it enough that we can't dummy it up
    anymore</changelog>
  <changelog author="trenn@suse.de" date="1538654400">- Allow compilation with SLE-12 and before by:
  * removing -std=C99 Latest compiler version does not complain
  anymore, SLE12 SPx and before did.
  * Fix a possible buffer overflow compiler warning
  A fix_buffer_overflow_compiler.patch</changelog>
  <changelog author="trenn@suse.de" date="1561982400">- Update to version 1.6.0 (b47eea84cbb93f533b0cba2f1aa):
  * fix balancing when numa information isn't available
  * Refine document about IRQBALANCE_BANNED_CPUS
  * Fix string truncation issues detected by GCC 8
  * fix socket path creation
  * Update document for option --banmod and --deepestcache
  * Fix ambiguous parsing of *node* entries in /sys.
  * procinterrupts: check xen-dyn-event more flexible
  * misc: Add an example for policy script
  * policyscript: ignore non-executable files when specifying a directory
  remove because already mainline:
  D fix_buffer_overflow_compiler.patch</changelog>
  <changelog author="jengelh@inai.de" date="1562500800">- Use noun phrase in summaries.</changelog>
  <changelog author="trenn@suse.de" date="1562846400">- Add git hash tag and date in version as source is derived from
  master/HEAD branch. Thanks to namtrac.
  This is done via _service file.
  Also add an example how to get back to a stable release version
- Update to latest git master version:
  git commit f7fdebbaa4dbc27fcdeb7</changelog>
  <changelog author="kukuk@suse.com" date="1587643200">- Use fillup_prereq macro
- Move ui into sub-package to get minimal core much smaller</changelog>
  <changelog author="fvogt@suse.com" date="1587729600">- Package COPYING and README.md
- Add some deps for the -ui subpackage</changelog>
  <changelog author="trenn@suse.de" date="1590494400">- Update to latest git HEAD version 0348a3b.
  There has been no version update for quite some time, but some
  restructuring and fixes we want to have included.
  D install-man-pages.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Corrected mis-spelling (wrong CamelCase) of "EnvironmentFile"
  in misc/irqbalance.service
  [bsc#1172665, Correct-capitalizing-in-service-file.patch]</changelog>
  <changelog author="dmueller@suse.com" date="1597579200">- update to 1.7.0:
  * Strlen checking for IRQBALANCE_BANNED_CPU env var
  * Typo cleanup in SOCKET_TMPFS
  * consolidation of numa node creation on non-numa systems
  * fix uninitialized use of package_mask in affinity setup
  * use num_online_cpus instead of core_count
  * fix a null ptr crash in do_one_cpu
  * make list searching common from glib
  * fix a calloc parameter bug
  * remove some unused variables
  * use g_list_free_full
  * remove redundant call to free_cl_opts
  * fix some resource leaks in main()
  * fix some use after free issues in check_for_irq_ban
  * fix resource leaks in irqballance-ui, and in add_one_node
- remove Correct-capitalizing-in-service-file.patch: upstream</changelog>
  <changelog author="trenn@suse.de" date="1615377600">- Update to version 1.7.0+git20210222.9db8d5c:
  * ui: fix cpu/irq menu off by one
  * fix uint64_t printf format (use PRIu64)
  * Also fetch node info for non-PCI devices
  * Add hot pull method for irqbalance
  * Add log for hotplug appropriately
  * add irq hotplug feature for irqbalance
  * Remove some unused constant macros in constants.h
  * Add a deprecation notice for IRQBALANCE_BANNED_CPUS
  * Add IRQBALANCE_BANNED_CPULIST to env file
  * log correctly for isolated and nohz_full cpus
  * Update README.md
  * Add some examples for IRQBALANCE_BANNED_CPUS
  * Adjust how we determine if a cpu is online
  * activate_mapping: activate only online CPUs
  * add env variable to ban cpus using cpulist syntax
  * put arg parsing detail into parse_command_line()
  * Updating configure script to version 1.7.0
  * Add strlen checking for IRQBALANCE_BANNED_CPUS
  * remove redundant "/" in SOCKET_TMPFS
  * Fix typo in service unit file
  * arm64: Add irq aff change check For aarch64, the PPIs format in /proc/interrputs can be parsed and add to interrupt db, and next, the number of interrupts is counted and used to calculate the load. Finally these interrupts maybe scheduled between the NUMA domains.
  * Correct typos in irqbalance.c
  * free cpu_ban_string when the next request come
  * improve irq migrate rule to avoid high irq load
  * make the option 'V' closer to the option with no arg</changelog>
  <changelog author="trenn@suse.de" date="1618315200">- Add _service file pointing to github sources
  A _service
- Update to version 1.8.0:
  * Add return value check of opendir in do_one_cpu
  * Hotplug may occur again during sleep, so wait until there is no hotplug</changelog>
  <changelog author="trenn@suse.de" date="1626091200">- Update to version 1.8.0.8.gbd5aaf5 (jsc#SLE-17697):
  * Fix comma typo in ui.c
  * drop NoNewPrivs from irqbalance service
  * remove no existing irq in banned_irqs
  * Fix compile issue with none AARCH64 builds
  * Fix irqbalance cannot obtain the full name of irq
- Enhance _service magic and add git hashtag to version</changelog>
  <changelog author="trenn@suse.de" date="1628683200">- Update to version 1.8.0.14.ga7f8148:
  * irqbalance: Check validity of numa_node
  * configure.ac: use pkg-config to find numa
  * Disable the communication socket when UI is disabled
- Use %{?systemd_ordering} instead of %{?systemd_requires}</changelog>
  <changelog author="trenn@suse.de" date="1630411200">- Update to version 1.8.0.18.git+2435e8d.obscpio:
  * fix unsigned integer subtraction sign overflow
- Make git hash in version better visable .git+&lt;githash&gt;</changelog>
  <changelog author="trenn@suse.de" date="1631102400">- Fixes integrated mainline:
  * bsc#1119461
  * bsc#1138190
  * bsc#1154905
  * bsc#1178477 bsc#1183405 (removed patches due to mainline integration):
    procinterrupts-check-xen-dyn-event-more-flexible.patch
  * bsc#1182254 bsc#1156315 (removed patches due to mainline integration):
    fix-ambiguous-parsing-of-node-entries-in-sys.patch
  * bsc#1183157
    also-fetch-node-info-for-non-PCI-devices.patch</changelog>
  <changelog author="trenn@suse.de" date="1631102401">- Update to version 1.8.0.18.git+2435e8d:
  * fix unsigned integer subtraction sign overflow
  * fix opendir fails in check_platform_device
  * irqbalance: Check validity of numa_node
  * configure.ac: use pkg-config to find numa
  * Disable the communication socket when UI is disabled
  * Fix comma typo in ui.c
  * drop NoNewPrivs from irqbalance service
  * remove no existing irq in banned_irqs
  * Fix compile issue with none AARCH64 builds</changelog>
  <changelog author="trenn@suse.de" date="1669032000">- Add mainline fixes (bnc#1204962, bsc#1206661):
  A    irqbalance-properly-check-if-irq-is-banned.patch
  A    get-irq-module-relationship-from-sys-bus-pci-driver.patch
  A    irqbalance-ui-skip-in-parse_setup-to-avoid-coredump.patch
  A    Fix-uninitialized-variable.patch</changelog>
</package>
<package pkgid="e1a6a05bb7b6c9cbc4714285c5d53c69dfa445659cd308b6a455dc592d7a00d6" name="jitterentropy" arch="src">
  <version epoch="0" ver="3.4.0" rel="150000.1.9.1"/>
  <changelog author="meissner@suse.com" date="1632225600">- add a userspace jitter entropy generator library</changelog>
  <changelog author="jengelh@inai.de" date="1632830400">- Trim conjecture from descriptions.</changelog>
  <changelog author="meissner@suse.com" date="1659528000">- updated to 3.4.0
  * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo
  * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state.
  It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8.
  * enhancement: add CMake support by Andrew Hopkins
- updated to 3.3.1
  * fix: bug fix in initialization logic by Vladis Dronov &lt;vdronov@redhat.com&gt;
  * fix: use __asm__ instead of asm to suit the C11 standard
- added a -devel-static package to be able to link it static.</changelog>
  <changelog author="meissner@suse.com" date="1663070400">- jitterentropy-split-internal-header.patch:
  Hide the non-GNUC constructs that are library internal from the
  exported header. (bsc#1202870)</changelog>
  <changelog author="meissner@suse.com" date="1674734400">- jitterentropy-with-debug.patch: build with debuginfo (bsc#1207789)</changelog>
</package>
<package pkgid="889e3af70e764aee1762e3dcf0b7c106cf01291f9c0483cc58d5b17f8405f0fa" name="jitterentropy-devel" arch="aarch64">
  <version epoch="0" ver="3.4.0" rel="150000.1.9.1"/>
  <changelog author="meissner@suse.com" date="1632225600">- add a userspace jitter entropy generator library</changelog>
  <changelog author="jengelh@inai.de" date="1632830400">- Trim conjecture from descriptions.</changelog>
  <changelog author="meissner@suse.com" date="1659528000">- updated to 3.4.0
  * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo
  * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state.
  It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8.
  * enhancement: add CMake support by Andrew Hopkins
- updated to 3.3.1
  * fix: bug fix in initialization logic by Vladis Dronov &lt;vdronov@redhat.com&gt;
  * fix: use __asm__ instead of asm to suit the C11 standard
- added a -devel-static package to be able to link it static.</changelog>
  <changelog author="meissner@suse.com" date="1663070400">- jitterentropy-split-internal-header.patch:
  Hide the non-GNUC constructs that are library internal from the
  exported header. (bsc#1202870)</changelog>
  <changelog author="meissner@suse.com" date="1674734400">- jitterentropy-with-debug.patch: build with debuginfo (bsc#1207789)</changelog>
</package>
<package pkgid="79370f40c1d6f5254004f2d661f452be5fd197f51e05b127b43596647fc5356d" name="jitterentropy-devel" arch="x86_64">
  <version epoch="0" ver="3.4.0" rel="150000.1.9.1"/>
  <changelog author="meissner@suse.com" date="1632225600">- add a userspace jitter entropy generator library</changelog>
  <changelog author="jengelh@inai.de" date="1632830400">- Trim conjecture from descriptions.</changelog>
  <changelog author="meissner@suse.com" date="1659528000">- updated to 3.4.0
  * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo
  * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state.
  It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8.
  * enhancement: add CMake support by Andrew Hopkins
- updated to 3.3.1
  * fix: bug fix in initialization logic by Vladis Dronov &lt;vdronov@redhat.com&gt;
  * fix: use __asm__ instead of asm to suit the C11 standard
- added a -devel-static package to be able to link it static.</changelog>
  <changelog author="meissner@suse.com" date="1663070400">- jitterentropy-split-internal-header.patch:
  Hide the non-GNUC constructs that are library internal from the
  exported header. (bsc#1202870)</changelog>
  <changelog author="meissner@suse.com" date="1674734400">- jitterentropy-with-debug.patch: build with debuginfo (bsc#1207789)</changelog>
</package>
<package pkgid="f6a269be30e64f39bda84e5b5c97f0c7d2cf21cd22b256a972a5fac135e0e70e" name="kbd" arch="aarch64">
  <version epoch="0" ver="2.4.0" rel="150400.5.3.1"/>
  <changelog author="sbrabec@suse.com" date="1522929600">- Disable characters &gt;=U+F000. These do not work properly
  (bsc#1085432#c15, kbd-unicode-fxxx.patch).</changelog>
  <changelog author="kukuk@suse.de" date="1527163200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="schwab@suse.de" date="1533211200">- fbtest.c: include &lt;sys/sysmacros.h&gt; for major/minor</changelog>
  <changelog author="mvidner@suse.com" date="1568894400">- Allow YaST to select Iranian (Persian, Farsi) keyboard layout
  (bsc#1092920)</changelog>
  <changelog author="kukuk@suse.de" date="1575547200">- Move pam.d/vlock to /usr/etc</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578571200">- Use a UTF-8 capable locale, otherwise ckbcomp will not not able
  to do proper uppercase/lowercase conversions.
- Rebase cz-map.patch after UTF-8 changes.
- Skip compression/decompression of maps which are about to be
  discarded later (~30%). Avoid zgrep, which is a shell script
  spawning grep and gunzip for each input file.</changelog>
  <changelog author="sbrabec@suse.com" date="1583236800">- Update to version 2.2.0:
  * setfont: Add option -d to double size of font.
  * kbd_mode: Add -f option and deny dangerous mode switches
    without it.
  * Data files updates.
  * Fix gcc warnings and error with gcc-10 (boo#1160273).
  * Other fixes.
  * For a full list of changes see:
    https://git.kernel.org/pub/scm/linux/kernel/git/legion/kbd.git/log/
- Update home page.
- Refresh patches: kbd-1.15.2-dumpkeys-C-opt.patch,
  kbd-1.15.2-setfont-no-cruft.patch,
  kbd-1.15.5-loadkeys-search-path.patch.</changelog>
  <changelog author="lnussel@suse.de" date="1587470400">- drop broken kbd command as well as guess_encoding (boo#1170067)
- don't use subdirectory for legacy keymaps (boo#1166423)
- use fdupes</changelog>
  <changelog author="jslaby@suse.com" date="1597924800">- add libkeymap-Fix-mk_mapname-for-the-plain-map.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1600344000">- Fix kbd-1.15.5-loadkeys-search-path.patch to prefer xkb keymaps
  (boo#1176302).</changelog>
  <changelog author="sbrabec@suse.com" date="1600344001">- Make kbdsettings working in both bash and dash (boo#1175040).</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1600776000">- Refresh patch to fix build on non-x86 architecture broken
  by previous commit:
  * kbdsettings-nox86.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1600948800">- Update to version 2.3.0:
  * Added libkfont library (internal yet).
  * Added Canadian Multilingual Standard keyboard map.
  * Added us1 that maps Right Alt to AltGr and Shift+Tab to
    Alt+Tab.
  * The dead_macron is used instead of macron in fi.map.
  * Added retries when switching to the console (chvt, openvt).
  * Added option -d to double size of font (setfont).
  * Added long options, help messages.
  * Added solar24x32 font.
  * Updated eurlatgr font.
  * Fixed problems with formatting man pages.
  * Fixed search path error (boo#1176854).
- Refresh partially upstreamed kbd-1.15.2-dumpkeys-C-opt.patch
- Drop upstreamed libkeymap-Fix-mk_mapname-for-the-plain-map.patch
- Refresh kbd-1.15.2-setfont-no-cruft.patch and
  kbd-1.15.5-loadkeys-search-path.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035200">- Do not package libtswrap.so.0: it's only used by the test suite
  in a LD_PRELOAD fashion.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="jslaby@suse.cz" date="1608292800">- Update to version 2.4.0:
  * po: Update cs and sr translations (from translationproject.org)
  * libkfont: Use only KDFONTOP
  * Added support for a few derivatives of neo
  * Fix use-after-free of pipe_cmd
  * Update solar24x32 font
  * vlock's pam config added to destination directory
  * Update sun12x22.psfu
  * libkeymap: unify non/unicode accent_table generation
  * libkeymap: note about --unicode use
  * libkeymap: remove last ushort
  * fi.map: use newly added deadkeys
  * Do not install internal library
  * Additional deadkeys
- Remove kbd-1.15.2-setfont-no-cruft.patch
  The old ioctls were finally dropped.</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Update the installed license file.
  COPYING is a symlink to LICENSE. Let's use this file directly.</changelog>
  <changelog author="kukuk@suse.com" date="1627041600">- Only run kbdsettings.service if /etc/sysconfig/keyboard exists.
  Necessary for image based installations without admin made changes.</changelog>
  <changelog author="fvogt@suse.com" date="1642420800">- Add patch to fix random doubling of font sizes (bsc#1194698):
  * 0001-libkfont-Initialize-kfont_context-options.patch</changelog>
  <changelog author="fvogt@suse.com" date="1645444800">- Fix build without %_distconfdir (see bsc#1195679)</changelog>
</package>
<package pkgid="87da6a063c53dbb4bd80d7b2cf9085ef97e4c13cd3cb7ef6c2d94f69747523f0" name="kbd" arch="src">
  <version epoch="0" ver="2.4.0" rel="150400.5.3.1"/>
  <changelog author="sbrabec@suse.com" date="1522929600">- Disable characters &gt;=U+F000. These do not work properly
  (bsc#1085432#c15, kbd-unicode-fxxx.patch).</changelog>
  <changelog author="kukuk@suse.de" date="1527163200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="schwab@suse.de" date="1533211200">- fbtest.c: include &lt;sys/sysmacros.h&gt; for major/minor</changelog>
  <changelog author="mvidner@suse.com" date="1568894400">- Allow YaST to select Iranian (Persian, Farsi) keyboard layout
  (bsc#1092920)</changelog>
  <changelog author="kukuk@suse.de" date="1575547200">- Move pam.d/vlock to /usr/etc</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578571200">- Use a UTF-8 capable locale, otherwise ckbcomp will not not able
  to do proper uppercase/lowercase conversions.
- Rebase cz-map.patch after UTF-8 changes.
- Skip compression/decompression of maps which are about to be
  discarded later (~30%). Avoid zgrep, which is a shell script
  spawning grep and gunzip for each input file.</changelog>
  <changelog author="sbrabec@suse.com" date="1583236800">- Update to version 2.2.0:
  * setfont: Add option -d to double size of font.
  * kbd_mode: Add -f option and deny dangerous mode switches
    without it.
  * Data files updates.
  * Fix gcc warnings and error with gcc-10 (boo#1160273).
  * Other fixes.
  * For a full list of changes see:
    https://git.kernel.org/pub/scm/linux/kernel/git/legion/kbd.git/log/
- Update home page.
- Refresh patches: kbd-1.15.2-dumpkeys-C-opt.patch,
  kbd-1.15.2-setfont-no-cruft.patch,
  kbd-1.15.5-loadkeys-search-path.patch.</changelog>
  <changelog author="lnussel@suse.de" date="1587470400">- drop broken kbd command as well as guess_encoding (boo#1170067)
- don't use subdirectory for legacy keymaps (boo#1166423)
- use fdupes</changelog>
  <changelog author="jslaby@suse.com" date="1597924800">- add libkeymap-Fix-mk_mapname-for-the-plain-map.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1600344000">- Fix kbd-1.15.5-loadkeys-search-path.patch to prefer xkb keymaps
  (boo#1176302).</changelog>
  <changelog author="sbrabec@suse.com" date="1600344001">- Make kbdsettings working in both bash and dash (boo#1175040).</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1600776000">- Refresh patch to fix build on non-x86 architecture broken
  by previous commit:
  * kbdsettings-nox86.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1600948800">- Update to version 2.3.0:
  * Added libkfont library (internal yet).
  * Added Canadian Multilingual Standard keyboard map.
  * Added us1 that maps Right Alt to AltGr and Shift+Tab to
    Alt+Tab.
  * The dead_macron is used instead of macron in fi.map.
  * Added retries when switching to the console (chvt, openvt).
  * Added option -d to double size of font (setfont).
  * Added long options, help messages.
  * Added solar24x32 font.
  * Updated eurlatgr font.
  * Fixed problems with formatting man pages.
  * Fixed search path error (boo#1176854).
- Refresh partially upstreamed kbd-1.15.2-dumpkeys-C-opt.patch
- Drop upstreamed libkeymap-Fix-mk_mapname-for-the-plain-map.patch
- Refresh kbd-1.15.2-setfont-no-cruft.patch and
  kbd-1.15.5-loadkeys-search-path.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035200">- Do not package libtswrap.so.0: it's only used by the test suite
  in a LD_PRELOAD fashion.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="jslaby@suse.cz" date="1608292800">- Update to version 2.4.0:
  * po: Update cs and sr translations (from translationproject.org)
  * libkfont: Use only KDFONTOP
  * Added support for a few derivatives of neo
  * Fix use-after-free of pipe_cmd
  * Update solar24x32 font
  * vlock's pam config added to destination directory
  * Update sun12x22.psfu
  * libkeymap: unify non/unicode accent_table generation
  * libkeymap: note about --unicode use
  * libkeymap: remove last ushort
  * fi.map: use newly added deadkeys
  * Do not install internal library
  * Additional deadkeys
- Remove kbd-1.15.2-setfont-no-cruft.patch
  The old ioctls were finally dropped.</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Update the installed license file.
  COPYING is a symlink to LICENSE. Let's use this file directly.</changelog>
  <changelog author="kukuk@suse.com" date="1627041600">- Only run kbdsettings.service if /etc/sysconfig/keyboard exists.
  Necessary for image based installations without admin made changes.</changelog>
  <changelog author="fvogt@suse.com" date="1642420800">- Add patch to fix random doubling of font sizes (bsc#1194698):
  * 0001-libkfont-Initialize-kfont_context-options.patch</changelog>
  <changelog author="fvogt@suse.com" date="1645444800">- Fix build without %_distconfdir (see bsc#1195679)</changelog>
</package>
<package pkgid="8bde66d2f736a95d3c776585784a00b90a62ceef15efce9f2efea072cddfb11b" name="kbd" arch="x86_64">
  <version epoch="0" ver="2.4.0" rel="150400.5.3.1"/>
  <changelog author="sbrabec@suse.com" date="1522929600">- Disable characters &gt;=U+F000. These do not work properly
  (bsc#1085432#c15, kbd-unicode-fxxx.patch).</changelog>
  <changelog author="kukuk@suse.de" date="1527163200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="schwab@suse.de" date="1533211200">- fbtest.c: include &lt;sys/sysmacros.h&gt; for major/minor</changelog>
  <changelog author="mvidner@suse.com" date="1568894400">- Allow YaST to select Iranian (Persian, Farsi) keyboard layout
  (bsc#1092920)</changelog>
  <changelog author="kukuk@suse.de" date="1575547200">- Move pam.d/vlock to /usr/etc</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578571200">- Use a UTF-8 capable locale, otherwise ckbcomp will not not able
  to do proper uppercase/lowercase conversions.
- Rebase cz-map.patch after UTF-8 changes.
- Skip compression/decompression of maps which are about to be
  discarded later (~30%). Avoid zgrep, which is a shell script
  spawning grep and gunzip for each input file.</changelog>
  <changelog author="sbrabec@suse.com" date="1583236800">- Update to version 2.2.0:
  * setfont: Add option -d to double size of font.
  * kbd_mode: Add -f option and deny dangerous mode switches
    without it.
  * Data files updates.
  * Fix gcc warnings and error with gcc-10 (boo#1160273).
  * Other fixes.
  * For a full list of changes see:
    https://git.kernel.org/pub/scm/linux/kernel/git/legion/kbd.git/log/
- Update home page.
- Refresh patches: kbd-1.15.2-dumpkeys-C-opt.patch,
  kbd-1.15.2-setfont-no-cruft.patch,
  kbd-1.15.5-loadkeys-search-path.patch.</changelog>
  <changelog author="lnussel@suse.de" date="1587470400">- drop broken kbd command as well as guess_encoding (boo#1170067)
- don't use subdirectory for legacy keymaps (boo#1166423)
- use fdupes</changelog>
  <changelog author="jslaby@suse.com" date="1597924800">- add libkeymap-Fix-mk_mapname-for-the-plain-map.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1600344000">- Fix kbd-1.15.5-loadkeys-search-path.patch to prefer xkb keymaps
  (boo#1176302).</changelog>
  <changelog author="sbrabec@suse.com" date="1600344001">- Make kbdsettings working in both bash and dash (boo#1175040).</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1600776000">- Refresh patch to fix build on non-x86 architecture broken
  by previous commit:
  * kbdsettings-nox86.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1600948800">- Update to version 2.3.0:
  * Added libkfont library (internal yet).
  * Added Canadian Multilingual Standard keyboard map.
  * Added us1 that maps Right Alt to AltGr and Shift+Tab to
    Alt+Tab.
  * The dead_macron is used instead of macron in fi.map.
  * Added retries when switching to the console (chvt, openvt).
  * Added option -d to double size of font (setfont).
  * Added long options, help messages.
  * Added solar24x32 font.
  * Updated eurlatgr font.
  * Fixed problems with formatting man pages.
  * Fixed search path error (boo#1176854).
- Refresh partially upstreamed kbd-1.15.2-dumpkeys-C-opt.patch
- Drop upstreamed libkeymap-Fix-mk_mapname-for-the-plain-map.patch
- Refresh kbd-1.15.2-setfont-no-cruft.patch and
  kbd-1.15.5-loadkeys-search-path.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035200">- Do not package libtswrap.so.0: it's only used by the test suite
  in a LD_PRELOAD fashion.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="jslaby@suse.cz" date="1608292800">- Update to version 2.4.0:
  * po: Update cs and sr translations (from translationproject.org)
  * libkfont: Use only KDFONTOP
  * Added support for a few derivatives of neo
  * Fix use-after-free of pipe_cmd
  * Update solar24x32 font
  * vlock's pam config added to destination directory
  * Update sun12x22.psfu
  * libkeymap: unify non/unicode accent_table generation
  * libkeymap: note about --unicode use
  * libkeymap: remove last ushort
  * fi.map: use newly added deadkeys
  * Do not install internal library
  * Additional deadkeys
- Remove kbd-1.15.2-setfont-no-cruft.patch
  The old ioctls were finally dropped.</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Update the installed license file.
  COPYING is a symlink to LICENSE. Let's use this file directly.</changelog>
  <changelog author="kukuk@suse.com" date="1627041600">- Only run kbdsettings.service if /etc/sysconfig/keyboard exists.
  Necessary for image based installations without admin made changes.</changelog>
  <changelog author="fvogt@suse.com" date="1642420800">- Add patch to fix random doubling of font sizes (bsc#1194698):
  * 0001-libkfont-Initialize-kfont_context-options.patch</changelog>
  <changelog author="fvogt@suse.com" date="1645444800">- Fix build without %_distconfdir (see bsc#1195679)</changelog>
</package>
<package pkgid="96ccf8ebc4a32029c4bd0ce9cfd0f4ad74aaf4d4950078ddc78bc6012e65e3b6" name="kbd-legacy" arch="noarch">
  <version epoch="0" ver="2.4.0" rel="150400.5.3.1"/>
  <changelog author="sbrabec@suse.com" date="1522929600">- Disable characters &gt;=U+F000. These do not work properly
  (bsc#1085432#c15, kbd-unicode-fxxx.patch).</changelog>
  <changelog author="kukuk@suse.de" date="1527163200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="schwab@suse.de" date="1533211200">- fbtest.c: include &lt;sys/sysmacros.h&gt; for major/minor</changelog>
  <changelog author="mvidner@suse.com" date="1568894400">- Allow YaST to select Iranian (Persian, Farsi) keyboard layout
  (bsc#1092920)</changelog>
  <changelog author="kukuk@suse.de" date="1575547200">- Move pam.d/vlock to /usr/etc</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578571200">- Use a UTF-8 capable locale, otherwise ckbcomp will not not able
  to do proper uppercase/lowercase conversions.
- Rebase cz-map.patch after UTF-8 changes.
- Skip compression/decompression of maps which are about to be
  discarded later (~30%). Avoid zgrep, which is a shell script
  spawning grep and gunzip for each input file.</changelog>
  <changelog author="sbrabec@suse.com" date="1583236800">- Update to version 2.2.0:
  * setfont: Add option -d to double size of font.
  * kbd_mode: Add -f option and deny dangerous mode switches
    without it.
  * Data files updates.
  * Fix gcc warnings and error with gcc-10 (boo#1160273).
  * Other fixes.
  * For a full list of changes see:
    https://git.kernel.org/pub/scm/linux/kernel/git/legion/kbd.git/log/
- Update home page.
- Refresh patches: kbd-1.15.2-dumpkeys-C-opt.patch,
  kbd-1.15.2-setfont-no-cruft.patch,
  kbd-1.15.5-loadkeys-search-path.patch.</changelog>
  <changelog author="lnussel@suse.de" date="1587470400">- drop broken kbd command as well as guess_encoding (boo#1170067)
- don't use subdirectory for legacy keymaps (boo#1166423)
- use fdupes</changelog>
  <changelog author="jslaby@suse.com" date="1597924800">- add libkeymap-Fix-mk_mapname-for-the-plain-map.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1600344000">- Fix kbd-1.15.5-loadkeys-search-path.patch to prefer xkb keymaps
  (boo#1176302).</changelog>
  <changelog author="sbrabec@suse.com" date="1600344001">- Make kbdsettings working in both bash and dash (boo#1175040).</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1600776000">- Refresh patch to fix build on non-x86 architecture broken
  by previous commit:
  * kbdsettings-nox86.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1600948800">- Update to version 2.3.0:
  * Added libkfont library (internal yet).
  * Added Canadian Multilingual Standard keyboard map.
  * Added us1 that maps Right Alt to AltGr and Shift+Tab to
    Alt+Tab.
  * The dead_macron is used instead of macron in fi.map.
  * Added retries when switching to the console (chvt, openvt).
  * Added option -d to double size of font (setfont).
  * Added long options, help messages.
  * Added solar24x32 font.
  * Updated eurlatgr font.
  * Fixed problems with formatting man pages.
  * Fixed search path error (boo#1176854).
- Refresh partially upstreamed kbd-1.15.2-dumpkeys-C-opt.patch
- Drop upstreamed libkeymap-Fix-mk_mapname-for-the-plain-map.patch
- Refresh kbd-1.15.2-setfont-no-cruft.patch and
  kbd-1.15.5-loadkeys-search-path.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035200">- Do not package libtswrap.so.0: it's only used by the test suite
  in a LD_PRELOAD fashion.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="jslaby@suse.cz" date="1608292800">- Update to version 2.4.0:
  * po: Update cs and sr translations (from translationproject.org)
  * libkfont: Use only KDFONTOP
  * Added support for a few derivatives of neo
  * Fix use-after-free of pipe_cmd
  * Update solar24x32 font
  * vlock's pam config added to destination directory
  * Update sun12x22.psfu
  * libkeymap: unify non/unicode accent_table generation
  * libkeymap: note about --unicode use
  * libkeymap: remove last ushort
  * fi.map: use newly added deadkeys
  * Do not install internal library
  * Additional deadkeys
- Remove kbd-1.15.2-setfont-no-cruft.patch
  The old ioctls were finally dropped.</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Update the installed license file.
  COPYING is a symlink to LICENSE. Let's use this file directly.</changelog>
  <changelog author="kukuk@suse.com" date="1627041600">- Only run kbdsettings.service if /etc/sysconfig/keyboard exists.
  Necessary for image based installations without admin made changes.</changelog>
  <changelog author="fvogt@suse.com" date="1642420800">- Add patch to fix random doubling of font sizes (bsc#1194698):
  * 0001-libkfont-Initialize-kfont_context-options.patch</changelog>
  <changelog author="fvogt@suse.com" date="1645444800">- Fix build without %_distconfdir (see bsc#1195679)</changelog>
</package>
<package pkgid="5cf4ffecbc2b82209eec96ac4f795ffbdfc5fe363264d5d69a55b10577ccac5c" name="kdump" arch="aarch64">
  <version epoch="0" ver="1.0.2+git18.g615d6ab" rel="150400.3.8.1"/>
  <changelog author="ptesarik@suse.com" date="1614945600">- kdump-query-systemd-network.service.patch: Query systemd
  network.service to find out if wicked is used (bsc#1182309).
- kdump-check-explicit-ip-options.patch: Do not add
  network-related dracut options if ip= is set explicitly
  (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1614945601">- Update to 0.9.1
  * Add build dependency on libmount
  * Drop build dependency on OpenSSL
  * Build with --stdc=c++11
  * Bug fixes (bsc#1173914, bsc#1177196, bsc#1180513)
- Remove patches that have been upstreamed:
  * kdump-block-initrd-parse-etc.service.patch
  * kdump-fadump-avoid-multipath-optimizations.patch
  * kdump-split-cmdline-purpose-wise.patch
  * kdump-fadump-fix-network-bring-up.patch
  * kdump-fadump-add-udev-support.patch
  * kdump-turn-off-NUMA-in-kdump-kernel.patch
  * kdump-remove-noefi-and-acpi_rsdp-for-efi-firmware.patch
  * kdump-Restore-only-static-routes-in-kdump-initrd.patch
  * kdump-fallback-re-register-fadump-from-userspace.patch
  * kdump-recover-from-missing-CRASHTIME.patch
  * kdump-fix-multipath-user_friendly_names.patch
  * kdump-Add-skip_balance-option-to-BTRFS-mounts.patch
  * kdump-kdumprd-Look-for-boot-image-and-boot-Image.patch
  * kdump-savedump-search-also-for-vmlinux.xz.patch
  * kdump-preserve-white-space.patch
  * kdump-Clean-up-the-use-of-current-vs-boot-network-iface.patch
  * kdump-Use-a-custom-namespace-for-physical-NICs.patch
  * kdump-clean-up-kdump-mount-points.patch
  * kdump-skip-mounts-if-no-proc-vmcore.patch
  * kdump-nss-modules.patch
  * kdump-Add-force-option-to-KDUMP_NETCONFIG.patch
  * kdump-Add-fence_kdump_send-when-fence-agents-installed.patch
  * kdump-FENCE_KDUMP_SEND-variable.patch
  * kdump-Document-fence_kdump_send.patch
  * kdump-powerpc-no-reload-on-CPU-removal.patch
  * kdump-prefer-by-path-and-device-mapper.patch
  * kdump-calibrate-Update-values.patch
  * kdump-activate-udev-rules-late-during-boot.patch
  * kdump-make-sure-that-the-udev-runtime-directory-exists.patch
  * kdump-make-sure-that-initrd.target.wants-directory-exists.patch
  * kdump-check-explicit-ip-options.patch
  * kdump-query-systemd-network.service.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1614945602">- kdump-mounts.cc-Include-sys-ioctl.h.patch: mounts.cc: Include
  &lt;sys/ioctl.h&gt;.</changelog>
  <changelog author="ptesarik@suse.com" date="1617883200">- kdump-Add-bootdev-to-dracut-command-line.patch: Add 'bootdev=' to
  dracut command line (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1622203200">- kdump-do-not-iterate-past-end-of-string.patch: Fix a crash caused
  by iterating past end of string (bsc#1186037).</changelog>
  <changelog author="ptesarik@suse.com" date="1622203201">- kdump-fix-incorrect-exit-code-checking.patch: Fix incorrect exit
  code checking after "local" with assignment (bsc#1184616,
  LTC#192282)</changelog>
  <changelog author="ptesarik@suse.com" date="1622203202">- Fix use of DNS in the panic environment (bsc#1183070):
  * kdump-avoid-endless-loop-on-EAI_AGAIN.patch: Avoid an endless
    loop when resolving a hostname fails with EAI_AGAIN.
  * kdump-install-real-resolv.conf.patch: Install /etc/resolv.conf
    using its resolved path.</changelog>
  <changelog author="ptesarik@suse.com" date="1637841600">- kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd
  location for usrmerge kernels (boo#1190920).</changelog>
  <changelog author="ptesarik@suse.com" date="1638964800">- Update to 0.9.2
  * Isolate fadump initrd within the default one (jsc#SLE-18272)
  * Bug fixes
  * Code cleanups
- Remove patches that have been upstreamed:
  * kdump-mounts.cc-Include-sys-ioctl.h.patch
  * kdump-Add-bootdev-to-dracut-command-line.patch
  * kdump-do-not-iterate-past-end-of-string.patch
  * kdump-fix-incorrect-exit-code-checking.patch
  * kdump-avoid-endless-loop-on-EAI_AGAIN.patch
  * kdump-install-real-resolv.conf.patch
  * kdump-Store-kdump-initrd-in-kernel-image-path.patch
- Remove patches that have been solved differently:
  * kdump-on-error-option-yesno.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1639051200">- Sync with SLE15-SP4 changelog. These patches were never applied
  to Factory:
  * kdump-avoid-endless-loop-EAI_AGAIN.patch
  * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch
  * kdump-calibrate-Fix-kernel-command-line-parsing.patch
  * kdump-do-not-add-rd.neednet.patch
  * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch
  * kdump-ensure-initrd.target.wants-directory.patch
  * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch
  * kdump-Implement-KString-isHexNumber.patch
  * kdump-install-etc-resolv.conf-using-resolved-path.patch
  * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch
  * kdump-remove-console-hvc0-from-commandline.patch
  * kdump-set-serial-console-from-Xen-cmdline.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1641211200">- kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix
  malformation in passing Dracut compression parameters in mkdumprd
  (bsc#1193765).
- Refresh existing patches.</changelog>
  <changelog author="ptesarik@suse.com" date="1642766400">- Update to 1.0
  * Estimate kdump memory requirements at build time
    (jsc#SLE-18441).
- Remove patches that have been upstreamed:
  * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1642766401">- kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate:
  Ignore malformed VMCOREINFO lines (address occasional OBS build
  failures).</changelog>
  <changelog author="ptesarik@suse.com" date="1643716800">- Update to 1.0.2
  * Adjust crash kernel reservation at boot time (jsc#SLE-18441).
- All remaining patches have been upstreamed:
  * kdump-fillupdir-fixes.patch
  * kdump-use-pbl.patch
  * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1643716801">- kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf:
  Add dependency on kdumptool.
- kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network
  interface naming.
- kdump-calibrate-include-af_packet.patch: calibrate: Explicitly
  include af_packet in the test initrd.</changelog>
  <changelog author="ptesarik@suse.com" date="1644321600">- Exclude i586 from SLE builds.</changelog>
  <changelog author="jbohac@suse.com" date="1648728000">- pull sources directly from git using obs_scm
- fix bsc#1190299, bsc#1186272
- remove patches included in upstream git:
  kdump-calibrate-include-af_packet.patch,
  kdump-calibrate-fix-nic-naming.patch,
  kdump-calibrate.conf-depends-on-kdumptool.patch</changelog>
  <changelog author="jbohac@suse.com" date="1651665600">- kdumptool calibrate: add more margin to reservation calculations
  (bsc#1196728)
- remount target filesystem r/w for fadump (bsc1197125)
- stop reloading FADump on CPU hot-add event (jsc#IBM-768)
- mkdumprd: add option to run dracut in debug mode</changelog>
  <changelog author="jbohac@suse.com" date="1665748800">- fix network-related dracut options handling for fadump case
  (bsc#1201051)
- fix broken URL in manpage (bsc#1187312)
- use inst_binary to install kdump-save (bsc#1202981)</changelog>
  <changelog author="jbohac@suse.com" date="1669377600">- Make the kdump-save.service reboot after kdump-save is finished
  (bsc#1204000)
- fix renaming of qeth interfaces (bsc#1204743, bsc#1144337)
- ppc64: rebuild initrd image after migration (bsc#1191410)</changelog>
</package>
<package pkgid="8e47e67f52d095711996a6ee63e1a988c660cea6306ef11d69b9ec699180413c" name="kdump" arch="src">
  <version epoch="0" ver="1.0.2+git18.g615d6ab" rel="150400.3.8.1"/>
  <changelog author="ptesarik@suse.com" date="1614945600">- kdump-query-systemd-network.service.patch: Query systemd
  network.service to find out if wicked is used (bsc#1182309).
- kdump-check-explicit-ip-options.patch: Do not add
  network-related dracut options if ip= is set explicitly
  (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1614945601">- Update to 0.9.1
  * Add build dependency on libmount
  * Drop build dependency on OpenSSL
  * Build with --stdc=c++11
  * Bug fixes (bsc#1173914, bsc#1177196, bsc#1180513)
- Remove patches that have been upstreamed:
  * kdump-block-initrd-parse-etc.service.patch
  * kdump-fadump-avoid-multipath-optimizations.patch
  * kdump-split-cmdline-purpose-wise.patch
  * kdump-fadump-fix-network-bring-up.patch
  * kdump-fadump-add-udev-support.patch
  * kdump-turn-off-NUMA-in-kdump-kernel.patch
  * kdump-remove-noefi-and-acpi_rsdp-for-efi-firmware.patch
  * kdump-Restore-only-static-routes-in-kdump-initrd.patch
  * kdump-fallback-re-register-fadump-from-userspace.patch
  * kdump-recover-from-missing-CRASHTIME.patch
  * kdump-fix-multipath-user_friendly_names.patch
  * kdump-Add-skip_balance-option-to-BTRFS-mounts.patch
  * kdump-kdumprd-Look-for-boot-image-and-boot-Image.patch
  * kdump-savedump-search-also-for-vmlinux.xz.patch
  * kdump-preserve-white-space.patch
  * kdump-Clean-up-the-use-of-current-vs-boot-network-iface.patch
  * kdump-Use-a-custom-namespace-for-physical-NICs.patch
  * kdump-clean-up-kdump-mount-points.patch
  * kdump-skip-mounts-if-no-proc-vmcore.patch
  * kdump-nss-modules.patch
  * kdump-Add-force-option-to-KDUMP_NETCONFIG.patch
  * kdump-Add-fence_kdump_send-when-fence-agents-installed.patch
  * kdump-FENCE_KDUMP_SEND-variable.patch
  * kdump-Document-fence_kdump_send.patch
  * kdump-powerpc-no-reload-on-CPU-removal.patch
  * kdump-prefer-by-path-and-device-mapper.patch
  * kdump-calibrate-Update-values.patch
  * kdump-activate-udev-rules-late-during-boot.patch
  * kdump-make-sure-that-the-udev-runtime-directory-exists.patch
  * kdump-make-sure-that-initrd.target.wants-directory-exists.patch
  * kdump-check-explicit-ip-options.patch
  * kdump-query-systemd-network.service.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1614945602">- kdump-mounts.cc-Include-sys-ioctl.h.patch: mounts.cc: Include
  &lt;sys/ioctl.h&gt;.</changelog>
  <changelog author="ptesarik@suse.com" date="1617883200">- kdump-Add-bootdev-to-dracut-command-line.patch: Add 'bootdev=' to
  dracut command line (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1622203200">- kdump-do-not-iterate-past-end-of-string.patch: Fix a crash caused
  by iterating past end of string (bsc#1186037).</changelog>
  <changelog author="ptesarik@suse.com" date="1622203201">- kdump-fix-incorrect-exit-code-checking.patch: Fix incorrect exit
  code checking after "local" with assignment (bsc#1184616,
  LTC#192282)</changelog>
  <changelog author="ptesarik@suse.com" date="1622203202">- Fix use of DNS in the panic environment (bsc#1183070):
  * kdump-avoid-endless-loop-on-EAI_AGAIN.patch: Avoid an endless
    loop when resolving a hostname fails with EAI_AGAIN.
  * kdump-install-real-resolv.conf.patch: Install /etc/resolv.conf
    using its resolved path.</changelog>
  <changelog author="ptesarik@suse.com" date="1637841600">- kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd
  location for usrmerge kernels (boo#1190920).</changelog>
  <changelog author="ptesarik@suse.com" date="1638964800">- Update to 0.9.2
  * Isolate fadump initrd within the default one (jsc#SLE-18272)
  * Bug fixes
  * Code cleanups
- Remove patches that have been upstreamed:
  * kdump-mounts.cc-Include-sys-ioctl.h.patch
  * kdump-Add-bootdev-to-dracut-command-line.patch
  * kdump-do-not-iterate-past-end-of-string.patch
  * kdump-fix-incorrect-exit-code-checking.patch
  * kdump-avoid-endless-loop-on-EAI_AGAIN.patch
  * kdump-install-real-resolv.conf.patch
  * kdump-Store-kdump-initrd-in-kernel-image-path.patch
- Remove patches that have been solved differently:
  * kdump-on-error-option-yesno.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1639051200">- Sync with SLE15-SP4 changelog. These patches were never applied
  to Factory:
  * kdump-avoid-endless-loop-EAI_AGAIN.patch
  * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch
  * kdump-calibrate-Fix-kernel-command-line-parsing.patch
  * kdump-do-not-add-rd.neednet.patch
  * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch
  * kdump-ensure-initrd.target.wants-directory.patch
  * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch
  * kdump-Implement-KString-isHexNumber.patch
  * kdump-install-etc-resolv.conf-using-resolved-path.patch
  * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch
  * kdump-remove-console-hvc0-from-commandline.patch
  * kdump-set-serial-console-from-Xen-cmdline.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1641211200">- kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix
  malformation in passing Dracut compression parameters in mkdumprd
  (bsc#1193765).
- Refresh existing patches.</changelog>
  <changelog author="ptesarik@suse.com" date="1642766400">- Update to 1.0
  * Estimate kdump memory requirements at build time
    (jsc#SLE-18441).
- Remove patches that have been upstreamed:
  * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1642766401">- kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate:
  Ignore malformed VMCOREINFO lines (address occasional OBS build
  failures).</changelog>
  <changelog author="ptesarik@suse.com" date="1643716800">- Update to 1.0.2
  * Adjust crash kernel reservation at boot time (jsc#SLE-18441).
- All remaining patches have been upstreamed:
  * kdump-fillupdir-fixes.patch
  * kdump-use-pbl.patch
  * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1643716801">- kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf:
  Add dependency on kdumptool.
- kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network
  interface naming.
- kdump-calibrate-include-af_packet.patch: calibrate: Explicitly
  include af_packet in the test initrd.</changelog>
  <changelog author="ptesarik@suse.com" date="1644321600">- Exclude i586 from SLE builds.</changelog>
  <changelog author="jbohac@suse.com" date="1648728000">- pull sources directly from git using obs_scm
- fix bsc#1190299, bsc#1186272
- remove patches included in upstream git:
  kdump-calibrate-include-af_packet.patch,
  kdump-calibrate-fix-nic-naming.patch,
  kdump-calibrate.conf-depends-on-kdumptool.patch</changelog>
  <changelog author="jbohac@suse.com" date="1651665600">- kdumptool calibrate: add more margin to reservation calculations
  (bsc#1196728)
- remount target filesystem r/w for fadump (bsc1197125)
- stop reloading FADump on CPU hot-add event (jsc#IBM-768)
- mkdumprd: add option to run dracut in debug mode</changelog>
  <changelog author="jbohac@suse.com" date="1665748800">- fix network-related dracut options handling for fadump case
  (bsc#1201051)
- fix broken URL in manpage (bsc#1187312)
- use inst_binary to install kdump-save (bsc#1202981)</changelog>
  <changelog author="jbohac@suse.com" date="1669377600">- Make the kdump-save.service reboot after kdump-save is finished
  (bsc#1204000)
- fix renaming of qeth interfaces (bsc#1204743, bsc#1144337)
- ppc64: rebuild initrd image after migration (bsc#1191410)</changelog>
</package>
<package pkgid="a7ddc085bf84215bae60ed43b639b1c037315e549ae8d3a596085a32975b0e5e" name="kdump" arch="x86_64">
  <version epoch="0" ver="1.0.2+git18.g615d6ab" rel="150400.3.8.1"/>
  <changelog author="ptesarik@suse.com" date="1614945600">- kdump-query-systemd-network.service.patch: Query systemd
  network.service to find out if wicked is used (bsc#1182309).
- kdump-check-explicit-ip-options.patch: Do not add
  network-related dracut options if ip= is set explicitly
  (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1614945601">- Update to 0.9.1
  * Add build dependency on libmount
  * Drop build dependency on OpenSSL
  * Build with --stdc=c++11
  * Bug fixes (bsc#1173914, bsc#1177196, bsc#1180513)
- Remove patches that have been upstreamed:
  * kdump-block-initrd-parse-etc.service.patch
  * kdump-fadump-avoid-multipath-optimizations.patch
  * kdump-split-cmdline-purpose-wise.patch
  * kdump-fadump-fix-network-bring-up.patch
  * kdump-fadump-add-udev-support.patch
  * kdump-turn-off-NUMA-in-kdump-kernel.patch
  * kdump-remove-noefi-and-acpi_rsdp-for-efi-firmware.patch
  * kdump-Restore-only-static-routes-in-kdump-initrd.patch
  * kdump-fallback-re-register-fadump-from-userspace.patch
  * kdump-recover-from-missing-CRASHTIME.patch
  * kdump-fix-multipath-user_friendly_names.patch
  * kdump-Add-skip_balance-option-to-BTRFS-mounts.patch
  * kdump-kdumprd-Look-for-boot-image-and-boot-Image.patch
  * kdump-savedump-search-also-for-vmlinux.xz.patch
  * kdump-preserve-white-space.patch
  * kdump-Clean-up-the-use-of-current-vs-boot-network-iface.patch
  * kdump-Use-a-custom-namespace-for-physical-NICs.patch
  * kdump-clean-up-kdump-mount-points.patch
  * kdump-skip-mounts-if-no-proc-vmcore.patch
  * kdump-nss-modules.patch
  * kdump-Add-force-option-to-KDUMP_NETCONFIG.patch
  * kdump-Add-fence_kdump_send-when-fence-agents-installed.patch
  * kdump-FENCE_KDUMP_SEND-variable.patch
  * kdump-Document-fence_kdump_send.patch
  * kdump-powerpc-no-reload-on-CPU-removal.patch
  * kdump-prefer-by-path-and-device-mapper.patch
  * kdump-calibrate-Update-values.patch
  * kdump-activate-udev-rules-late-during-boot.patch
  * kdump-make-sure-that-the-udev-runtime-directory-exists.patch
  * kdump-make-sure-that-initrd.target.wants-directory-exists.patch
  * kdump-check-explicit-ip-options.patch
  * kdump-query-systemd-network.service.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1614945602">- kdump-mounts.cc-Include-sys-ioctl.h.patch: mounts.cc: Include
  &lt;sys/ioctl.h&gt;.</changelog>
  <changelog author="ptesarik@suse.com" date="1617883200">- kdump-Add-bootdev-to-dracut-command-line.patch: Add 'bootdev=' to
  dracut command line (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1622203200">- kdump-do-not-iterate-past-end-of-string.patch: Fix a crash caused
  by iterating past end of string (bsc#1186037).</changelog>
  <changelog author="ptesarik@suse.com" date="1622203201">- kdump-fix-incorrect-exit-code-checking.patch: Fix incorrect exit
  code checking after "local" with assignment (bsc#1184616,
  LTC#192282)</changelog>
  <changelog author="ptesarik@suse.com" date="1622203202">- Fix use of DNS in the panic environment (bsc#1183070):
  * kdump-avoid-endless-loop-on-EAI_AGAIN.patch: Avoid an endless
    loop when resolving a hostname fails with EAI_AGAIN.
  * kdump-install-real-resolv.conf.patch: Install /etc/resolv.conf
    using its resolved path.</changelog>
  <changelog author="ptesarik@suse.com" date="1637841600">- kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd
  location for usrmerge kernels (boo#1190920).</changelog>
  <changelog author="ptesarik@suse.com" date="1638964800">- Update to 0.9.2
  * Isolate fadump initrd within the default one (jsc#SLE-18272)
  * Bug fixes
  * Code cleanups
- Remove patches that have been upstreamed:
  * kdump-mounts.cc-Include-sys-ioctl.h.patch
  * kdump-Add-bootdev-to-dracut-command-line.patch
  * kdump-do-not-iterate-past-end-of-string.patch
  * kdump-fix-incorrect-exit-code-checking.patch
  * kdump-avoid-endless-loop-on-EAI_AGAIN.patch
  * kdump-install-real-resolv.conf.patch
  * kdump-Store-kdump-initrd-in-kernel-image-path.patch
- Remove patches that have been solved differently:
  * kdump-on-error-option-yesno.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1639051200">- Sync with SLE15-SP4 changelog. These patches were never applied
  to Factory:
  * kdump-avoid-endless-loop-EAI_AGAIN.patch
  * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch
  * kdump-calibrate-Fix-kernel-command-line-parsing.patch
  * kdump-do-not-add-rd.neednet.patch
  * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch
  * kdump-ensure-initrd.target.wants-directory.patch
  * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch
  * kdump-Implement-KString-isHexNumber.patch
  * kdump-install-etc-resolv.conf-using-resolved-path.patch
  * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch
  * kdump-remove-console-hvc0-from-commandline.patch
  * kdump-set-serial-console-from-Xen-cmdline.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1641211200">- kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix
  malformation in passing Dracut compression parameters in mkdumprd
  (bsc#1193765).
- Refresh existing patches.</changelog>
  <changelog author="ptesarik@suse.com" date="1642766400">- Update to 1.0
  * Estimate kdump memory requirements at build time
    (jsc#SLE-18441).
- Remove patches that have been upstreamed:
  * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1642766401">- kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate:
  Ignore malformed VMCOREINFO lines (address occasional OBS build
  failures).</changelog>
  <changelog author="ptesarik@suse.com" date="1643716800">- Update to 1.0.2
  * Adjust crash kernel reservation at boot time (jsc#SLE-18441).
- All remaining patches have been upstreamed:
  * kdump-fillupdir-fixes.patch
  * kdump-use-pbl.patch
  * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1643716801">- kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf:
  Add dependency on kdumptool.
- kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network
  interface naming.
- kdump-calibrate-include-af_packet.patch: calibrate: Explicitly
  include af_packet in the test initrd.</changelog>
  <changelog author="ptesarik@suse.com" date="1644321600">- Exclude i586 from SLE builds.</changelog>
  <changelog author="jbohac@suse.com" date="1648728000">- pull sources directly from git using obs_scm
- fix bsc#1190299, bsc#1186272
- remove patches included in upstream git:
  kdump-calibrate-include-af_packet.patch,
  kdump-calibrate-fix-nic-naming.patch,
  kdump-calibrate.conf-depends-on-kdumptool.patch</changelog>
  <changelog author="jbohac@suse.com" date="1651665600">- kdumptool calibrate: add more margin to reservation calculations
  (bsc#1196728)
- remount target filesystem r/w for fadump (bsc1197125)
- stop reloading FADump on CPU hot-add event (jsc#IBM-768)
- mkdumprd: add option to run dracut in debug mode</changelog>
  <changelog author="jbohac@suse.com" date="1665748800">- fix network-related dracut options handling for fadump case
  (bsc#1201051)
- fix broken URL in manpage (bsc#1187312)
- use inst_binary to install kdump-save (bsc#1202981)</changelog>
  <changelog author="jbohac@suse.com" date="1669377600">- Make the kdump-save.service reboot after kdump-save is finished
  (bsc#1204000)
- fix renaming of qeth interfaces (bsc#1204743, bsc#1144337)
- ppc64: rebuild initrd image after migration (bsc#1191410)</changelog>
</package>
<package pkgid="ac903baac1c868beaeb85ea3003532f352302efdfc04b7db7782cc7b7ac55499" name="kdump" arch="aarch64">
  <version epoch="0" ver="1.0.2+git20.g64239cc" rel="150400.3.11.1"/>
  <changelog author="ptesarik@suse.com" date="1614945600">- Update to 0.9.1
  * Add build dependency on libmount
  * Drop build dependency on OpenSSL
  * Build with --stdc=c++11
  * Bug fixes (bsc#1173914, bsc#1177196, bsc#1180513)
- Remove patches that have been upstreamed:
  * kdump-block-initrd-parse-etc.service.patch
  * kdump-fadump-avoid-multipath-optimizations.patch
  * kdump-split-cmdline-purpose-wise.patch
  * kdump-fadump-fix-network-bring-up.patch
  * kdump-fadump-add-udev-support.patch
  * kdump-turn-off-NUMA-in-kdump-kernel.patch
  * kdump-remove-noefi-and-acpi_rsdp-for-efi-firmware.patch
  * kdump-Restore-only-static-routes-in-kdump-initrd.patch
  * kdump-fallback-re-register-fadump-from-userspace.patch
  * kdump-recover-from-missing-CRASHTIME.patch
  * kdump-fix-multipath-user_friendly_names.patch
  * kdump-Add-skip_balance-option-to-BTRFS-mounts.patch
  * kdump-kdumprd-Look-for-boot-image-and-boot-Image.patch
  * kdump-savedump-search-also-for-vmlinux.xz.patch
  * kdump-preserve-white-space.patch
  * kdump-Clean-up-the-use-of-current-vs-boot-network-iface.patch
  * kdump-Use-a-custom-namespace-for-physical-NICs.patch
  * kdump-clean-up-kdump-mount-points.patch
  * kdump-skip-mounts-if-no-proc-vmcore.patch
  * kdump-nss-modules.patch
  * kdump-Add-force-option-to-KDUMP_NETCONFIG.patch
  * kdump-Add-fence_kdump_send-when-fence-agents-installed.patch
  * kdump-FENCE_KDUMP_SEND-variable.patch
  * kdump-Document-fence_kdump_send.patch
  * kdump-powerpc-no-reload-on-CPU-removal.patch
  * kdump-prefer-by-path-and-device-mapper.patch
  * kdump-calibrate-Update-values.patch
  * kdump-activate-udev-rules-late-during-boot.patch
  * kdump-make-sure-that-the-udev-runtime-directory-exists.patch
  * kdump-make-sure-that-initrd.target.wants-directory-exists.patch
  * kdump-check-explicit-ip-options.patch
  * kdump-query-systemd-network.service.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1614945601">- kdump-mounts.cc-Include-sys-ioctl.h.patch: mounts.cc: Include
  &lt;sys/ioctl.h&gt;.</changelog>
  <changelog author="ptesarik@suse.com" date="1617883200">- kdump-Add-bootdev-to-dracut-command-line.patch: Add 'bootdev=' to
  dracut command line (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1622203200">- kdump-do-not-iterate-past-end-of-string.patch: Fix a crash caused
  by iterating past end of string (bsc#1186037).</changelog>
  <changelog author="ptesarik@suse.com" date="1622203201">- kdump-fix-incorrect-exit-code-checking.patch: Fix incorrect exit
  code checking after "local" with assignment (bsc#1184616,
  LTC#192282)</changelog>
  <changelog author="ptesarik@suse.com" date="1622203202">- Fix use of DNS in the panic environment (bsc#1183070):
  * kdump-avoid-endless-loop-on-EAI_AGAIN.patch: Avoid an endless
    loop when resolving a hostname fails with EAI_AGAIN.
  * kdump-install-real-resolv.conf.patch: Install /etc/resolv.conf
    using its resolved path.</changelog>
  <changelog author="ptesarik@suse.com" date="1637841600">- kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd
  location for usrmerge kernels (boo#1190920).</changelog>
  <changelog author="ptesarik@suse.com" date="1638964800">- Update to 0.9.2
  * Isolate fadump initrd within the default one (jsc#SLE-18272)
  * Bug fixes
  * Code cleanups
- Remove patches that have been upstreamed:
  * kdump-mounts.cc-Include-sys-ioctl.h.patch
  * kdump-Add-bootdev-to-dracut-command-line.patch
  * kdump-do-not-iterate-past-end-of-string.patch
  * kdump-fix-incorrect-exit-code-checking.patch
  * kdump-avoid-endless-loop-on-EAI_AGAIN.patch
  * kdump-install-real-resolv.conf.patch
  * kdump-Store-kdump-initrd-in-kernel-image-path.patch
- Remove patches that have been solved differently:
  * kdump-on-error-option-yesno.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1639051200">- Sync with SLE15-SP4 changelog. These patches were never applied
  to Factory:
  * kdump-avoid-endless-loop-EAI_AGAIN.patch
  * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch
  * kdump-calibrate-Fix-kernel-command-line-parsing.patch
  * kdump-do-not-add-rd.neednet.patch
  * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch
  * kdump-ensure-initrd.target.wants-directory.patch
  * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch
  * kdump-Implement-KString-isHexNumber.patch
  * kdump-install-etc-resolv.conf-using-resolved-path.patch
  * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch
  * kdump-remove-console-hvc0-from-commandline.patch
  * kdump-set-serial-console-from-Xen-cmdline.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1641211200">- kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix
  malformation in passing Dracut compression parameters in mkdumprd
  (bsc#1193765).
- Refresh existing patches.</changelog>
  <changelog author="ptesarik@suse.com" date="1642766400">- Update to 1.0
  * Estimate kdump memory requirements at build time
    (jsc#SLE-18441).
- Remove patches that have been upstreamed:
  * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1642766401">- kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate:
  Ignore malformed VMCOREINFO lines (address occasional OBS build
  failures).</changelog>
  <changelog author="ptesarik@suse.com" date="1643716800">- Update to 1.0.2
  * Adjust crash kernel reservation at boot time (jsc#SLE-18441).
- All remaining patches have been upstreamed:
  * kdump-fillupdir-fixes.patch
  * kdump-use-pbl.patch
  * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1643716801">- kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf:
  Add dependency on kdumptool.
- kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network
  interface naming.
- kdump-calibrate-include-af_packet.patch: calibrate: Explicitly
  include af_packet in the test initrd.</changelog>
  <changelog author="ptesarik@suse.com" date="1644321600">- Exclude i586 from SLE builds.</changelog>
  <changelog author="jbohac@suse.com" date="1648728000">- pull sources directly from git using obs_scm
- fix bsc#1190299, bsc#1186272
- remove patches included in upstream git:
  kdump-calibrate-include-af_packet.patch,
  kdump-calibrate-fix-nic-naming.patch,
  kdump-calibrate.conf-depends-on-kdumptool.patch</changelog>
  <changelog author="jbohac@suse.com" date="1651665600">- kdumptool calibrate: add more margin to reservation calculations
  (bsc#1196728)
- remount target filesystem r/w for fadump (bsc1197125)
- stop reloading FADump on CPU hot-add event (jsc#IBM-768)
- mkdumprd: add option to run dracut in debug mode</changelog>
  <changelog author="jbohac@suse.com" date="1665748800">- fix network-related dracut options handling for fadump case
  (bsc#1201051)
- fix broken URL in manpage (bsc#1187312)
- use inst_binary to install kdump-save (bsc#1202981)</changelog>
  <changelog author="jbohac@suse.com" date="1669377600">- Make the kdump-save.service reboot after kdump-save is finished
  (bsc#1204000)
- fix renaming of qeth interfaces (bsc#1204743, bsc#1144337)
- ppc64: rebuild initrd image after migration (bsc#1191410)</changelog>
  <changelog author="jbohac@suse.com" date="1677153600">- run kdump.service only after kdump-early.service (bsc#1196335)
- don't skip infiniband interfaces (bsc#1186745)
  (not a complete fix, requires a patch in dracut as well)</changelog>
</package>
<package pkgid="6899d12734999eba3a137b1ddc5cbf193b02007f8ee77c69a0935b837ad92df9" name="kdump" arch="src">
  <version epoch="0" ver="1.0.2+git20.g64239cc" rel="150400.3.11.1"/>
  <changelog author="ptesarik@suse.com" date="1614945600">- Update to 0.9.1
  * Add build dependency on libmount
  * Drop build dependency on OpenSSL
  * Build with --stdc=c++11
  * Bug fixes (bsc#1173914, bsc#1177196, bsc#1180513)
- Remove patches that have been upstreamed:
  * kdump-block-initrd-parse-etc.service.patch
  * kdump-fadump-avoid-multipath-optimizations.patch
  * kdump-split-cmdline-purpose-wise.patch
  * kdump-fadump-fix-network-bring-up.patch
  * kdump-fadump-add-udev-support.patch
  * kdump-turn-off-NUMA-in-kdump-kernel.patch
  * kdump-remove-noefi-and-acpi_rsdp-for-efi-firmware.patch
  * kdump-Restore-only-static-routes-in-kdump-initrd.patch
  * kdump-fallback-re-register-fadump-from-userspace.patch
  * kdump-recover-from-missing-CRASHTIME.patch
  * kdump-fix-multipath-user_friendly_names.patch
  * kdump-Add-skip_balance-option-to-BTRFS-mounts.patch
  * kdump-kdumprd-Look-for-boot-image-and-boot-Image.patch
  * kdump-savedump-search-also-for-vmlinux.xz.patch
  * kdump-preserve-white-space.patch
  * kdump-Clean-up-the-use-of-current-vs-boot-network-iface.patch
  * kdump-Use-a-custom-namespace-for-physical-NICs.patch
  * kdump-clean-up-kdump-mount-points.patch
  * kdump-skip-mounts-if-no-proc-vmcore.patch
  * kdump-nss-modules.patch
  * kdump-Add-force-option-to-KDUMP_NETCONFIG.patch
  * kdump-Add-fence_kdump_send-when-fence-agents-installed.patch
  * kdump-FENCE_KDUMP_SEND-variable.patch
  * kdump-Document-fence_kdump_send.patch
  * kdump-powerpc-no-reload-on-CPU-removal.patch
  * kdump-prefer-by-path-and-device-mapper.patch
  * kdump-calibrate-Update-values.patch
  * kdump-activate-udev-rules-late-during-boot.patch
  * kdump-make-sure-that-the-udev-runtime-directory-exists.patch
  * kdump-make-sure-that-initrd.target.wants-directory-exists.patch
  * kdump-check-explicit-ip-options.patch
  * kdump-query-systemd-network.service.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1614945601">- kdump-mounts.cc-Include-sys-ioctl.h.patch: mounts.cc: Include
  &lt;sys/ioctl.h&gt;.</changelog>
  <changelog author="ptesarik@suse.com" date="1617883200">- kdump-Add-bootdev-to-dracut-command-line.patch: Add 'bootdev=' to
  dracut command line (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1622203200">- kdump-do-not-iterate-past-end-of-string.patch: Fix a crash caused
  by iterating past end of string (bsc#1186037).</changelog>
  <changelog author="ptesarik@suse.com" date="1622203201">- kdump-fix-incorrect-exit-code-checking.patch: Fix incorrect exit
  code checking after "local" with assignment (bsc#1184616,
  LTC#192282)</changelog>
  <changelog author="ptesarik@suse.com" date="1622203202">- Fix use of DNS in the panic environment (bsc#1183070):
  * kdump-avoid-endless-loop-on-EAI_AGAIN.patch: Avoid an endless
    loop when resolving a hostname fails with EAI_AGAIN.
  * kdump-install-real-resolv.conf.patch: Install /etc/resolv.conf
    using its resolved path.</changelog>
  <changelog author="ptesarik@suse.com" date="1637841600">- kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd
  location for usrmerge kernels (boo#1190920).</changelog>
  <changelog author="ptesarik@suse.com" date="1638964800">- Update to 0.9.2
  * Isolate fadump initrd within the default one (jsc#SLE-18272)
  * Bug fixes
  * Code cleanups
- Remove patches that have been upstreamed:
  * kdump-mounts.cc-Include-sys-ioctl.h.patch
  * kdump-Add-bootdev-to-dracut-command-line.patch
  * kdump-do-not-iterate-past-end-of-string.patch
  * kdump-fix-incorrect-exit-code-checking.patch
  * kdump-avoid-endless-loop-on-EAI_AGAIN.patch
  * kdump-install-real-resolv.conf.patch
  * kdump-Store-kdump-initrd-in-kernel-image-path.patch
- Remove patches that have been solved differently:
  * kdump-on-error-option-yesno.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1639051200">- Sync with SLE15-SP4 changelog. These patches were never applied
  to Factory:
  * kdump-avoid-endless-loop-EAI_AGAIN.patch
  * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch
  * kdump-calibrate-Fix-kernel-command-line-parsing.patch
  * kdump-do-not-add-rd.neednet.patch
  * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch
  * kdump-ensure-initrd.target.wants-directory.patch
  * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch
  * kdump-Implement-KString-isHexNumber.patch
  * kdump-install-etc-resolv.conf-using-resolved-path.patch
  * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch
  * kdump-remove-console-hvc0-from-commandline.patch
  * kdump-set-serial-console-from-Xen-cmdline.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1641211200">- kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix
  malformation in passing Dracut compression parameters in mkdumprd
  (bsc#1193765).
- Refresh existing patches.</changelog>
  <changelog author="ptesarik@suse.com" date="1642766400">- Update to 1.0
  * Estimate kdump memory requirements at build time
    (jsc#SLE-18441).
- Remove patches that have been upstreamed:
  * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1642766401">- kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate:
  Ignore malformed VMCOREINFO lines (address occasional OBS build
  failures).</changelog>
  <changelog author="ptesarik@suse.com" date="1643716800">- Update to 1.0.2
  * Adjust crash kernel reservation at boot time (jsc#SLE-18441).
- All remaining patches have been upstreamed:
  * kdump-fillupdir-fixes.patch
  * kdump-use-pbl.patch
  * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1643716801">- kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf:
  Add dependency on kdumptool.
- kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network
  interface naming.
- kdump-calibrate-include-af_packet.patch: calibrate: Explicitly
  include af_packet in the test initrd.</changelog>
  <changelog author="ptesarik@suse.com" date="1644321600">- Exclude i586 from SLE builds.</changelog>
  <changelog author="jbohac@suse.com" date="1648728000">- pull sources directly from git using obs_scm
- fix bsc#1190299, bsc#1186272
- remove patches included in upstream git:
  kdump-calibrate-include-af_packet.patch,
  kdump-calibrate-fix-nic-naming.patch,
  kdump-calibrate.conf-depends-on-kdumptool.patch</changelog>
  <changelog author="jbohac@suse.com" date="1651665600">- kdumptool calibrate: add more margin to reservation calculations
  (bsc#1196728)
- remount target filesystem r/w for fadump (bsc1197125)
- stop reloading FADump on CPU hot-add event (jsc#IBM-768)
- mkdumprd: add option to run dracut in debug mode</changelog>
  <changelog author="jbohac@suse.com" date="1665748800">- fix network-related dracut options handling for fadump case
  (bsc#1201051)
- fix broken URL in manpage (bsc#1187312)
- use inst_binary to install kdump-save (bsc#1202981)</changelog>
  <changelog author="jbohac@suse.com" date="1669377600">- Make the kdump-save.service reboot after kdump-save is finished
  (bsc#1204000)
- fix renaming of qeth interfaces (bsc#1204743, bsc#1144337)
- ppc64: rebuild initrd image after migration (bsc#1191410)</changelog>
  <changelog author="jbohac@suse.com" date="1677153600">- run kdump.service only after kdump-early.service (bsc#1196335)
- don't skip infiniband interfaces (bsc#1186745)
  (not a complete fix, requires a patch in dracut as well)</changelog>
</package>
<package pkgid="55bf89eccea941541040686f3aad04d07088981b88153173d160e57868272c7e" name="kdump" arch="x86_64">
  <version epoch="0" ver="1.0.2+git20.g64239cc" rel="150400.3.11.1"/>
  <changelog author="ptesarik@suse.com" date="1614945600">- Update to 0.9.1
  * Add build dependency on libmount
  * Drop build dependency on OpenSSL
  * Build with --stdc=c++11
  * Bug fixes (bsc#1173914, bsc#1177196, bsc#1180513)
- Remove patches that have been upstreamed:
  * kdump-block-initrd-parse-etc.service.patch
  * kdump-fadump-avoid-multipath-optimizations.patch
  * kdump-split-cmdline-purpose-wise.patch
  * kdump-fadump-fix-network-bring-up.patch
  * kdump-fadump-add-udev-support.patch
  * kdump-turn-off-NUMA-in-kdump-kernel.patch
  * kdump-remove-noefi-and-acpi_rsdp-for-efi-firmware.patch
  * kdump-Restore-only-static-routes-in-kdump-initrd.patch
  * kdump-fallback-re-register-fadump-from-userspace.patch
  * kdump-recover-from-missing-CRASHTIME.patch
  * kdump-fix-multipath-user_friendly_names.patch
  * kdump-Add-skip_balance-option-to-BTRFS-mounts.patch
  * kdump-kdumprd-Look-for-boot-image-and-boot-Image.patch
  * kdump-savedump-search-also-for-vmlinux.xz.patch
  * kdump-preserve-white-space.patch
  * kdump-Clean-up-the-use-of-current-vs-boot-network-iface.patch
  * kdump-Use-a-custom-namespace-for-physical-NICs.patch
  * kdump-clean-up-kdump-mount-points.patch
  * kdump-skip-mounts-if-no-proc-vmcore.patch
  * kdump-nss-modules.patch
  * kdump-Add-force-option-to-KDUMP_NETCONFIG.patch
  * kdump-Add-fence_kdump_send-when-fence-agents-installed.patch
  * kdump-FENCE_KDUMP_SEND-variable.patch
  * kdump-Document-fence_kdump_send.patch
  * kdump-powerpc-no-reload-on-CPU-removal.patch
  * kdump-prefer-by-path-and-device-mapper.patch
  * kdump-calibrate-Update-values.patch
  * kdump-activate-udev-rules-late-during-boot.patch
  * kdump-make-sure-that-the-udev-runtime-directory-exists.patch
  * kdump-make-sure-that-initrd.target.wants-directory-exists.patch
  * kdump-check-explicit-ip-options.patch
  * kdump-query-systemd-network.service.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1614945601">- kdump-mounts.cc-Include-sys-ioctl.h.patch: mounts.cc: Include
  &lt;sys/ioctl.h&gt;.</changelog>
  <changelog author="ptesarik@suse.com" date="1617883200">- kdump-Add-bootdev-to-dracut-command-line.patch: Add 'bootdev=' to
  dracut command line (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1622203200">- kdump-do-not-iterate-past-end-of-string.patch: Fix a crash caused
  by iterating past end of string (bsc#1186037).</changelog>
  <changelog author="ptesarik@suse.com" date="1622203201">- kdump-fix-incorrect-exit-code-checking.patch: Fix incorrect exit
  code checking after "local" with assignment (bsc#1184616,
  LTC#192282)</changelog>
  <changelog author="ptesarik@suse.com" date="1622203202">- Fix use of DNS in the panic environment (bsc#1183070):
  * kdump-avoid-endless-loop-on-EAI_AGAIN.patch: Avoid an endless
    loop when resolving a hostname fails with EAI_AGAIN.
  * kdump-install-real-resolv.conf.patch: Install /etc/resolv.conf
    using its resolved path.</changelog>
  <changelog author="ptesarik@suse.com" date="1637841600">- kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd
  location for usrmerge kernels (boo#1190920).</changelog>
  <changelog author="ptesarik@suse.com" date="1638964800">- Update to 0.9.2
  * Isolate fadump initrd within the default one (jsc#SLE-18272)
  * Bug fixes
  * Code cleanups
- Remove patches that have been upstreamed:
  * kdump-mounts.cc-Include-sys-ioctl.h.patch
  * kdump-Add-bootdev-to-dracut-command-line.patch
  * kdump-do-not-iterate-past-end-of-string.patch
  * kdump-fix-incorrect-exit-code-checking.patch
  * kdump-avoid-endless-loop-on-EAI_AGAIN.patch
  * kdump-install-real-resolv.conf.patch
  * kdump-Store-kdump-initrd-in-kernel-image-path.patch
- Remove patches that have been solved differently:
  * kdump-on-error-option-yesno.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1639051200">- Sync with SLE15-SP4 changelog. These patches were never applied
  to Factory:
  * kdump-avoid-endless-loop-EAI_AGAIN.patch
  * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch
  * kdump-calibrate-Fix-kernel-command-line-parsing.patch
  * kdump-do-not-add-rd.neednet.patch
  * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch
  * kdump-ensure-initrd.target.wants-directory.patch
  * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch
  * kdump-Implement-KString-isHexNumber.patch
  * kdump-install-etc-resolv.conf-using-resolved-path.patch
  * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch
  * kdump-remove-console-hvc0-from-commandline.patch
  * kdump-set-serial-console-from-Xen-cmdline.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1641211200">- kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix
  malformation in passing Dracut compression parameters in mkdumprd
  (bsc#1193765).
- Refresh existing patches.</changelog>
  <changelog author="ptesarik@suse.com" date="1642766400">- Update to 1.0
  * Estimate kdump memory requirements at build time
    (jsc#SLE-18441).
- Remove patches that have been upstreamed:
  * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1642766401">- kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate:
  Ignore malformed VMCOREINFO lines (address occasional OBS build
  failures).</changelog>
  <changelog author="ptesarik@suse.com" date="1643716800">- Update to 1.0.2
  * Adjust crash kernel reservation at boot time (jsc#SLE-18441).
- All remaining patches have been upstreamed:
  * kdump-fillupdir-fixes.patch
  * kdump-use-pbl.patch
  * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1643716801">- kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf:
  Add dependency on kdumptool.
- kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network
  interface naming.
- kdump-calibrate-include-af_packet.patch: calibrate: Explicitly
  include af_packet in the test initrd.</changelog>
  <changelog author="ptesarik@suse.com" date="1644321600">- Exclude i586 from SLE builds.</changelog>
  <changelog author="jbohac@suse.com" date="1648728000">- pull sources directly from git using obs_scm
- fix bsc#1190299, bsc#1186272
- remove patches included in upstream git:
  kdump-calibrate-include-af_packet.patch,
  kdump-calibrate-fix-nic-naming.patch,
  kdump-calibrate.conf-depends-on-kdumptool.patch</changelog>
  <changelog author="jbohac@suse.com" date="1651665600">- kdumptool calibrate: add more margin to reservation calculations
  (bsc#1196728)
- remount target filesystem r/w for fadump (bsc1197125)
- stop reloading FADump on CPU hot-add event (jsc#IBM-768)
- mkdumprd: add option to run dracut in debug mode</changelog>
  <changelog author="jbohac@suse.com" date="1665748800">- fix network-related dracut options handling for fadump case
  (bsc#1201051)
- fix broken URL in manpage (bsc#1187312)
- use inst_binary to install kdump-save (bsc#1202981)</changelog>
  <changelog author="jbohac@suse.com" date="1669377600">- Make the kdump-save.service reboot after kdump-save is finished
  (bsc#1204000)
- fix renaming of qeth interfaces (bsc#1204743, bsc#1144337)
- ppc64: rebuild initrd image after migration (bsc#1191410)</changelog>
  <changelog author="jbohac@suse.com" date="1677153600">- run kdump.service only after kdump-early.service (bsc#1196335)
- don't skip infiniband interfaces (bsc#1186745)
  (not a complete fix, requires a patch in dracut as well)</changelog>
</package>
<package pkgid="d6b4f8ab699a8f7d104038a710de733972b5a77917ef61920a4c4ddba0672797" name="keepalived" arch="aarch64">
  <version epoch="0" ver="2.2.2" rel="150400.3.7.2"/>
  <changelog author="mrueckert@suse.de" date="1543406400">- update to 2.0.10
  - Fix compiling on Alpine Linux.
  - Stop printf compiler warning on Alpine Linux due to rlim_t.
  - manpage cosmetic.
  - Fix removing snmpd read threads when snmpd becomes unavailable.
  - Update to support libipset version 7.
  - Use ipset_printf for ipset messages so can go to log.
  - When opening files for write, ensure files can only be read by
    root.  Issue #1048 referred to CVE-2018-19046 regarding files
    used for debugging purposes could potentially be read by non
    root users.  This commit ensures that such log files cannot be
    opened by non root users.
  - Disable fopen_safe() append mode by default If a non privileged
    user creates /tmp/keepalived.log and has it open for read (e.g.
    tail -f), then even though keepalived will change the owner to
    root and remove all read/write permissions from non owners, the
    application which already has the file open will be able to
    read the added log entries.  Accordingly, opening a file in
    append mode is disabled by default, and only enabled if
  - -enable-smtp-alert-debug or --enable-log-file (which are
    debugging options and unset by default) are enabled.  This
    should further alleviate security concerns related to
    CVE-2018-19046.
  - vrrp: add support to constant time memcmp.  Just an update to
    use best practise security design pattern. While comparing
    password or hmac you need to ensure comparison function is time
    constant in order to figth against any timing attacks. We turn
    off potential compiler optimizations for this particular
    function to avoid any short circuit.
  - Make sure a non privileged user cannot read keepalived file
    output Ensure that when a file such as /tmp/keepalived.data is
    written, no non privileged can have a previous version of that
    file already open, thereby allowing them to read the data.
    This should fully resolve CVE-2018-19046.
- drop b7a98f9265ffb5927c4d54c9a30726c76e65bb52.patch: included in
  update</changelog>
  <changelog author="mrueckert@suse.de" date="1547812800">- update to 2.0.11
  - Fix segfault while shutting down when SNMP activity occurs.
    Issue #1061 identified that keepalived could segfault when it
    shut down. It appears that this was caused by data being
    received on the file descriptors that the snmp agent requests
    keepalived to monitor with epoll(). Since the read threads
    weren't being processed during a shutdown, the first time an
    snmp fd was ready, keepalived discarded the read thread. The
    second time that fd became ready there was no thread to handle
    the fd, and, since the assert() statement was not compiled in,
    non existant data was queued to the thread ready queue.  This
    commit changes the assert() calls to continue, so that non
    existant data is no longer queued to the thread ready queue.
  - While shutting down, continue to handle snmp agent fds.  Since
    we don't shutdown the snmp connection until the very end of the
    shutdown process (we need to be able to send snmp traps), we
    should continue to handle the snmp fds on behalf of the snmp
    agent while shutting down.
  - Ensure snmp agent is in correct state when initialising/closing
    Make sure the snmp agent is not already initialised before
    initialising it, and make sure it has been initialised before
    closing it.
  - Disable asserts in bfd code by default and add --enable-asserts
    Asserts were enabled by default in the bfd code, which
    shouldn't be the case.  Add --enable-asserts configure option
    so that the asserts tests can be enabled while debugging.
  - Remove debugging log message accidently left in.
  - Update receive buffers when interface is created.  The receive
    buffer size used by keepalived is based on the largest MTU of
    any interface that keepalived uses. If dynamic interfaces are
    being used and an interface is created after keepalived has
    started, the MTU of the new interface may be larger than the
    previous largest, so the receive buffer may need to be
    increased in size.  Further, if vrrp_rx_bufs_policy is MTU,
    then the kernel receive buffers on the receive socket may need
    to be increased.
  - Handle MTU sizes being changed.  Issue #1068 identified that
    the MTU size wasn't being updated in keepalived if it changed.
    This commit now updates the MTU size and adjusts receive buffer
    sizes accordingly.
  - Fix syntax error in configure.ac.
  - Fix double free when global data smtp_helo_name copied from
    local_name Issue #1071 identified a double free fault. It
    occurred when smtp_helo_name was not set, in which case it was
    set to point to the same malloc'd memory as local_name. At
    termination keepalived freed both local_name and
    smtp_helo_name.  If keepalived needs to use local_name for
    smtp_helo_name it now malloc's additional memory to copy the
    string into.
  - Rename TIMER_MAX to TIMER_MAXIMUM.  ulibC defines TIMER_MAX, so
    to avoid naming conflict rename it.  This issue was reported by
    Paul Gildea &lt;gildeap@tcd.ie&gt; who also provided the patch.
  - Fix segfault when smtp alerts configured.
  - First working version of nftables.
  - Restructed code around how iptables/nftables are called This
    commit also allows building keepalived without iptables
    support, thereby allowing only nftables support.  Adding any
    other mechanism to handle no_accept mode, i.e. blocking
    receiving and sending to/from VIPs should be added to
    vrrp_firewall.c, in a similar way to how nftables/iptables are
    used.
  - Update doc files re nftables.
  - Make nftables handle dont_track_primary appropriately.
  - Fix config reload with nftables.
  - Set base chain priorities from configuration.
  - Use iptables by default if neither iptables or nftables
    configured.  But if the build of keepalived does not include
    iptables, then use nftables default.
  - Stop dumping keywords - left turned on after debugging.
  - Make umask configuration apply to created file.
  - Add libmnl and libnftnl to travis file.
  - Fix compilation failure when NFTNL_EXPR_LOOKUP_FLAGS not
    defined.
  - Fix compilation failure when build with nftables but without
    iptables.
  - Fix order of include files in configure COLLISION test.  Since
    Linux 4.4.11 (commit 1575c09) including linux/if.h after
    net/if.h works, whereas until glibc fix their headers including
    net/if.h after linux/if.h causes compiler redefinition errors.
    Unfortunately the test for the collision was done the wrong way
    round, as identified in issue #1079. The patch included in the
    issue report corrects the order of inclusion of the header
    files.  What we should do is ensure that glibc header files are
    included before Linux header files, so that at least if kernel
    headers from 4.4.11 onwards are used, the conflict will not
    occur.
  - Set CLOEXEC on netlink sockets.
  - Correct error message for invalid route metric.
  - Add track_process for vrrp to monitor if another process is
    running.  Configurations frequently include a track_script to
    check that a process is running, often haproxy or nginx. Using
    any of pgrep, pkill, killall, pidof, etc, has an overhead of
    reading all /proc/[1-9]*/status and/or /proc/[1-9]*/cmdline
    files. In particular reading the cmdline files has a
    significant overhead on a system that is swapping, since the
    cmdline files provide access to part of the address space of
    each process, which may need to be fetched from the swap space.
    This commit reads the /proc/[1-9]*/stat and/or the
    /proc/[1-9]*/cmdline files only when keepalived starts, and
    after that uses the process events connector to track process
    creation and termination.  keepalived will ignore zombie
    processes, whereas pgrep etc include them.  A minimum number of
    instances of a process can be specified, and also a delay so
    that if a process is restarted, it won't cause monitoring vrrp
    instances to immediately transition to fault state but to wait
    the configured time and it the monitored process starts again
    it won't transition to fault state.  There are potential
    difficulties with the process event connector if a large number
    of process events occur very rapidly, since there can be a
    receive buffer overrun on the netlink socket. This code will
    detect that happening, increase the receive buffer size, and
    reread the processes from /proc.
  - Add missing #include to track_process.c.
  - Fix number of elements of fd_set read for snmp select info.
  - Remove thread_event_t when EPOLL_CTL_DEL fails.  If snmpd
    closes a file descriptor, when keepalived attempts to
    unregister the fd from epoll an error is returned. However, we
    still need to remove the thread_event_t from the io_events
    rbtree.
  - Fix connection to snmpd after it has to reconnect.  Issue #1080
    identified that keepalived wasn't handling a connection failure
    and reconnect to snmpd properly. The problem was created when
    the change from select() to epoll() was made.  This commit
    makes keepalived unregister and reregister the snmp file
    descriptors after snmpd reconnects.
  - Fix retry count for SMTP_CHECK checker.  The checker was doing
    one too few retries.
  - Make healthchecker failure reporting consistent Some
    healthcheckers were reporting all failures, and others only
    when the retries expired. This commit by default makes the
    checkers only report failure when the retries expire, unless
    the global keyword checker_log_all_failures or log_all_failures
    on the specific checker is configured.
  - After reload, reinitialise current track processes state.
  - Remove unused variable in track_process.c.
  - Add configure checks re --with-kernel-dir.
  - Convert remaining select() to epoll_wait().  keepalived was
    using select() for handling the termination of child processes,
    but the main scheduling loop now uses epoll_wait(), so convert
    the select() to epoll_wait() from consistency.
  - Stop keepalived leaving zombie child processes.  keepalived
    wasn't reaping the termination of its child processes, so this
    commit adds waitpid() calls once it knows the processes have
    terminated.
  - Fix make distclean and make distcheck.
  - Also skip route not configured with down interface.  Otherwise,
    if keepalived has virtual_routes configured, we create a
    virtual interface and bring it up and down, current code will
    bring VRRP state to FAULT and never return.
  - Stop vrrp process entering infinite loop when track script
    times out Issue #1093 identified that the vrrp process was
    entering an infinite loop after a track script timed out. This
    was due to a child process thread having an RB tree for PIDs as
    well as for the timeout, and if a child process timed out, the
    thread wasn't being removed from the PID RB tree. This commit
    now ensures it is removed.
  - Fix the abbreviation of Shortest Expected Delay.
  - Don't free unallocated memory if not tracking processes.
  - vrrp: Rewrote JSON code Remove dependency to json-c extralib by
    using a simple streaming JSON writter.  Refactored code to make
    it simple to maintain.
  - vrrp: Fix JSON handling for v{route;rule}.
  - autoconf: fix nftables selection We need to inhibit nftable
    compilation if compiling system has kernel header file
    nf_tables.h but not libnftnl nor libmnl.</changelog>
  <changelog author="mrueckert@suse.de" date="1547899200">- fix build on 42.3/sle12 by disabling http regexp check support
- add nftables to the BR
- cleanup BR support for sle11, moved almost all BR to pkgconfig
  style
- disable dbus instance creation support as it is marked as
  dangerous</changelog>
  <changelog author="mrueckert@suse.de" date="1553083200">- update to 2.0.13
  - Add BFD build option to keepalived.spec rpm file
    Issue #1114 identified that the keepalived.spec file was not being
    generated to build BFD support even if keepalived had been configured
    to support it.
  - Copy tarball to rpmbuild/SOURCES when building in place
    It seems that even when building in place, rpmbuild expects the
    tarball to be in the rpmbuild/SOURCES directory.
  - Fix configure check for __always_inline
  - Handle interface MAC addresses changing
    When an interface is added to a bond interface, if it is the first
    interface added, the MAC address of the bond interface is changed
    to the MAC address of the added interface. When subsequent interfaces
    are added, their MAC addresses are changed to that of the bond
    interface.
    Issue #1112 identified that if a bond interface is deleted and
    recreated, the gratuitous ARPs were sent with the wrong source MAC
    address.
    This commit now updates interface MAC addresses from the netlink
    RTM_NEWLINK messages, so that the correct MAC address is always
    used.
  - Minor tidying up of opening gratuitous ARP socket.
  - Streamline setting SOCK_NONBLOCK on vrrp sockets.
  - Use netlink reported hardware address length for unsolicited NAs
    ETH_ALEN is correct for Ethernet type interaces, but is not right
    for Infiniband interfaces.
  - Minor tidying up of opening gratuitous NA socket.
  - Make gratuitous ARP/NA sockets non blocking
    keepalived shouldn't block when sending gratutious ARP/NA messages.
    It is better to lose the messages than for keepalived to block, so
    set the sockets non blocking.
  - Use netlink provided broadcast address for gratuitous ARP
    If an interface has a non-standard broadcast address, we should
    honour it.
  - Fix building on pre 3.10 kernels re track_process
    Issue #1119 reported that keepalived wouldn't build on CentOS 6.
    Various PROC_EVENT_- declarations were assumed to exist, some of which
    were not introduced until Linux v3.10. Most of them are not needed, but
    PROC_EVENT_COMM is used by the track_process code.
    This commit now checks for the existence of the PROC_EVENT_- declarations,
    but since keepalived uses PROC_EVENT_COMM, track_process is not supported
    prior to Linux v3.2.
  - Make track_process work prior to Linux 3.2, but with limitations
    Prior to Linux 3.2 the PROC_EVENT_COMM event did not exist, which
    means that keepalived is unable to detect changes to process name
    (/proc/PID/comm) prior to Linux 3.2. most processes do not change
    their process name, and so using track_process prior to Linux 3.2
    is safe so long as the monitored processes are known not to change
    their process name.
  - Stop configure failing when nftables is not supported.
  - Streamline socket use with linkbeat.
    Previously the socket used for ioctls was opened and closed twice per
    poll if using MII or ETHTOOL polling, and once per poll if using ioctl
    polling. This commit opens the socket once at startup, uses that socket
    for all linkbeat polls, and closes it on termination.
  - Enable linkbeat polling to work with dynamic interfaces.
  - Add linkbeat_interfaces configuration block
    It was not possible to indicate that an interface that wasn't used
    as the interface of a vrrp instance, but was used either as a track
    interface, or for virtual/static ip addresses or routes should use
    linkbeat. This commit adds that capability.
  - Add ability to specify linkbeat type in linkbeat_interfaces block.
  - Add --disable-linkbeat configure option
    Does anyone use linkbeat anymore? This commit enables keepalived to
    be build without the linkbeat code.
  - Don't remove link local IPv6 address from VMAC that isn't keepalived's
    If IFLA_INET6_ADDR_GEN_MODE isn't supported and a macvlan interface
    already had a (non-default) link local addresss and the link local
    address that matched the interface's MAC address was added, keepalived
    was removing it as soon as it was added. This commit stop keepalived
    removing the address when we shouldn't.
  - Set configure init type correctly in keepalived.spec file.
  - Fix handling of VMACs with multiple reloads
    If a configuration is loaded that has a VRRP instance using a VMAC,
    then the configuration is updated to remove that VRRP instance and
    keepalived reloads its configuration, then the configuration is
    updated again to reinstate the VRRP instance and the configuration
    is again reloaded, keepalived thought the VMAC interface still
    existed, whereas it was deleted following the first reload.
    This commit ensures that keepalived properly detects whether an
    interface exists following a reload.
  - Remember more than one interface local address per interface
    Keepalived needs a local address for each interface it sends adverts
    on. If the address keepalived is using is deleted and another address
    is configured on the interface, then keepalived should start using
    that address. To do this, a list of configured address on each
    interfaces needs to be maintained.
  - Don't consider VIPs as local addresses when restart after crash
    Keepalived maintains a list of addresses per interface that can be
    used as source adddresses for adverts. To build the list, keepalived
    reads the addresses configured on interfaces when it starts. However,
    if keepalived crashed it will have left VIPs configured on interfaces,
    and we don't want to use them as advert source addresses.
    This commit makes keepalived compare the addresses on interfaces
    to VIPs, and ignores any addresses that are VIPs.
  - Fix removing left over VIPs at startup.
  - Use read_timer() when parsing config where appropriate.
  - Allow fractional warmup, delay_loop and delay_before_retry for checkers
    To shorten the real server monitoring interval, make it possible to specify
    decimal value for following items:
    warmup
    delay_loop
    delay_before_retry
  - Update connect_timeout configuration options
    Based on the patch submitted by tamu.0.0.tamu@gmail.com this patch
    allows setting the connect_timeout to a resolution of micro-seconds.
    The patch also adds the ability to set a default value at the virtual
    server and real server levels.
  - Fix unused variable warning when building only with RFC compliant
    SNMP.
  - It enable to set zero value as mintime for delay_loop and connect_timeout.
  - Add option not to check for EINTR if using signalfd()
    If keepalived is using signalfd(), there are no asynchronous signal
    handlers, and therefore EINTR cannot be returned.
    Currently the check for EINTR is enabled by default, and configure
    option --disable-eintr-debug disables the check, while
  - -enable-eintr-debug enables writing log entries if EINTR is returned.
    Once sufficient testing has been performed, the default will be
    changed not to test for EINTR if signalfd() is supported.
  - Make checking for EAGAIN/EWOULDBLOCK consistent
    The code in some places checked errno for EAGAIN and EWOULDBLOCK
    and in other places only checked EAGAIN. On Linux EAGAIN == EWOULDBLOCK,
    so the check is not necessary, but EAGAIN is not guaranteed to be the
    same value as EWOULDBLOCK, so define check_EAGAIN that only checks EAGAIN
    if they are the same value, but checks both if they are different.
  - Ensure default connection timeout for smtp checker hosts set.
  - Set default connection timeout if no smtp check host specified.
  - Fix min timer value, zero to 0.000001Sec.
  - Add fixing min time for vs_co_timeout_handler() and rs_co_timeout_handler().
  - Fix parameter of read_timer(), it treat Mintime and Maxtime as microseconds.
  - vrrp: vrrp_dispatcher_read() performance extension
    We took time with Quentin to simulate and rework this code. We introduced
    2 imbricated while loop:
    (1) First one is catching recvfrom EINTR (this code trig
    only on kernel older than 2.6.22 where signalfd was firstly introduced).
    Newer kernel will immediately break the loop (hey guys: if you are running
    older than 2.6.22 it is worth considering upgrading).
    (2) Second loop will continue reading from socket until same VRID advert
    has been received during the same cycle. After simulating, it appears that
    during contention with a lot of VRRP instances (around 1500), this design
    is needed to relax socket recvq from growing. This can be viewed as a
    Poll-Mode activation during contention and fallback to regular I/O MUX
    during normal operations. This loop breaks immediately and re-submit
    opration to I/O MUX when there is no more to be read.
  - Fix conversion from long for double in read_timer().
  - Remove variable timer of unsigned long cast in read_timer().
    When Double type variable timer is cast to long type, it's scale falls.
- changes from2.0.12
  - Documentation related.
    Remove keepalived.conf.SYNOPSIS content to make a pointer to manpage.
    Update README manifest to reflect actual Keepalived goal and features.
  - Improve error message if process events connector not enabled in
    kernel.
  - Add option to disable track-process functionality
    Issue #1099 reported that their kernel did not support the proc events
    connector, and it would therefore be helpful to have an option to build
    keepalived without the track-process functionality.
    This commit adds the --disable-track-process configure option.
  - Fix vrrp instances going to fault state when have virtual routes
    If an interface going down caused a vrrp instance to go to fault
    state, and the vrrp instance also had virtual routes, the state
    of the vrrp instance would be set to backup when the deletion of
    the virtual route was detected. This commit ensures that the vrrp
    instance stays in fault state until the interface is brought up
    again.
  - Remove Red Hat Linux 9 and RH Enterprise Linux 3 from spec file.
    Red Hat Linux 9 and Red Hat Enterprise Linux 3 are both based on
    Linux 2.4, which is no longer supported by keepalived. The options
    in the spec file for Reh Hat Linux 9 have twice caused people to
    specify wrong options to configure when trying to build keepalived,
    so the options are removed to i) avoid confusion and ii) they are
    not longer relevant.
  - Add global option vrrp_min_garp.
    By default keepalived sends 5 gratuitous ARP/NA messages after
    transitioning to master, and 5 more 5 seconds later. This isn't
    necessary with modern switches, and so if the vrrp_min_garp option
    is set, only one gratuitious ARP/NA message is sent after transition
    to master, and no repeat messages are sent 4 seconds later.
  - Standardise definition of _INCLUDE_UNUSED_CODE_
  - Remove out of date comment re VRRP over IPv6.
  - Correct typo in keepalived.conf.5.
  - Directly use structure sizes for packet header lengths.
  - vrrp_state_fault_rx() is not used.
    Wrap the function in conditional compilation so it is not compiled
  - Convert so list loops to use LIST_FOREACH.
  - Don't recalculate vrrp packet header address.
    vrrp_get_header() calculates the address of the vrrp header in a
    received packet, but it was being recalculated in vrrp_in_chk().
    This commit passes the already calculated address to vrrp_in_chk().
  - Ensure a received packet has an AH header if and only if AH auth.
    Ensure that a received packet has an AH header if we expect AH
    authentication, and doesn't have an AH header if we don't expect
    AH authentication.
  - Ensure all protocol headers received before return pointer to vrrp header
    vrrp_get_header() returns a pointer to the vrrp header, but it now returns
    NULL if insufficient data has been received to include all the (IP,
    possibly AH, and VRRP) headers (this does not include the VIPs in the VRRP
    packet).
    This means that when a pointer to the VRRP header is returned, all fields in
    all protocol headers can safely be accessed.
  - Add check of received IPv6 hop count in multicast adverts
    The VRRP RFC requires that IPv6 hop count MUST be checked to be 255,
    just as the TTL for IPv6 must be 255. Previously that wasn't being
    checked, since IPv6 raw sockets don't provide access to the IPv6
    header.
    Using recvmsg() rather than recvfrom(), and setting socket option
    IPV6_RECVHOPLIMIT allows keepalived to receive the hop count as
    ancillary data, and that can now be checked.
  - Improve reading from vrrp receive sockets.
    Previously no check was made of the return value from recvfrom()/
    recvmsg(). This meant than an error could occur (e.g. EINTR), or no
    data might be returned, and keepalived would still attempt to process
    the receive buffer as though data had been received.
  - Enhance and streamline checking of validity of received VRRP packet
    This includes checking that a packet is multicast, unless unicast is
    expected in which case it is checked for unicast, ensuring that if
    AH authentication is used, the next header protocol is VRRP.
    The sequence of some checks is revised to ensure that the fields being
    checked are valid to be accessed prior to accessing them, e.g. check
    that the packet is VRRP version 2 before checking the authentication.
  - Stop clearing receive buffer before receiving VRRP packets.
    This is no longer necessary now that the appropriate checks are
    made of the return status of recvmsg(), and also that the checks
    of received packet length and packet headers now do all necessary
    checks.
  - Add compile time checks for IPV6_RECVHOPLIMIT/IPV6_RECVPKTINFO
    support.
  - Update keepalived.spec.in build-requires.
    The kernel package required for building keepalived is kernel-headers
    not kernel-devel. Also, it is superfluous to have package kernel in
    the build-requires!
  - Add missing file (build.setup) to tarball.
  - Fix calculating print format to rlim_t in configure.ac.
  - Fix compiler warnings on 32 bit systems re HASH_UPDATE.
    Removing all the casts stopped the warnings.
  - Use PRI_rlim_t when printing rlim_t types.
  - Use %zd/%zu for ssize_t/size_t to avoid warnings on 32 bit systems.
  - Fix some space/tab formatting.
  - Stop declaring some timer definitions unsigned to stop compiler
    warnings.
    TIMER_HZ, TIMER_CENTI_HZ, NSEC_PER_SEC were causing some compiler warnings
    on some systems due to being defined with a 'U' unsigned suffix. Removing
    the unsigned specifier stopped the compiler warnings.
  - Fix compiler warning due to incorrect format specifier.
    An int64_t should use % PRIi64 and not %ld
  - Stop an uninitialized variable compiler warning.
  - Fix MEM_CHECK debugging on processors without unaligned memory
    access.
  - Don't attempt to use unopened socket for getting ipset version.
  - Tidy up an error message.
  - vrrp: make vrrp_dispatcher_read() async while catching error.
    During investigations we decided to update previous patch to resubmit
    into I/O MUX on read error. It will make read procedure I/O MUX freindly
    by removing potential sync operation potentially leading to a global
    I/O MUX desync. We aggreed, the situation is really and very exceptionnal
    but could happen.
  - vrrp: vrrp_arp_thread split.
    Split the function for maintainability purpose.</changelog>
  <changelog author="mrueckert@suse.de" date="1554292800">- update to 2.0.14
  - Add compiler warning -Wfloat-conversion and fix new warnings.
    It was discovered that passing 0.000001 as a parameter
    specified as uint32_t to a function did not generate any
    warning of type mismatch, or loss of precision.  This commit
    adds -Wfloat-conversion and fixes 3 instances of new warnings
    that were generated.
  - For non systemd enviroment, it occurs syntax error 'fi'.  To
    avoid syntax error, modify keepalived.spec.in.
  - When uninstall keepalived with init upstart, stop keepalived
    process.
  - Fix type re LOG_INGO should be LOG_INFO - 6git stash --cached.
    The code was actualy in a #ifdef INCLUDE_UNUSED_CODE block, and
    so isn't currently compiled.
  - Register missing thread function for thread debugging.
  - Fix reutrn value of notify_script_compare misusing issue.
  - Fix typo in keepalived.conf man page re BFD min_rx.
  - Fix segfault when bfd process reloads config.  Issue #1145
    reported the bdf process was segfaulting when reloading.  The
    bfd process was freeing and allocating a new thread_master_t
    when reloading, which doesn't work. This commit changes the bfd
    process to clean and reinitialise the thread_master_t.
  - Fix segfault in handle_proc_ev().  On Linux 3.10 the ack bit
    can be set in a connector message, and the CPU number is set to
    UINT32_MAX. This commit skips acks, and also checks that CPU
    number is within range of the number of CPUs on the system.
  - Fix OpenSSL init failure with OpenSSL v1.1.1.  OpenSSL v1.1.1,
    but not v1.1.0h or v1.1.1b failed in SSL_CTX_new() if
    OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG) had previously
    been called.  This commit doesn't call OPENSSL_init_crypto() if
    doing so causes SSL_CTX_new() to fail.
  - Remove all references to libnfnetlink.  Commit 2899da6 (Stop
    using linbl for mcast group membership and setting rx buf
    sizes) stopped using libnfnetlink, but INSTALL and
    keepalived.spec.in were not updated accordingly.
  - Fix genhash re OPENSSL_init_crypto bug and improve
    configure.ac.  Commit fe6d6ac (Fix OpenSSL init failure with
    OpenSSL v1.1.1) didn't update the identical code in
    genhash/ssl.c. Also, an improvement for the test in
    configure.ac was suggested.
  - Fix log output when real server removed.  FMT_VS() and FMT_RS()
    both call inet_sockaddrtotrio which uses a static buffer to
    return the formatted string, but since FMT_VS(), wheich simply
    calls format_vs() copies the returned string to its own static
    buffer, if FMT_VS() was called before FMT_RS() then the
    returned strings from both could be used.  The problem occurs
    when both FMT_VS() and FMT_RS() are used as parameters to
    log_message() (or printf etc). It appeared to work fine on
    x86_64, but was writing the same IP address for both the real
    server and virtual server on ARM architectures. This is due to
    the compiler evaluating parameters to the log_message()
    function call in a different order on the different
    architectures.  This commit adds inet_sockaddrtotrio_r() which
    allows the output to be in a buffer specified by the caller,
    and so FMT_VS() and FMT_RS() can now be called in either order
    without one overwriting a buffer used by the other.
  - Streamline some string formatting with FMT_RS() and FMR_VS().
    Following commit 9fe353d (Fix log output when real server
    removed) some code can be streamlined now that the order of
    calling FMT_VS() and FMT_RS() does not matter.
  - Replace FMT_HTTP_RS(), FMT_TCP_RS() and FMT_DNS_RS() with
    FMT_CHK().  They were all simply defined to be FMT_CHK() so
    just replace them with that. This made it much simpler to find
    all used of FMT_CHK().
  - Fix building with gcc 4.4.7 (Centos 6.5).  gcc v4.4.7 doesn't
    support -Wfloat-conversion, so check for it at configure time.
  - Add dumping checker config/status when receive SIGUSR1.
  - Don't put alpha mode checkers into failed state at reload If a
    new checker is added at a reload, unless the real server aleady
    has failed checkers, then ignore the alpha mode of the checker.
    This means that the real server, if up, won't be taken down and
    then brought back up again almost straight away. If the real
    server already has failed checkers, then setting an alpha mode
    checker down initially won't take down the real server, so we
    can allow the alpha mode setting to apply.
  - Handle alpha mode checkers initial failure at startup better.
  - Fix compile failure discovered by Travis-CI.
  - Fix calling syslog when not using signalfd().  Pull request
    [#1149] identified that syslog is AS-Unsafe (see signal-safety
    man page), and that therefore signals should be blocked when
    calling it.  This commit blocks signals when calling
    syslog()/vsyslog() when signalfd() is not being used.
  - Rationalise function attributes.
  - Fix enable-optimise configure option.
  - Use AS_HELP_STRING for all options in configure.ac.
  - Streamline genhash -h option.
  - Make genhash -v version match keepalived.
  - Fix config check of virtual server quorum against weights of
    real servers.
  - Fix some configure tested checks for OPENSSL_init_crypto.
  - Add infrastructure for adding additional compiler warnings.
  - Add standard and extra compiler warnings.
  - Add and resolve missing-declarations and missing-prototypes
    warnings Approximately 16 additional functions are now declared
    static.
  - Add and resolve old-style-definitions warnings
  - Add and resolve redundant-decls warnings
  - Add and resolve jump-misses-init warnings
  - Add and resolve shadow warnings
  - Add and resolve unsuffixed-float-constants warnings
  - Add and resolve suggest-attribute=const warnings
  - Add and resolve suggest-attribute=format warnings
  - Add and resolve suggest-attribute=malloc warnings
  - Add and resolve suggest-attribute=noreturn warnings
  - Add and resolve suggest-attribute=pure warnings
  - Add and resolve unused-macros warnings
  - Add and resolve null-dereference warnings
  - Add and resolve float-equal warnings
  - Add and resolve stack-protector warnings
  - Add and resolve strict-overflow=4 warnings
  - Add and resolve pointer-arith warnings This particularly
    includes adding a number of bytes to a void -.
  - Add and resolve cast-qual warnings
  - Resolve additional warnings identified on Centos 6.5/gcc 4.4.7
  - Remove static from zalloc()
  - Fix some compiler warnings on Ubuntu Xenial, and add comments
    re others.
  - Rename LIST parameters to lst in list_head.h to avoid upper
    case.
  - Fix real server checkers moving from failed to OK on reload.
  - add rs judgement in migrate_checkers.
  - Detect connection failure in genhash and exit rather than loop.
  - Add another function pure attribute.
  - Fix sending notifies for vrrp instances at startup when in sync
    group Issue #1155 idenfified that notify scripts for vrrp
    instance transition to backup state when keepalived started up
    were not being sent if the vrrp instance was in a sync group.
    It was also the case that SNMP traps, SMTP alerts and FIFO
    notifies were not being sent either.  This commit make
    keepalived send the initial notifies when the vrrp instance is
    in a sync group.
  - Fix building keepalived RPM on Fedora 26.  For some reason
  - fPIC is needed when testing for the presence of setns().
  - Add vrrp_startup_delay configuration option.  Some systems that
    start keepalived at boot time need to delay the startup of the
    vrrp instances, due to network interfaces taking time to
    properly come up. This commit adds a global configuration
    option vrrp_startup_delay that delays the vrrp instances
    starting up, for the specified number of seconds.
  - Handle checkers properly when reload immediately after startup.
  - Streamline some of the SMTP checker code.
  - Create separate checker for each host in SMTP_CHECK block
    Having multiple host entries in an SMTP_CHECK block is
    deprecated.  This commit streamlines the SMTP_CHECK code by
    creating a separate SMTP checker for each host declared in the
    SMTP_CHECK block, so that apart from parsing the configuration,
    the code no longer handles multiple hosts per checker.  The
    support for parsing configuration with multiple hosts is only
    enabled if WITH_HOST_ENTRIES is defined in check_smtp.c. It is
    currently enabled, but when support for multiple hosts in the
    SMTP_CHECK block is finally removed, it will simply be a matter
    of deleting all code in the WITH_HOST_ENTRIES conditional
    blocks.
  - Make checker fail if ENETUNREACH returned by connect().  The
    connect() call can return some immediate errors such as
    ENETUNREACH.  These were not being treated as a failure of the
    checker, since the code used to assume that any non success
    return by connect() meant that the connection was in progress.
    keepalived will now treat ENETUNREACH, EHOSTUNREACH,
    ECONNREFUSED, EHOSTDOWN, ENETDOWN, ECONNRESET, ECONNABORTED,
    ETIMEDOUT, when returned by connect(), as meaning that the
    checker has failed.
  - Don't set SO_LINGER with a timeout of 0 SO_LINGER with a
    timeout of 0 causes a TCP connection to be reset rather than
    cleanly closed. Instead of specifying a timeout of 0, use 5
    seconds, so that there is an orderly shutdown of the TCP
    connection, but the close socket doesn't remain in TIMED_WAIT
    state for more than a short time.
  - nftables: fix build with kernel lower than 4.1.
  - Remove dead code and cosmectics.  Remove code marked as UNUSED
    where things simply go nowhere even if define is set. We keep
    for the moment UNUSED code related to debug helpers used during
    coding process.</changelog>
  <changelog author="mrueckert@suse.de" date="1554292801">- add buildrequires for file-devel
  - used in the checker to verify scripts</changelog>
  <changelog author="mrueckert@suse.de" date="1555416000">- update to 2.0.15
  - Fix uninitialised variable.
  - Fix rpmbuild on CentOS7, and rely on auto-requires.
  - Add option to flush lvs on shutdown.  Currently all known
    virtual servers and their real servers are removed one at a
    time at shutdown. With large configurations on a busy system,
    this can take some time.  Add an option just like the existing
    'lvs_flush' which operates on shutdown. Typical environments
    with a single keepalived instance can take advantage of this
    option to achieve a faster shutdown or restart cycle.
  - Make alpha mode checkers on new real servers start down on
    reload.  Patch #1180 identified that new real servers with
    alpha mode checkers were being added online immediately, and if
    the checker then failed were being removed. This commit makes
    real servers that didn't exist before the reload start in down
    state if they have alpha mode checkers.
  - Remove duplicate config dump entry.
  - Make new real servers at reload start down if have alpha mode
    checkers.
  - Close checker and smtp_alert sockets on reload.  Issue #1177
    identified that sockets were being left open (lost) after a
    reload. It transpired that these were sockets opened by
    TCP_CHECK, HTTP_GET, SSL_GET, DNS_CHECK and SMTP_CHECK
    checkers, and by smtp_alerts in the process of being sent.
    This commit adds an extra parameter to thread_add_read() and
    thread_add_write() to allow indicating that the scheduler
    should close the socket when destroying threads.
  - Send vrrp group backup notifies at startup.
  - Make inhibit_on_failure be inherited by real server from
    virtual server.
  - Allow real and sorry servers to be configured with port 0 This
    is to maintain backwards compatibility with keepalived prior to
    commit d87f07c - "Ensure always check return from
    inet_stosockaddr when parsing config".  The proper way to
    configure this is to omit the port, which requires the next
    commit.
  - Don't setup IPVS config with real and virtual servers ports
    different.  If the real server is using DR or TUN, the port of
    the real server must be the same as the port of the virtual
    server. This commit uses the virtual server port for the real
    server when configuring IPVS.
  - Log warnings if real server and virtual server ports don't
    match This commit adds logging warnings if virtual and real
    server ports, when using TUN or DR, don't match.  It also sets
    the real server ports to be the same as the virtual server
    ports. Although listing the IPVS configuration with ipvsadm
    will look different, the kernel ignored the port of a real
    server when using DR or TUN, so the behaviour isn't changed,
    but when looking at the configuration it now shows what is
    actually happening.
  - Fix warning when protocol specified for virtual server with
    fwmark.
  - Add log message that nb_get_retry is deprecated.
  - Fix whitespace in configure.ac.
  - Fix configure error when systemd not installed configure was
    trying to execute pkg-config --variable=systemdsystemunitdir
    systemd even if systemd was not available.  This commit makes
    configure only execute the above if it has determined that
    systemd is the correct init package to use.
  - Correct references to RFC6527 (VRRPv3 SNMP RFC).
  - nsure checker-&gt;has_run is always set once a checker has run.
  - Fix some indentation in configure.ac.
  - Update fopen_safe() to open temporary file in destination
    directory rename() in fopen_safe() was failing if the file
    being created was not on the same filesystem as /tmp.
  - Add ${_RANDOM} configuration keyword.  It might seem strange to
    introduce random elements to configuration files, but it can be
    useful for testing.
  - Fix using ~SEQ() in multiline configuration definitions.
  - Make blank lines terminate a multiline definition.
  - Minor updates for lvs_flush_on_stop.
  - Add option to skip deleting real servers on shutdown or reload
    If a virtual server is removed, the kernel will remove its real
    servers, so keepalived doesn't explicitly need to do so.  The
    lvs_flush_onstop option removes all LVS configuration, whereas
    this new option will only remove the virtual servers managed by
    keepalived.
  - Correct error message re checker_log_all_failures.
  - Fix syntax error in configure.ac.
  - Fix track_process initialisation for processes with PIDs
    starting 9.
  - Remove debugging log message.
  - Remove inappropriate function const attributes They were
    causing iptables/ipsets not to be initialised.
  - Stop warning: function might be candidate for attribute
    "const" Depending on what configure options are selected,
    gcc can output the above warning for
    initialise_debug_options().  This commit ensures that the
    warning is not produced.
  - Enable strict-config-checks option in keepalived.spec RPM file.
  - vrrp: relax attribute 'const' warning at iptables helpers.
  - Propagate libm to KA_LIBS.
  - Fix building on Alpine Linux.  Alpine (musl) doesn't have a
    definition of __GNU_PREREQ, so create a dummy definition.</changelog>
  <changelog author="mrueckert@suse.de" date="1555416001">- added systemd-after-snmp.patch:
  If you want to use the snmp support the masterx socket needs be
  available otherwise the snmp support is broken
  strictly speaking we would need to use BindsTo= here but that
  would require that add a Requires for net-snmp to the keepalived
  package. to be discussed.</changelog>
  <changelog author="chris@computersalat.de" date="1563883200">- Update to 2.0.17 (2019-06-25)
  * https://www.keepalived.org/changelog.html
- remove obsolete patch
  * systemd-after-snmp.patch
- rebase patch
  * linux-4.15.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1573128000">- update to 2.0.19
  Fix minor IPVS features support. Extend BFD to support more than
  one BFD instance with a neighnour. Extend nftable support. Script
  timeout extension. Properly filter IGMP/MLD packets on VMAC
  interface. Refer to ChangeLog for more infos.
  https://keepalived.org/changelog.html
- changes from 2.0.18
  Add support to IPVS new GUE tunnel type. New feature 'weight
  reverse' available in all trackers. Resolve all outstanding
  coverity issues. Some fixes and performance extensions. Refer to
  ChangeLog for more infos.
  https://keepalived.org/changelog.html</changelog>
  <changelog author="mrueckert@suse.de" date="1573128001">- new BR pkgconfig(libnftnl) to fix nftables support</changelog>
  <changelog author="dakechi@suse.com" date="1584100800">- Inclusion into SLE as ACC supported packages
  (bsc#1158280, ECO#223)</changelog>
  <changelog author="mrueckert@suse.de" date="1611662400">- Update to 2.2.1
  https://www.keepalived.org/release-notes/Release-2.2.1.html
  https://www.keepalived.org/release-notes/Release-2.2.0.html
  https://www.keepalived.org/release-notes/Release-2.1.5.html
  https://www.keepalived.org/release-notes/Release-2.1.4.html
  https://www.keepalived.org/release-notes/Release-2.1.3.html
  https://www.keepalived.org/release-notes/Release-2.1.2.html
  https://www.keepalived.org/release-notes/Release-2.1.1.html
  https://www.keepalived.org/release-notes/Release-2.1.0.html
- enable systemd integration via libsystemd (new BR: libsystemd)
- switch to systemd_ordering instead of systemd_requires
- sync configure options with the configure script</changelog>
  <changelog author="mrueckert@suse.de" date="1613649600">- Make sure we pull in the libraries we need for dlopen, by
  following the symlinks from the .so symlinks with the
  requires_file macro.</changelog>
  <changelog author="mrueckert@suse.de" date="1615118400">- Update to 2.2.2
  https://www.keepalived.org/release-notes/Release-2.2.2.html
- change how we install documentation to avoid duplicated files
- Link all the files for ipset, iptables, libnl instead of dlopen.
  Drop the previous workaround for generating requires for the
  dlopen-ed libaries.
- remove unsupported configure option: --enable-libiptc</changelog>
  <changelog author="mrueckert@suse.de" date="1615204800">- drop linux-4.15.patch: No longer needed as it was a backport from
  upstream
- Cleanup configure options after consultation with upstream:
  - --enable-regex-timers is for debugging purposes
  - --enable-snmp-checker and --enable-snmp-vrrp are enabled by
  - -enable-snmp
  - --enable-snmp-rfcv2 and --enable-snmp-rfcv3 anre enabled by
  - -enable-snmp-rfc
  - --enable-stacktrace is definitely a debugging option
- on systems where we have nftables support we will only ship with
  nftables support (&gt;= 15.0) and use iptables support only on older
  distributions.</changelog>
  <changelog author="dmueller@suse.com" date="1626868800">- add 1915.patch to fix build on tumbleweed</changelog>
  <changelog author="jsegitz@suse.com" date="1632744000">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_keepalived.service.patch</changelog>
  <changelog author="varkoly@suse.com" date="1659960000">- VUL-0: CVE-2021-44225: keepalived: possible privilege escalation
  due to insufficient control in the D-Bus policy (bsc#1193115)
  apply upstream patch:
  * 0001-dbus-fix-policy-to-not-be-overly-broad.patch</changelog>
  <changelog author="varkoly@suse.com" date="1661774400">- FATAL: Module ip_vs not found in directory /lib/modules/5.14.21-150400.24.18-default
  (bsc#1202808)
  Set ProtectKernelModules to false in service file</changelog>
</package>
<package pkgid="2218b9dd93679fa466a38ae46eb774e00d62faabee954fec41b5803f11c8c48d" name="keepalived" arch="src">
  <version epoch="0" ver="2.2.2" rel="150400.3.7.2"/>
  <changelog author="mrueckert@suse.de" date="1543406400">- update to 2.0.10
  - Fix compiling on Alpine Linux.
  - Stop printf compiler warning on Alpine Linux due to rlim_t.
  - manpage cosmetic.
  - Fix removing snmpd read threads when snmpd becomes unavailable.
  - Update to support libipset version 7.
  - Use ipset_printf for ipset messages so can go to log.
  - When opening files for write, ensure files can only be read by
    root.  Issue #1048 referred to CVE-2018-19046 regarding files
    used for debugging purposes could potentially be read by non
    root users.  This commit ensures that such log files cannot be
    opened by non root users.
  - Disable fopen_safe() append mode by default If a non privileged
    user creates /tmp/keepalived.log and has it open for read (e.g.
    tail -f), then even though keepalived will change the owner to
    root and remove all read/write permissions from non owners, the
    application which already has the file open will be able to
    read the added log entries.  Accordingly, opening a file in
    append mode is disabled by default, and only enabled if
  - -enable-smtp-alert-debug or --enable-log-file (which are
    debugging options and unset by default) are enabled.  This
    should further alleviate security concerns related to
    CVE-2018-19046.
  - vrrp: add support to constant time memcmp.  Just an update to
    use best practise security design pattern. While comparing
    password or hmac you need to ensure comparison function is time
    constant in order to figth against any timing attacks. We turn
    off potential compiler optimizations for this particular
    function to avoid any short circuit.
  - Make sure a non privileged user cannot read keepalived file
    output Ensure that when a file such as /tmp/keepalived.data is
    written, no non privileged can have a previous version of that
    file already open, thereby allowing them to read the data.
    This should fully resolve CVE-2018-19046.
- drop b7a98f9265ffb5927c4d54c9a30726c76e65bb52.patch: included in
  update</changelog>
  <changelog author="mrueckert@suse.de" date="1547812800">- update to 2.0.11
  - Fix segfault while shutting down when SNMP activity occurs.
    Issue #1061 identified that keepalived could segfault when it
    shut down. It appears that this was caused by data being
    received on the file descriptors that the snmp agent requests
    keepalived to monitor with epoll(). Since the read threads
    weren't being processed during a shutdown, the first time an
    snmp fd was ready, keepalived discarded the read thread. The
    second time that fd became ready there was no thread to handle
    the fd, and, since the assert() statement was not compiled in,
    non existant data was queued to the thread ready queue.  This
    commit changes the assert() calls to continue, so that non
    existant data is no longer queued to the thread ready queue.
  - While shutting down, continue to handle snmp agent fds.  Since
    we don't shutdown the snmp connection until the very end of the
    shutdown process (we need to be able to send snmp traps), we
    should continue to handle the snmp fds on behalf of the snmp
    agent while shutting down.
  - Ensure snmp agent is in correct state when initialising/closing
    Make sure the snmp agent is not already initialised before
    initialising it, and make sure it has been initialised before
    closing it.
  - Disable asserts in bfd code by default and add --enable-asserts
    Asserts were enabled by default in the bfd code, which
    shouldn't be the case.  Add --enable-asserts configure option
    so that the asserts tests can be enabled while debugging.
  - Remove debugging log message accidently left in.
  - Update receive buffers when interface is created.  The receive
    buffer size used by keepalived is based on the largest MTU of
    any interface that keepalived uses. If dynamic interfaces are
    being used and an interface is created after keepalived has
    started, the MTU of the new interface may be larger than the
    previous largest, so the receive buffer may need to be
    increased in size.  Further, if vrrp_rx_bufs_policy is MTU,
    then the kernel receive buffers on the receive socket may need
    to be increased.
  - Handle MTU sizes being changed.  Issue #1068 identified that
    the MTU size wasn't being updated in keepalived if it changed.
    This commit now updates the MTU size and adjusts receive buffer
    sizes accordingly.
  - Fix syntax error in configure.ac.
  - Fix double free when global data smtp_helo_name copied from
    local_name Issue #1071 identified a double free fault. It
    occurred when smtp_helo_name was not set, in which case it was
    set to point to the same malloc'd memory as local_name. At
    termination keepalived freed both local_name and
    smtp_helo_name.  If keepalived needs to use local_name for
    smtp_helo_name it now malloc's additional memory to copy the
    string into.
  - Rename TIMER_MAX to TIMER_MAXIMUM.  ulibC defines TIMER_MAX, so
    to avoid naming conflict rename it.  This issue was reported by
    Paul Gildea &lt;gildeap@tcd.ie&gt; who also provided the patch.
  - Fix segfault when smtp alerts configured.
  - First working version of nftables.
  - Restructed code around how iptables/nftables are called This
    commit also allows building keepalived without iptables
    support, thereby allowing only nftables support.  Adding any
    other mechanism to handle no_accept mode, i.e. blocking
    receiving and sending to/from VIPs should be added to
    vrrp_firewall.c, in a similar way to how nftables/iptables are
    used.
  - Update doc files re nftables.
  - Make nftables handle dont_track_primary appropriately.
  - Fix config reload with nftables.
  - Set base chain priorities from configuration.
  - Use iptables by default if neither iptables or nftables
    configured.  But if the build of keepalived does not include
    iptables, then use nftables default.
  - Stop dumping keywords - left turned on after debugging.
  - Make umask configuration apply to created file.
  - Add libmnl and libnftnl to travis file.
  - Fix compilation failure when NFTNL_EXPR_LOOKUP_FLAGS not
    defined.
  - Fix compilation failure when build with nftables but without
    iptables.
  - Fix order of include files in configure COLLISION test.  Since
    Linux 4.4.11 (commit 1575c09) including linux/if.h after
    net/if.h works, whereas until glibc fix their headers including
    net/if.h after linux/if.h causes compiler redefinition errors.
    Unfortunately the test for the collision was done the wrong way
    round, as identified in issue #1079. The patch included in the
    issue report corrects the order of inclusion of the header
    files.  What we should do is ensure that glibc header files are
    included before Linux header files, so that at least if kernel
    headers from 4.4.11 onwards are used, the conflict will not
    occur.
  - Set CLOEXEC on netlink sockets.
  - Correct error message for invalid route metric.
  - Add track_process for vrrp to monitor if another process is
    running.  Configurations frequently include a track_script to
    check that a process is running, often haproxy or nginx. Using
    any of pgrep, pkill, killall, pidof, etc, has an overhead of
    reading all /proc/[1-9]*/status and/or /proc/[1-9]*/cmdline
    files. In particular reading the cmdline files has a
    significant overhead on a system that is swapping, since the
    cmdline files provide access to part of the address space of
    each process, which may need to be fetched from the swap space.
    This commit reads the /proc/[1-9]*/stat and/or the
    /proc/[1-9]*/cmdline files only when keepalived starts, and
    after that uses the process events connector to track process
    creation and termination.  keepalived will ignore zombie
    processes, whereas pgrep etc include them.  A minimum number of
    instances of a process can be specified, and also a delay so
    that if a process is restarted, it won't cause monitoring vrrp
    instances to immediately transition to fault state but to wait
    the configured time and it the monitored process starts again
    it won't transition to fault state.  There are potential
    difficulties with the process event connector if a large number
    of process events occur very rapidly, since there can be a
    receive buffer overrun on the netlink socket. This code will
    detect that happening, increase the receive buffer size, and
    reread the processes from /proc.
  - Add missing #include to track_process.c.
  - Fix number of elements of fd_set read for snmp select info.
  - Remove thread_event_t when EPOLL_CTL_DEL fails.  If snmpd
    closes a file descriptor, when keepalived attempts to
    unregister the fd from epoll an error is returned. However, we
    still need to remove the thread_event_t from the io_events
    rbtree.
  - Fix connection to snmpd after it has to reconnect.  Issue #1080
    identified that keepalived wasn't handling a connection failure
    and reconnect to snmpd properly. The problem was created when
    the change from select() to epoll() was made.  This commit
    makes keepalived unregister and reregister the snmp file
    descriptors after snmpd reconnects.
  - Fix retry count for SMTP_CHECK checker.  The checker was doing
    one too few retries.
  - Make healthchecker failure reporting consistent Some
    healthcheckers were reporting all failures, and others only
    when the retries expired. This commit by default makes the
    checkers only report failure when the retries expire, unless
    the global keyword checker_log_all_failures or log_all_failures
    on the specific checker is configured.
  - After reload, reinitialise current track processes state.
  - Remove unused variable in track_process.c.
  - Add configure checks re --with-kernel-dir.
  - Convert remaining select() to epoll_wait().  keepalived was
    using select() for handling the termination of child processes,
    but the main scheduling loop now uses epoll_wait(), so convert
    the select() to epoll_wait() from consistency.
  - Stop keepalived leaving zombie child processes.  keepalived
    wasn't reaping the termination of its child processes, so this
    commit adds waitpid() calls once it knows the processes have
    terminated.
  - Fix make distclean and make distcheck.
  - Also skip route not configured with down interface.  Otherwise,
    if keepalived has virtual_routes configured, we create a
    virtual interface and bring it up and down, current code will
    bring VRRP state to FAULT and never return.
  - Stop vrrp process entering infinite loop when track script
    times out Issue #1093 identified that the vrrp process was
    entering an infinite loop after a track script timed out. This
    was due to a child process thread having an RB tree for PIDs as
    well as for the timeout, and if a child process timed out, the
    thread wasn't being removed from the PID RB tree. This commit
    now ensures it is removed.
  - Fix the abbreviation of Shortest Expected Delay.
  - Don't free unallocated memory if not tracking processes.
  - vrrp: Rewrote JSON code Remove dependency to json-c extralib by
    using a simple streaming JSON writter.  Refactored code to make
    it simple to maintain.
  - vrrp: Fix JSON handling for v{route;rule}.
  - autoconf: fix nftables selection We need to inhibit nftable
    compilation if compiling system has kernel header file
    nf_tables.h but not libnftnl nor libmnl.</changelog>
  <changelog author="mrueckert@suse.de" date="1547899200">- fix build on 42.3/sle12 by disabling http regexp check support
- add nftables to the BR
- cleanup BR support for sle11, moved almost all BR to pkgconfig
  style
- disable dbus instance creation support as it is marked as
  dangerous</changelog>
  <changelog author="mrueckert@suse.de" date="1553083200">- update to 2.0.13
  - Add BFD build option to keepalived.spec rpm file
    Issue #1114 identified that the keepalived.spec file was not being
    generated to build BFD support even if keepalived had been configured
    to support it.
  - Copy tarball to rpmbuild/SOURCES when building in place
    It seems that even when building in place, rpmbuild expects the
    tarball to be in the rpmbuild/SOURCES directory.
  - Fix configure check for __always_inline
  - Handle interface MAC addresses changing
    When an interface is added to a bond interface, if it is the first
    interface added, the MAC address of the bond interface is changed
    to the MAC address of the added interface. When subsequent interfaces
    are added, their MAC addresses are changed to that of the bond
    interface.
    Issue #1112 identified that if a bond interface is deleted and
    recreated, the gratuitous ARPs were sent with the wrong source MAC
    address.
    This commit now updates interface MAC addresses from the netlink
    RTM_NEWLINK messages, so that the correct MAC address is always
    used.
  - Minor tidying up of opening gratuitous ARP socket.
  - Streamline setting SOCK_NONBLOCK on vrrp sockets.
  - Use netlink reported hardware address length for unsolicited NAs
    ETH_ALEN is correct for Ethernet type interaces, but is not right
    for Infiniband interfaces.
  - Minor tidying up of opening gratuitous NA socket.
  - Make gratuitous ARP/NA sockets non blocking
    keepalived shouldn't block when sending gratutious ARP/NA messages.
    It is better to lose the messages than for keepalived to block, so
    set the sockets non blocking.
  - Use netlink provided broadcast address for gratuitous ARP
    If an interface has a non-standard broadcast address, we should
    honour it.
  - Fix building on pre 3.10 kernels re track_process
    Issue #1119 reported that keepalived wouldn't build on CentOS 6.
    Various PROC_EVENT_- declarations were assumed to exist, some of which
    were not introduced until Linux v3.10. Most of them are not needed, but
    PROC_EVENT_COMM is used by the track_process code.
    This commit now checks for the existence of the PROC_EVENT_- declarations,
    but since keepalived uses PROC_EVENT_COMM, track_process is not supported
    prior to Linux v3.2.
  - Make track_process work prior to Linux 3.2, but with limitations
    Prior to Linux 3.2 the PROC_EVENT_COMM event did not exist, which
    means that keepalived is unable to detect changes to process name
    (/proc/PID/comm) prior to Linux 3.2. most processes do not change
    their process name, and so using track_process prior to Linux 3.2
    is safe so long as the monitored processes are known not to change
    their process name.
  - Stop configure failing when nftables is not supported.
  - Streamline socket use with linkbeat.
    Previously the socket used for ioctls was opened and closed twice per
    poll if using MII or ETHTOOL polling, and once per poll if using ioctl
    polling. This commit opens the socket once at startup, uses that socket
    for all linkbeat polls, and closes it on termination.
  - Enable linkbeat polling to work with dynamic interfaces.
  - Add linkbeat_interfaces configuration block
    It was not possible to indicate that an interface that wasn't used
    as the interface of a vrrp instance, but was used either as a track
    interface, or for virtual/static ip addresses or routes should use
    linkbeat. This commit adds that capability.
  - Add ability to specify linkbeat type in linkbeat_interfaces block.
  - Add --disable-linkbeat configure option
    Does anyone use linkbeat anymore? This commit enables keepalived to
    be build without the linkbeat code.
  - Don't remove link local IPv6 address from VMAC that isn't keepalived's
    If IFLA_INET6_ADDR_GEN_MODE isn't supported and a macvlan interface
    already had a (non-default) link local addresss and the link local
    address that matched the interface's MAC address was added, keepalived
    was removing it as soon as it was added. This commit stop keepalived
    removing the address when we shouldn't.
  - Set configure init type correctly in keepalived.spec file.
  - Fix handling of VMACs with multiple reloads
    If a configuration is loaded that has a VRRP instance using a VMAC,
    then the configuration is updated to remove that VRRP instance and
    keepalived reloads its configuration, then the configuration is
    updated again to reinstate the VRRP instance and the configuration
    is again reloaded, keepalived thought the VMAC interface still
    existed, whereas it was deleted following the first reload.
    This commit ensures that keepalived properly detects whether an
    interface exists following a reload.
  - Remember more than one interface local address per interface
    Keepalived needs a local address for each interface it sends adverts
    on. If the address keepalived is using is deleted and another address
    is configured on the interface, then keepalived should start using
    that address. To do this, a list of configured address on each
    interfaces needs to be maintained.
  - Don't consider VIPs as local addresses when restart after crash
    Keepalived maintains a list of addresses per interface that can be
    used as source adddresses for adverts. To build the list, keepalived
    reads the addresses configured on interfaces when it starts. However,
    if keepalived crashed it will have left VIPs configured on interfaces,
    and we don't want to use them as advert source addresses.
    This commit makes keepalived compare the addresses on interfaces
    to VIPs, and ignores any addresses that are VIPs.
  - Fix removing left over VIPs at startup.
  - Use read_timer() when parsing config where appropriate.
  - Allow fractional warmup, delay_loop and delay_before_retry for checkers
    To shorten the real server monitoring interval, make it possible to specify
    decimal value for following items:
    warmup
    delay_loop
    delay_before_retry
  - Update connect_timeout configuration options
    Based on the patch submitted by tamu.0.0.tamu@gmail.com this patch
    allows setting the connect_timeout to a resolution of micro-seconds.
    The patch also adds the ability to set a default value at the virtual
    server and real server levels.
  - Fix unused variable warning when building only with RFC compliant
    SNMP.
  - It enable to set zero value as mintime for delay_loop and connect_timeout.
  - Add option not to check for EINTR if using signalfd()
    If keepalived is using signalfd(), there are no asynchronous signal
    handlers, and therefore EINTR cannot be returned.
    Currently the check for EINTR is enabled by default, and configure
    option --disable-eintr-debug disables the check, while
  - -enable-eintr-debug enables writing log entries if EINTR is returned.
    Once sufficient testing has been performed, the default will be
    changed not to test for EINTR if signalfd() is supported.
  - Make checking for EAGAIN/EWOULDBLOCK consistent
    The code in some places checked errno for EAGAIN and EWOULDBLOCK
    and in other places only checked EAGAIN. On Linux EAGAIN == EWOULDBLOCK,
    so the check is not necessary, but EAGAIN is not guaranteed to be the
    same value as EWOULDBLOCK, so define check_EAGAIN that only checks EAGAIN
    if they are the same value, but checks both if they are different.
  - Ensure default connection timeout for smtp checker hosts set.
  - Set default connection timeout if no smtp check host specified.
  - Fix min timer value, zero to 0.000001Sec.
  - Add fixing min time for vs_co_timeout_handler() and rs_co_timeout_handler().
  - Fix parameter of read_timer(), it treat Mintime and Maxtime as microseconds.
  - vrrp: vrrp_dispatcher_read() performance extension
    We took time with Quentin to simulate and rework this code. We introduced
    2 imbricated while loop:
    (1) First one is catching recvfrom EINTR (this code trig
    only on kernel older than 2.6.22 where signalfd was firstly introduced).
    Newer kernel will immediately break the loop (hey guys: if you are running
    older than 2.6.22 it is worth considering upgrading).
    (2) Second loop will continue reading from socket until same VRID advert
    has been received during the same cycle. After simulating, it appears that
    during contention with a lot of VRRP instances (around 1500), this design
    is needed to relax socket recvq from growing. This can be viewed as a
    Poll-Mode activation during contention and fallback to regular I/O MUX
    during normal operations. This loop breaks immediately and re-submit
    opration to I/O MUX when there is no more to be read.
  - Fix conversion from long for double in read_timer().
  - Remove variable timer of unsigned long cast in read_timer().
    When Double type variable timer is cast to long type, it's scale falls.
- changes from2.0.12
  - Documentation related.
    Remove keepalived.conf.SYNOPSIS content to make a pointer to manpage.
    Update README manifest to reflect actual Keepalived goal and features.
  - Improve error message if process events connector not enabled in
    kernel.
  - Add option to disable track-process functionality
    Issue #1099 reported that their kernel did not support the proc events
    connector, and it would therefore be helpful to have an option to build
    keepalived without the track-process functionality.
    This commit adds the --disable-track-process configure option.
  - Fix vrrp instances going to fault state when have virtual routes
    If an interface going down caused a vrrp instance to go to fault
    state, and the vrrp instance also had virtual routes, the state
    of the vrrp instance would be set to backup when the deletion of
    the virtual route was detected. This commit ensures that the vrrp
    instance stays in fault state until the interface is brought up
    again.
  - Remove Red Hat Linux 9 and RH Enterprise Linux 3 from spec file.
    Red Hat Linux 9 and Red Hat Enterprise Linux 3 are both based on
    Linux 2.4, which is no longer supported by keepalived. The options
    in the spec file for Reh Hat Linux 9 have twice caused people to
    specify wrong options to configure when trying to build keepalived,
    so the options are removed to i) avoid confusion and ii) they are
    not longer relevant.
  - Add global option vrrp_min_garp.
    By default keepalived sends 5 gratuitous ARP/NA messages after
    transitioning to master, and 5 more 5 seconds later. This isn't
    necessary with modern switches, and so if the vrrp_min_garp option
    is set, only one gratuitious ARP/NA message is sent after transition
    to master, and no repeat messages are sent 4 seconds later.
  - Standardise definition of _INCLUDE_UNUSED_CODE_
  - Remove out of date comment re VRRP over IPv6.
  - Correct typo in keepalived.conf.5.
  - Directly use structure sizes for packet header lengths.
  - vrrp_state_fault_rx() is not used.
    Wrap the function in conditional compilation so it is not compiled
  - Convert so list loops to use LIST_FOREACH.
  - Don't recalculate vrrp packet header address.
    vrrp_get_header() calculates the address of the vrrp header in a
    received packet, but it was being recalculated in vrrp_in_chk().
    This commit passes the already calculated address to vrrp_in_chk().
  - Ensure a received packet has an AH header if and only if AH auth.
    Ensure that a received packet has an AH header if we expect AH
    authentication, and doesn't have an AH header if we don't expect
    AH authentication.
  - Ensure all protocol headers received before return pointer to vrrp header
    vrrp_get_header() returns a pointer to the vrrp header, but it now returns
    NULL if insufficient data has been received to include all the (IP,
    possibly AH, and VRRP) headers (this does not include the VIPs in the VRRP
    packet).
    This means that when a pointer to the VRRP header is returned, all fields in
    all protocol headers can safely be accessed.
  - Add check of received IPv6 hop count in multicast adverts
    The VRRP RFC requires that IPv6 hop count MUST be checked to be 255,
    just as the TTL for IPv6 must be 255. Previously that wasn't being
    checked, since IPv6 raw sockets don't provide access to the IPv6
    header.
    Using recvmsg() rather than recvfrom(), and setting socket option
    IPV6_RECVHOPLIMIT allows keepalived to receive the hop count as
    ancillary data, and that can now be checked.
  - Improve reading from vrrp receive sockets.
    Previously no check was made of the return value from recvfrom()/
    recvmsg(). This meant than an error could occur (e.g. EINTR), or no
    data might be returned, and keepalived would still attempt to process
    the receive buffer as though data had been received.
  - Enhance and streamline checking of validity of received VRRP packet
    This includes checking that a packet is multicast, unless unicast is
    expected in which case it is checked for unicast, ensuring that if
    AH authentication is used, the next header protocol is VRRP.
    The sequence of some checks is revised to ensure that the fields being
    checked are valid to be accessed prior to accessing them, e.g. check
    that the packet is VRRP version 2 before checking the authentication.
  - Stop clearing receive buffer before receiving VRRP packets.
    This is no longer necessary now that the appropriate checks are
    made of the return status of recvmsg(), and also that the checks
    of received packet length and packet headers now do all necessary
    checks.
  - Add compile time checks for IPV6_RECVHOPLIMIT/IPV6_RECVPKTINFO
    support.
  - Update keepalived.spec.in build-requires.
    The kernel package required for building keepalived is kernel-headers
    not kernel-devel. Also, it is superfluous to have package kernel in
    the build-requires!
  - Add missing file (build.setup) to tarball.
  - Fix calculating print format to rlim_t in configure.ac.
  - Fix compiler warnings on 32 bit systems re HASH_UPDATE.
    Removing all the casts stopped the warnings.
  - Use PRI_rlim_t when printing rlim_t types.
  - Use %zd/%zu for ssize_t/size_t to avoid warnings on 32 bit systems.
  - Fix some space/tab formatting.
  - Stop declaring some timer definitions unsigned to stop compiler
    warnings.
    TIMER_HZ, TIMER_CENTI_HZ, NSEC_PER_SEC were causing some compiler warnings
    on some systems due to being defined with a 'U' unsigned suffix. Removing
    the unsigned specifier stopped the compiler warnings.
  - Fix compiler warning due to incorrect format specifier.
    An int64_t should use % PRIi64 and not %ld
  - Stop an uninitialized variable compiler warning.
  - Fix MEM_CHECK debugging on processors without unaligned memory
    access.
  - Don't attempt to use unopened socket for getting ipset version.
  - Tidy up an error message.
  - vrrp: make vrrp_dispatcher_read() async while catching error.
    During investigations we decided to update previous patch to resubmit
    into I/O MUX on read error. It will make read procedure I/O MUX freindly
    by removing potential sync operation potentially leading to a global
    I/O MUX desync. We aggreed, the situation is really and very exceptionnal
    but could happen.
  - vrrp: vrrp_arp_thread split.
    Split the function for maintainability purpose.</changelog>
  <changelog author="mrueckert@suse.de" date="1554292800">- update to 2.0.14
  - Add compiler warning -Wfloat-conversion and fix new warnings.
    It was discovered that passing 0.000001 as a parameter
    specified as uint32_t to a function did not generate any
    warning of type mismatch, or loss of precision.  This commit
    adds -Wfloat-conversion and fixes 3 instances of new warnings
    that were generated.
  - For non systemd enviroment, it occurs syntax error 'fi'.  To
    avoid syntax error, modify keepalived.spec.in.
  - When uninstall keepalived with init upstart, stop keepalived
    process.
  - Fix type re LOG_INGO should be LOG_INFO - 6git stash --cached.
    The code was actualy in a #ifdef INCLUDE_UNUSED_CODE block, and
    so isn't currently compiled.
  - Register missing thread function for thread debugging.
  - Fix reutrn value of notify_script_compare misusing issue.
  - Fix typo in keepalived.conf man page re BFD min_rx.
  - Fix segfault when bfd process reloads config.  Issue #1145
    reported the bdf process was segfaulting when reloading.  The
    bfd process was freeing and allocating a new thread_master_t
    when reloading, which doesn't work. This commit changes the bfd
    process to clean and reinitialise the thread_master_t.
  - Fix segfault in handle_proc_ev().  On Linux 3.10 the ack bit
    can be set in a connector message, and the CPU number is set to
    UINT32_MAX. This commit skips acks, and also checks that CPU
    number is within range of the number of CPUs on the system.
  - Fix OpenSSL init failure with OpenSSL v1.1.1.  OpenSSL v1.1.1,
    but not v1.1.0h or v1.1.1b failed in SSL_CTX_new() if
    OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG) had previously
    been called.  This commit doesn't call OPENSSL_init_crypto() if
    doing so causes SSL_CTX_new() to fail.
  - Remove all references to libnfnetlink.  Commit 2899da6 (Stop
    using linbl for mcast group membership and setting rx buf
    sizes) stopped using libnfnetlink, but INSTALL and
    keepalived.spec.in were not updated accordingly.
  - Fix genhash re OPENSSL_init_crypto bug and improve
    configure.ac.  Commit fe6d6ac (Fix OpenSSL init failure with
    OpenSSL v1.1.1) didn't update the identical code in
    genhash/ssl.c. Also, an improvement for the test in
    configure.ac was suggested.
  - Fix log output when real server removed.  FMT_VS() and FMT_RS()
    both call inet_sockaddrtotrio which uses a static buffer to
    return the formatted string, but since FMT_VS(), wheich simply
    calls format_vs() copies the returned string to its own static
    buffer, if FMT_VS() was called before FMT_RS() then the
    returned strings from both could be used.  The problem occurs
    when both FMT_VS() and FMT_RS() are used as parameters to
    log_message() (or printf etc). It appeared to work fine on
    x86_64, but was writing the same IP address for both the real
    server and virtual server on ARM architectures. This is due to
    the compiler evaluating parameters to the log_message()
    function call in a different order on the different
    architectures.  This commit adds inet_sockaddrtotrio_r() which
    allows the output to be in a buffer specified by the caller,
    and so FMT_VS() and FMT_RS() can now be called in either order
    without one overwriting a buffer used by the other.
  - Streamline some string formatting with FMT_RS() and FMR_VS().
    Following commit 9fe353d (Fix log output when real server
    removed) some code can be streamlined now that the order of
    calling FMT_VS() and FMT_RS() does not matter.
  - Replace FMT_HTTP_RS(), FMT_TCP_RS() and FMT_DNS_RS() with
    FMT_CHK().  They were all simply defined to be FMT_CHK() so
    just replace them with that. This made it much simpler to find
    all used of FMT_CHK().
  - Fix building with gcc 4.4.7 (Centos 6.5).  gcc v4.4.7 doesn't
    support -Wfloat-conversion, so check for it at configure time.
  - Add dumping checker config/status when receive SIGUSR1.
  - Don't put alpha mode checkers into failed state at reload If a
    new checker is added at a reload, unless the real server aleady
    has failed checkers, then ignore the alpha mode of the checker.
    This means that the real server, if up, won't be taken down and
    then brought back up again almost straight away. If the real
    server already has failed checkers, then setting an alpha mode
    checker down initially won't take down the real server, so we
    can allow the alpha mode setting to apply.
  - Handle alpha mode checkers initial failure at startup better.
  - Fix compile failure discovered by Travis-CI.
  - Fix calling syslog when not using signalfd().  Pull request
    [#1149] identified that syslog is AS-Unsafe (see signal-safety
    man page), and that therefore signals should be blocked when
    calling it.  This commit blocks signals when calling
    syslog()/vsyslog() when signalfd() is not being used.
  - Rationalise function attributes.
  - Fix enable-optimise configure option.
  - Use AS_HELP_STRING for all options in configure.ac.
  - Streamline genhash -h option.
  - Make genhash -v version match keepalived.
  - Fix config check of virtual server quorum against weights of
    real servers.
  - Fix some configure tested checks for OPENSSL_init_crypto.
  - Add infrastructure for adding additional compiler warnings.
  - Add standard and extra compiler warnings.
  - Add and resolve missing-declarations and missing-prototypes
    warnings Approximately 16 additional functions are now declared
    static.
  - Add and resolve old-style-definitions warnings
  - Add and resolve redundant-decls warnings
  - Add and resolve jump-misses-init warnings
  - Add and resolve shadow warnings
  - Add and resolve unsuffixed-float-constants warnings
  - Add and resolve suggest-attribute=const warnings
  - Add and resolve suggest-attribute=format warnings
  - Add and resolve suggest-attribute=malloc warnings
  - Add and resolve suggest-attribute=noreturn warnings
  - Add and resolve suggest-attribute=pure warnings
  - Add and resolve unused-macros warnings
  - Add and resolve null-dereference warnings
  - Add and resolve float-equal warnings
  - Add and resolve stack-protector warnings
  - Add and resolve strict-overflow=4 warnings
  - Add and resolve pointer-arith warnings This particularly
    includes adding a number of bytes to a void -.
  - Add and resolve cast-qual warnings
  - Resolve additional warnings identified on Centos 6.5/gcc 4.4.7
  - Remove static from zalloc()
  - Fix some compiler warnings on Ubuntu Xenial, and add comments
    re others.
  - Rename LIST parameters to lst in list_head.h to avoid upper
    case.
  - Fix real server checkers moving from failed to OK on reload.
  - add rs judgement in migrate_checkers.
  - Detect connection failure in genhash and exit rather than loop.
  - Add another function pure attribute.
  - Fix sending notifies for vrrp instances at startup when in sync
    group Issue #1155 idenfified that notify scripts for vrrp
    instance transition to backup state when keepalived started up
    were not being sent if the vrrp instance was in a sync group.
    It was also the case that SNMP traps, SMTP alerts and FIFO
    notifies were not being sent either.  This commit make
    keepalived send the initial notifies when the vrrp instance is
    in a sync group.
  - Fix building keepalived RPM on Fedora 26.  For some reason
  - fPIC is needed when testing for the presence of setns().
  - Add vrrp_startup_delay configuration option.  Some systems that
    start keepalived at boot time need to delay the startup of the
    vrrp instances, due to network interfaces taking time to
    properly come up. This commit adds a global configuration
    option vrrp_startup_delay that delays the vrrp instances
    starting up, for the specified number of seconds.
  - Handle checkers properly when reload immediately after startup.
  - Streamline some of the SMTP checker code.
  - Create separate checker for each host in SMTP_CHECK block
    Having multiple host entries in an SMTP_CHECK block is
    deprecated.  This commit streamlines the SMTP_CHECK code by
    creating a separate SMTP checker for each host declared in the
    SMTP_CHECK block, so that apart from parsing the configuration,
    the code no longer handles multiple hosts per checker.  The
    support for parsing configuration with multiple hosts is only
    enabled if WITH_HOST_ENTRIES is defined in check_smtp.c. It is
    currently enabled, but when support for multiple hosts in the
    SMTP_CHECK block is finally removed, it will simply be a matter
    of deleting all code in the WITH_HOST_ENTRIES conditional
    blocks.
  - Make checker fail if ENETUNREACH returned by connect().  The
    connect() call can return some immediate errors such as
    ENETUNREACH.  These were not being treated as a failure of the
    checker, since the code used to assume that any non success
    return by connect() meant that the connection was in progress.
    keepalived will now treat ENETUNREACH, EHOSTUNREACH,
    ECONNREFUSED, EHOSTDOWN, ENETDOWN, ECONNRESET, ECONNABORTED,
    ETIMEDOUT, when returned by connect(), as meaning that the
    checker has failed.
  - Don't set SO_LINGER with a timeout of 0 SO_LINGER with a
    timeout of 0 causes a TCP connection to be reset rather than
    cleanly closed. Instead of specifying a timeout of 0, use 5
    seconds, so that there is an orderly shutdown of the TCP
    connection, but the close socket doesn't remain in TIMED_WAIT
    state for more than a short time.
  - nftables: fix build with kernel lower than 4.1.
  - Remove dead code and cosmectics.  Remove code marked as UNUSED
    where things simply go nowhere even if define is set. We keep
    for the moment UNUSED code related to debug helpers used during
    coding process.</changelog>
  <changelog author="mrueckert@suse.de" date="1554292801">- add buildrequires for file-devel
  - used in the checker to verify scripts</changelog>
  <changelog author="mrueckert@suse.de" date="1555416000">- update to 2.0.15
  - Fix uninitialised variable.
  - Fix rpmbuild on CentOS7, and rely on auto-requires.
  - Add option to flush lvs on shutdown.  Currently all known
    virtual servers and their real servers are removed one at a
    time at shutdown. With large configurations on a busy system,
    this can take some time.  Add an option just like the existing
    'lvs_flush' which operates on shutdown. Typical environments
    with a single keepalived instance can take advantage of this
    option to achieve a faster shutdown or restart cycle.
  - Make alpha mode checkers on new real servers start down on
    reload.  Patch #1180 identified that new real servers with
    alpha mode checkers were being added online immediately, and if
    the checker then failed were being removed. This commit makes
    real servers that didn't exist before the reload start in down
    state if they have alpha mode checkers.
  - Remove duplicate config dump entry.
  - Make new real servers at reload start down if have alpha mode
    checkers.
  - Close checker and smtp_alert sockets on reload.  Issue #1177
    identified that sockets were being left open (lost) after a
    reload. It transpired that these were sockets opened by
    TCP_CHECK, HTTP_GET, SSL_GET, DNS_CHECK and SMTP_CHECK
    checkers, and by smtp_alerts in the process of being sent.
    This commit adds an extra parameter to thread_add_read() and
    thread_add_write() to allow indicating that the scheduler
    should close the socket when destroying threads.
  - Send vrrp group backup notifies at startup.
  - Make inhibit_on_failure be inherited by real server from
    virtual server.
  - Allow real and sorry servers to be configured with port 0 This
    is to maintain backwards compatibility with keepalived prior to
    commit d87f07c - "Ensure always check return from
    inet_stosockaddr when parsing config".  The proper way to
    configure this is to omit the port, which requires the next
    commit.
  - Don't setup IPVS config with real and virtual servers ports
    different.  If the real server is using DR or TUN, the port of
    the real server must be the same as the port of the virtual
    server. This commit uses the virtual server port for the real
    server when configuring IPVS.
  - Log warnings if real server and virtual server ports don't
    match This commit adds logging warnings if virtual and real
    server ports, when using TUN or DR, don't match.  It also sets
    the real server ports to be the same as the virtual server
    ports. Although listing the IPVS configuration with ipvsadm
    will look different, the kernel ignored the port of a real
    server when using DR or TUN, so the behaviour isn't changed,
    but when looking at the configuration it now shows what is
    actually happening.
  - Fix warning when protocol specified for virtual server with
    fwmark.
  - Add log message that nb_get_retry is deprecated.
  - Fix whitespace in configure.ac.
  - Fix configure error when systemd not installed configure was
    trying to execute pkg-config --variable=systemdsystemunitdir
    systemd even if systemd was not available.  This commit makes
    configure only execute the above if it has determined that
    systemd is the correct init package to use.
  - Correct references to RFC6527 (VRRPv3 SNMP RFC).
  - nsure checker-&gt;has_run is always set once a checker has run.
  - Fix some indentation in configure.ac.
  - Update fopen_safe() to open temporary file in destination
    directory rename() in fopen_safe() was failing if the file
    being created was not on the same filesystem as /tmp.
  - Add ${_RANDOM} configuration keyword.  It might seem strange to
    introduce random elements to configuration files, but it can be
    useful for testing.
  - Fix using ~SEQ() in multiline configuration definitions.
  - Make blank lines terminate a multiline definition.
  - Minor updates for lvs_flush_on_stop.
  - Add option to skip deleting real servers on shutdown or reload
    If a virtual server is removed, the kernel will remove its real
    servers, so keepalived doesn't explicitly need to do so.  The
    lvs_flush_onstop option removes all LVS configuration, whereas
    this new option will only remove the virtual servers managed by
    keepalived.
  - Correct error message re checker_log_all_failures.
  - Fix syntax error in configure.ac.
  - Fix track_process initialisation for processes with PIDs
    starting 9.
  - Remove debugging log message.
  - Remove inappropriate function const attributes They were
    causing iptables/ipsets not to be initialised.
  - Stop warning: function might be candidate for attribute
    "const" Depending on what configure options are selected,
    gcc can output the above warning for
    initialise_debug_options().  This commit ensures that the
    warning is not produced.
  - Enable strict-config-checks option in keepalived.spec RPM file.
  - vrrp: relax attribute 'const' warning at iptables helpers.
  - Propagate libm to KA_LIBS.
  - Fix building on Alpine Linux.  Alpine (musl) doesn't have a
    definition of __GNU_PREREQ, so create a dummy definition.</changelog>
  <changelog author="mrueckert@suse.de" date="1555416001">- added systemd-after-snmp.patch:
  If you want to use the snmp support the masterx socket needs be
  available otherwise the snmp support is broken
  strictly speaking we would need to use BindsTo= here but that
  would require that add a Requires for net-snmp to the keepalived
  package. to be discussed.</changelog>
  <changelog author="chris@computersalat.de" date="1563883200">- Update to 2.0.17 (2019-06-25)
  * https://www.keepalived.org/changelog.html
- remove obsolete patch
  * systemd-after-snmp.patch
- rebase patch
  * linux-4.15.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1573128000">- update to 2.0.19
  Fix minor IPVS features support. Extend BFD to support more than
  one BFD instance with a neighnour. Extend nftable support. Script
  timeout extension. Properly filter IGMP/MLD packets on VMAC
  interface. Refer to ChangeLog for more infos.
  https://keepalived.org/changelog.html
- changes from 2.0.18
  Add support to IPVS new GUE tunnel type. New feature 'weight
  reverse' available in all trackers. Resolve all outstanding
  coverity issues. Some fixes and performance extensions. Refer to
  ChangeLog for more infos.
  https://keepalived.org/changelog.html</changelog>
  <changelog author="mrueckert@suse.de" date="1573128001">- new BR pkgconfig(libnftnl) to fix nftables support</changelog>
  <changelog author="dakechi@suse.com" date="1584100800">- Inclusion into SLE as ACC supported packages
  (bsc#1158280, ECO#223)</changelog>
  <changelog author="mrueckert@suse.de" date="1611662400">- Update to 2.2.1
  https://www.keepalived.org/release-notes/Release-2.2.1.html
  https://www.keepalived.org/release-notes/Release-2.2.0.html
  https://www.keepalived.org/release-notes/Release-2.1.5.html
  https://www.keepalived.org/release-notes/Release-2.1.4.html
  https://www.keepalived.org/release-notes/Release-2.1.3.html
  https://www.keepalived.org/release-notes/Release-2.1.2.html
  https://www.keepalived.org/release-notes/Release-2.1.1.html
  https://www.keepalived.org/release-notes/Release-2.1.0.html
- enable systemd integration via libsystemd (new BR: libsystemd)
- switch to systemd_ordering instead of systemd_requires
- sync configure options with the configure script</changelog>
  <changelog author="mrueckert@suse.de" date="1613649600">- Make sure we pull in the libraries we need for dlopen, by
  following the symlinks from the .so symlinks with the
  requires_file macro.</changelog>
  <changelog author="mrueckert@suse.de" date="1615118400">- Update to 2.2.2
  https://www.keepalived.org/release-notes/Release-2.2.2.html
- change how we install documentation to avoid duplicated files
- Link all the files for ipset, iptables, libnl instead of dlopen.
  Drop the previous workaround for generating requires for the
  dlopen-ed libaries.
- remove unsupported configure option: --enable-libiptc</changelog>
  <changelog author="mrueckert@suse.de" date="1615204800">- drop linux-4.15.patch: No longer needed as it was a backport from
  upstream
- Cleanup configure options after consultation with upstream:
  - --enable-regex-timers is for debugging purposes
  - --enable-snmp-checker and --enable-snmp-vrrp are enabled by
  - -enable-snmp
  - --enable-snmp-rfcv2 and --enable-snmp-rfcv3 anre enabled by
  - -enable-snmp-rfc
  - --enable-stacktrace is definitely a debugging option
- on systems where we have nftables support we will only ship with
  nftables support (&gt;= 15.0) and use iptables support only on older
  distributions.</changelog>
  <changelog author="dmueller@suse.com" date="1626868800">- add 1915.patch to fix build on tumbleweed</changelog>
  <changelog author="jsegitz@suse.com" date="1632744000">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_keepalived.service.patch</changelog>
  <changelog author="varkoly@suse.com" date="1659960000">- VUL-0: CVE-2021-44225: keepalived: possible privilege escalation
  due to insufficient control in the D-Bus policy (bsc#1193115)
  apply upstream patch:
  * 0001-dbus-fix-policy-to-not-be-overly-broad.patch</changelog>
  <changelog author="varkoly@suse.com" date="1661774400">- FATAL: Module ip_vs not found in directory /lib/modules/5.14.21-150400.24.18-default
  (bsc#1202808)
  Set ProtectKernelModules to false in service file</changelog>
</package>
<package pkgid="13740cce5e9270b362f12e7427725ba5b15a3674776766831aa95c07cce2842b" name="keepalived" arch="x86_64">
  <version epoch="0" ver="2.2.2" rel="150400.3.7.2"/>
  <changelog author="mrueckert@suse.de" date="1543406400">- update to 2.0.10
  - Fix compiling on Alpine Linux.
  - Stop printf compiler warning on Alpine Linux due to rlim_t.
  - manpage cosmetic.
  - Fix removing snmpd read threads when snmpd becomes unavailable.
  - Update to support libipset version 7.
  - Use ipset_printf for ipset messages so can go to log.
  - When opening files for write, ensure files can only be read by
    root.  Issue #1048 referred to CVE-2018-19046 regarding files
    used for debugging purposes could potentially be read by non
    root users.  This commit ensures that such log files cannot be
    opened by non root users.
  - Disable fopen_safe() append mode by default If a non privileged
    user creates /tmp/keepalived.log and has it open for read (e.g.
    tail -f), then even though keepalived will change the owner to
    root and remove all read/write permissions from non owners, the
    application which already has the file open will be able to
    read the added log entries.  Accordingly, opening a file in
    append mode is disabled by default, and only enabled if
  - -enable-smtp-alert-debug or --enable-log-file (which are
    debugging options and unset by default) are enabled.  This
    should further alleviate security concerns related to
    CVE-2018-19046.
  - vrrp: add support to constant time memcmp.  Just an update to
    use best practise security design pattern. While comparing
    password or hmac you need to ensure comparison function is time
    constant in order to figth against any timing attacks. We turn
    off potential compiler optimizations for this particular
    function to avoid any short circuit.
  - Make sure a non privileged user cannot read keepalived file
    output Ensure that when a file such as /tmp/keepalived.data is
    written, no non privileged can have a previous version of that
    file already open, thereby allowing them to read the data.
    This should fully resolve CVE-2018-19046.
- drop b7a98f9265ffb5927c4d54c9a30726c76e65bb52.patch: included in
  update</changelog>
  <changelog author="mrueckert@suse.de" date="1547812800">- update to 2.0.11
  - Fix segfault while shutting down when SNMP activity occurs.
    Issue #1061 identified that keepalived could segfault when it
    shut down. It appears that this was caused by data being
    received on the file descriptors that the snmp agent requests
    keepalived to monitor with epoll(). Since the read threads
    weren't being processed during a shutdown, the first time an
    snmp fd was ready, keepalived discarded the read thread. The
    second time that fd became ready there was no thread to handle
    the fd, and, since the assert() statement was not compiled in,
    non existant data was queued to the thread ready queue.  This
    commit changes the assert() calls to continue, so that non
    existant data is no longer queued to the thread ready queue.
  - While shutting down, continue to handle snmp agent fds.  Since
    we don't shutdown the snmp connection until the very end of the
    shutdown process (we need to be able to send snmp traps), we
    should continue to handle the snmp fds on behalf of the snmp
    agent while shutting down.
  - Ensure snmp agent is in correct state when initialising/closing
    Make sure the snmp agent is not already initialised before
    initialising it, and make sure it has been initialised before
    closing it.
  - Disable asserts in bfd code by default and add --enable-asserts
    Asserts were enabled by default in the bfd code, which
    shouldn't be the case.  Add --enable-asserts configure option
    so that the asserts tests can be enabled while debugging.
  - Remove debugging log message accidently left in.
  - Update receive buffers when interface is created.  The receive
    buffer size used by keepalived is based on the largest MTU of
    any interface that keepalived uses. If dynamic interfaces are
    being used and an interface is created after keepalived has
    started, the MTU of the new interface may be larger than the
    previous largest, so the receive buffer may need to be
    increased in size.  Further, if vrrp_rx_bufs_policy is MTU,
    then the kernel receive buffers on the receive socket may need
    to be increased.
  - Handle MTU sizes being changed.  Issue #1068 identified that
    the MTU size wasn't being updated in keepalived if it changed.
    This commit now updates the MTU size and adjusts receive buffer
    sizes accordingly.
  - Fix syntax error in configure.ac.
  - Fix double free when global data smtp_helo_name copied from
    local_name Issue #1071 identified a double free fault. It
    occurred when smtp_helo_name was not set, in which case it was
    set to point to the same malloc'd memory as local_name. At
    termination keepalived freed both local_name and
    smtp_helo_name.  If keepalived needs to use local_name for
    smtp_helo_name it now malloc's additional memory to copy the
    string into.
  - Rename TIMER_MAX to TIMER_MAXIMUM.  ulibC defines TIMER_MAX, so
    to avoid naming conflict rename it.  This issue was reported by
    Paul Gildea &lt;gildeap@tcd.ie&gt; who also provided the patch.
  - Fix segfault when smtp alerts configured.
  - First working version of nftables.
  - Restructed code around how iptables/nftables are called This
    commit also allows building keepalived without iptables
    support, thereby allowing only nftables support.  Adding any
    other mechanism to handle no_accept mode, i.e. blocking
    receiving and sending to/from VIPs should be added to
    vrrp_firewall.c, in a similar way to how nftables/iptables are
    used.
  - Update doc files re nftables.
  - Make nftables handle dont_track_primary appropriately.
  - Fix config reload with nftables.
  - Set base chain priorities from configuration.
  - Use iptables by default if neither iptables or nftables
    configured.  But if the build of keepalived does not include
    iptables, then use nftables default.
  - Stop dumping keywords - left turned on after debugging.
  - Make umask configuration apply to created file.
  - Add libmnl and libnftnl to travis file.
  - Fix compilation failure when NFTNL_EXPR_LOOKUP_FLAGS not
    defined.
  - Fix compilation failure when build with nftables but without
    iptables.
  - Fix order of include files in configure COLLISION test.  Since
    Linux 4.4.11 (commit 1575c09) including linux/if.h after
    net/if.h works, whereas until glibc fix their headers including
    net/if.h after linux/if.h causes compiler redefinition errors.
    Unfortunately the test for the collision was done the wrong way
    round, as identified in issue #1079. The patch included in the
    issue report corrects the order of inclusion of the header
    files.  What we should do is ensure that glibc header files are
    included before Linux header files, so that at least if kernel
    headers from 4.4.11 onwards are used, the conflict will not
    occur.
  - Set CLOEXEC on netlink sockets.
  - Correct error message for invalid route metric.
  - Add track_process for vrrp to monitor if another process is
    running.  Configurations frequently include a track_script to
    check that a process is running, often haproxy or nginx. Using
    any of pgrep, pkill, killall, pidof, etc, has an overhead of
    reading all /proc/[1-9]*/status and/or /proc/[1-9]*/cmdline
    files. In particular reading the cmdline files has a
    significant overhead on a system that is swapping, since the
    cmdline files provide access to part of the address space of
    each process, which may need to be fetched from the swap space.
    This commit reads the /proc/[1-9]*/stat and/or the
    /proc/[1-9]*/cmdline files only when keepalived starts, and
    after that uses the process events connector to track process
    creation and termination.  keepalived will ignore zombie
    processes, whereas pgrep etc include them.  A minimum number of
    instances of a process can be specified, and also a delay so
    that if a process is restarted, it won't cause monitoring vrrp
    instances to immediately transition to fault state but to wait
    the configured time and it the monitored process starts again
    it won't transition to fault state.  There are potential
    difficulties with the process event connector if a large number
    of process events occur very rapidly, since there can be a
    receive buffer overrun on the netlink socket. This code will
    detect that happening, increase the receive buffer size, and
    reread the processes from /proc.
  - Add missing #include to track_process.c.
  - Fix number of elements of fd_set read for snmp select info.
  - Remove thread_event_t when EPOLL_CTL_DEL fails.  If snmpd
    closes a file descriptor, when keepalived attempts to
    unregister the fd from epoll an error is returned. However, we
    still need to remove the thread_event_t from the io_events
    rbtree.
  - Fix connection to snmpd after it has to reconnect.  Issue #1080
    identified that keepalived wasn't handling a connection failure
    and reconnect to snmpd properly. The problem was created when
    the change from select() to epoll() was made.  This commit
    makes keepalived unregister and reregister the snmp file
    descriptors after snmpd reconnects.
  - Fix retry count for SMTP_CHECK checker.  The checker was doing
    one too few retries.
  - Make healthchecker failure reporting consistent Some
    healthcheckers were reporting all failures, and others only
    when the retries expired. This commit by default makes the
    checkers only report failure when the retries expire, unless
    the global keyword checker_log_all_failures or log_all_failures
    on the specific checker is configured.
  - After reload, reinitialise current track processes state.
  - Remove unused variable in track_process.c.
  - Add configure checks re --with-kernel-dir.
  - Convert remaining select() to epoll_wait().  keepalived was
    using select() for handling the termination of child processes,
    but the main scheduling loop now uses epoll_wait(), so convert
    the select() to epoll_wait() from consistency.
  - Stop keepalived leaving zombie child processes.  keepalived
    wasn't reaping the termination of its child processes, so this
    commit adds waitpid() calls once it knows the processes have
    terminated.
  - Fix make distclean and make distcheck.
  - Also skip route not configured with down interface.  Otherwise,
    if keepalived has virtual_routes configured, we create a
    virtual interface and bring it up and down, current code will
    bring VRRP state to FAULT and never return.
  - Stop vrrp process entering infinite loop when track script
    times out Issue #1093 identified that the vrrp process was
    entering an infinite loop after a track script timed out. This
    was due to a child process thread having an RB tree for PIDs as
    well as for the timeout, and if a child process timed out, the
    thread wasn't being removed from the PID RB tree. This commit
    now ensures it is removed.
  - Fix the abbreviation of Shortest Expected Delay.
  - Don't free unallocated memory if not tracking processes.
  - vrrp: Rewrote JSON code Remove dependency to json-c extralib by
    using a simple streaming JSON writter.  Refactored code to make
    it simple to maintain.
  - vrrp: Fix JSON handling for v{route;rule}.
  - autoconf: fix nftables selection We need to inhibit nftable
    compilation if compiling system has kernel header file
    nf_tables.h but not libnftnl nor libmnl.</changelog>
  <changelog author="mrueckert@suse.de" date="1547899200">- fix build on 42.3/sle12 by disabling http regexp check support
- add nftables to the BR
- cleanup BR support for sle11, moved almost all BR to pkgconfig
  style
- disable dbus instance creation support as it is marked as
  dangerous</changelog>
  <changelog author="mrueckert@suse.de" date="1553083200">- update to 2.0.13
  - Add BFD build option to keepalived.spec rpm file
    Issue #1114 identified that the keepalived.spec file was not being
    generated to build BFD support even if keepalived had been configured
    to support it.
  - Copy tarball to rpmbuild/SOURCES when building in place
    It seems that even when building in place, rpmbuild expects the
    tarball to be in the rpmbuild/SOURCES directory.
  - Fix configure check for __always_inline
  - Handle interface MAC addresses changing
    When an interface is added to a bond interface, if it is the first
    interface added, the MAC address of the bond interface is changed
    to the MAC address of the added interface. When subsequent interfaces
    are added, their MAC addresses are changed to that of the bond
    interface.
    Issue #1112 identified that if a bond interface is deleted and
    recreated, the gratuitous ARPs were sent with the wrong source MAC
    address.
    This commit now updates interface MAC addresses from the netlink
    RTM_NEWLINK messages, so that the correct MAC address is always
    used.
  - Minor tidying up of opening gratuitous ARP socket.
  - Streamline setting SOCK_NONBLOCK on vrrp sockets.
  - Use netlink reported hardware address length for unsolicited NAs
    ETH_ALEN is correct for Ethernet type interaces, but is not right
    for Infiniband interfaces.
  - Minor tidying up of opening gratuitous NA socket.
  - Make gratuitous ARP/NA sockets non blocking
    keepalived shouldn't block when sending gratutious ARP/NA messages.
    It is better to lose the messages than for keepalived to block, so
    set the sockets non blocking.
  - Use netlink provided broadcast address for gratuitous ARP
    If an interface has a non-standard broadcast address, we should
    honour it.
  - Fix building on pre 3.10 kernels re track_process
    Issue #1119 reported that keepalived wouldn't build on CentOS 6.
    Various PROC_EVENT_- declarations were assumed to exist, some of which
    were not introduced until Linux v3.10. Most of them are not needed, but
    PROC_EVENT_COMM is used by the track_process code.
    This commit now checks for the existence of the PROC_EVENT_- declarations,
    but since keepalived uses PROC_EVENT_COMM, track_process is not supported
    prior to Linux v3.2.
  - Make track_process work prior to Linux 3.2, but with limitations
    Prior to Linux 3.2 the PROC_EVENT_COMM event did not exist, which
    means that keepalived is unable to detect changes to process name
    (/proc/PID/comm) prior to Linux 3.2. most processes do not change
    their process name, and so using track_process prior to Linux 3.2
    is safe so long as the monitored processes are known not to change
    their process name.
  - Stop configure failing when nftables is not supported.
  - Streamline socket use with linkbeat.
    Previously the socket used for ioctls was opened and closed twice per
    poll if using MII or ETHTOOL polling, and once per poll if using ioctl
    polling. This commit opens the socket once at startup, uses that socket
    for all linkbeat polls, and closes it on termination.
  - Enable linkbeat polling to work with dynamic interfaces.
  - Add linkbeat_interfaces configuration block
    It was not possible to indicate that an interface that wasn't used
    as the interface of a vrrp instance, but was used either as a track
    interface, or for virtual/static ip addresses or routes should use
    linkbeat. This commit adds that capability.
  - Add ability to specify linkbeat type in linkbeat_interfaces block.
  - Add --disable-linkbeat configure option
    Does anyone use linkbeat anymore? This commit enables keepalived to
    be build without the linkbeat code.
  - Don't remove link local IPv6 address from VMAC that isn't keepalived's
    If IFLA_INET6_ADDR_GEN_MODE isn't supported and a macvlan interface
    already had a (non-default) link local addresss and the link local
    address that matched the interface's MAC address was added, keepalived
    was removing it as soon as it was added. This commit stop keepalived
    removing the address when we shouldn't.
  - Set configure init type correctly in keepalived.spec file.
  - Fix handling of VMACs with multiple reloads
    If a configuration is loaded that has a VRRP instance using a VMAC,
    then the configuration is updated to remove that VRRP instance and
    keepalived reloads its configuration, then the configuration is
    updated again to reinstate the VRRP instance and the configuration
    is again reloaded, keepalived thought the VMAC interface still
    existed, whereas it was deleted following the first reload.
    This commit ensures that keepalived properly detects whether an
    interface exists following a reload.
  - Remember more than one interface local address per interface
    Keepalived needs a local address for each interface it sends adverts
    on. If the address keepalived is using is deleted and another address
    is configured on the interface, then keepalived should start using
    that address. To do this, a list of configured address on each
    interfaces needs to be maintained.
  - Don't consider VIPs as local addresses when restart after crash
    Keepalived maintains a list of addresses per interface that can be
    used as source adddresses for adverts. To build the list, keepalived
    reads the addresses configured on interfaces when it starts. However,
    if keepalived crashed it will have left VIPs configured on interfaces,
    and we don't want to use them as advert source addresses.
    This commit makes keepalived compare the addresses on interfaces
    to VIPs, and ignores any addresses that are VIPs.
  - Fix removing left over VIPs at startup.
  - Use read_timer() when parsing config where appropriate.
  - Allow fractional warmup, delay_loop and delay_before_retry for checkers
    To shorten the real server monitoring interval, make it possible to specify
    decimal value for following items:
    warmup
    delay_loop
    delay_before_retry
  - Update connect_timeout configuration options
    Based on the patch submitted by tamu.0.0.tamu@gmail.com this patch
    allows setting the connect_timeout to a resolution of micro-seconds.
    The patch also adds the ability to set a default value at the virtual
    server and real server levels.
  - Fix unused variable warning when building only with RFC compliant
    SNMP.
  - It enable to set zero value as mintime for delay_loop and connect_timeout.
  - Add option not to check for EINTR if using signalfd()
    If keepalived is using signalfd(), there are no asynchronous signal
    handlers, and therefore EINTR cannot be returned.
    Currently the check for EINTR is enabled by default, and configure
    option --disable-eintr-debug disables the check, while
  - -enable-eintr-debug enables writing log entries if EINTR is returned.
    Once sufficient testing has been performed, the default will be
    changed not to test for EINTR if signalfd() is supported.
  - Make checking for EAGAIN/EWOULDBLOCK consistent
    The code in some places checked errno for EAGAIN and EWOULDBLOCK
    and in other places only checked EAGAIN. On Linux EAGAIN == EWOULDBLOCK,
    so the check is not necessary, but EAGAIN is not guaranteed to be the
    same value as EWOULDBLOCK, so define check_EAGAIN that only checks EAGAIN
    if they are the same value, but checks both if they are different.
  - Ensure default connection timeout for smtp checker hosts set.
  - Set default connection timeout if no smtp check host specified.
  - Fix min timer value, zero to 0.000001Sec.
  - Add fixing min time for vs_co_timeout_handler() and rs_co_timeout_handler().
  - Fix parameter of read_timer(), it treat Mintime and Maxtime as microseconds.
  - vrrp: vrrp_dispatcher_read() performance extension
    We took time with Quentin to simulate and rework this code. We introduced
    2 imbricated while loop:
    (1) First one is catching recvfrom EINTR (this code trig
    only on kernel older than 2.6.22 where signalfd was firstly introduced).
    Newer kernel will immediately break the loop (hey guys: if you are running
    older than 2.6.22 it is worth considering upgrading).
    (2) Second loop will continue reading from socket until same VRID advert
    has been received during the same cycle. After simulating, it appears that
    during contention with a lot of VRRP instances (around 1500), this design
    is needed to relax socket recvq from growing. This can be viewed as a
    Poll-Mode activation during contention and fallback to regular I/O MUX
    during normal operations. This loop breaks immediately and re-submit
    opration to I/O MUX when there is no more to be read.
  - Fix conversion from long for double in read_timer().
  - Remove variable timer of unsigned long cast in read_timer().
    When Double type variable timer is cast to long type, it's scale falls.
- changes from2.0.12
  - Documentation related.
    Remove keepalived.conf.SYNOPSIS content to make a pointer to manpage.
    Update README manifest to reflect actual Keepalived goal and features.
  - Improve error message if process events connector not enabled in
    kernel.
  - Add option to disable track-process functionality
    Issue #1099 reported that their kernel did not support the proc events
    connector, and it would therefore be helpful to have an option to build
    keepalived without the track-process functionality.
    This commit adds the --disable-track-process configure option.
  - Fix vrrp instances going to fault state when have virtual routes
    If an interface going down caused a vrrp instance to go to fault
    state, and the vrrp instance also had virtual routes, the state
    of the vrrp instance would be set to backup when the deletion of
    the virtual route was detected. This commit ensures that the vrrp
    instance stays in fault state until the interface is brought up
    again.
  - Remove Red Hat Linux 9 and RH Enterprise Linux 3 from spec file.
    Red Hat Linux 9 and Red Hat Enterprise Linux 3 are both based on
    Linux 2.4, which is no longer supported by keepalived. The options
    in the spec file for Reh Hat Linux 9 have twice caused people to
    specify wrong options to configure when trying to build keepalived,
    so the options are removed to i) avoid confusion and ii) they are
    not longer relevant.
  - Add global option vrrp_min_garp.
    By default keepalived sends 5 gratuitous ARP/NA messages after
    transitioning to master, and 5 more 5 seconds later. This isn't
    necessary with modern switches, and so if the vrrp_min_garp option
    is set, only one gratuitious ARP/NA message is sent after transition
    to master, and no repeat messages are sent 4 seconds later.
  - Standardise definition of _INCLUDE_UNUSED_CODE_
  - Remove out of date comment re VRRP over IPv6.
  - Correct typo in keepalived.conf.5.
  - Directly use structure sizes for packet header lengths.
  - vrrp_state_fault_rx() is not used.
    Wrap the function in conditional compilation so it is not compiled
  - Convert so list loops to use LIST_FOREACH.
  - Don't recalculate vrrp packet header address.
    vrrp_get_header() calculates the address of the vrrp header in a
    received packet, but it was being recalculated in vrrp_in_chk().
    This commit passes the already calculated address to vrrp_in_chk().
  - Ensure a received packet has an AH header if and only if AH auth.
    Ensure that a received packet has an AH header if we expect AH
    authentication, and doesn't have an AH header if we don't expect
    AH authentication.
  - Ensure all protocol headers received before return pointer to vrrp header
    vrrp_get_header() returns a pointer to the vrrp header, but it now returns
    NULL if insufficient data has been received to include all the (IP,
    possibly AH, and VRRP) headers (this does not include the VIPs in the VRRP
    packet).
    This means that when a pointer to the VRRP header is returned, all fields in
    all protocol headers can safely be accessed.
  - Add check of received IPv6 hop count in multicast adverts
    The VRRP RFC requires that IPv6 hop count MUST be checked to be 255,
    just as the TTL for IPv6 must be 255. Previously that wasn't being
    checked, since IPv6 raw sockets don't provide access to the IPv6
    header.
    Using recvmsg() rather than recvfrom(), and setting socket option
    IPV6_RECVHOPLIMIT allows keepalived to receive the hop count as
    ancillary data, and that can now be checked.
  - Improve reading from vrrp receive sockets.
    Previously no check was made of the return value from recvfrom()/
    recvmsg(). This meant than an error could occur (e.g. EINTR), or no
    data might be returned, and keepalived would still attempt to process
    the receive buffer as though data had been received.
  - Enhance and streamline checking of validity of received VRRP packet
    This includes checking that a packet is multicast, unless unicast is
    expected in which case it is checked for unicast, ensuring that if
    AH authentication is used, the next header protocol is VRRP.
    The sequence of some checks is revised to ensure that the fields being
    checked are valid to be accessed prior to accessing them, e.g. check
    that the packet is VRRP version 2 before checking the authentication.
  - Stop clearing receive buffer before receiving VRRP packets.
    This is no longer necessary now that the appropriate checks are
    made of the return status of recvmsg(), and also that the checks
    of received packet length and packet headers now do all necessary
    checks.
  - Add compile time checks for IPV6_RECVHOPLIMIT/IPV6_RECVPKTINFO
    support.
  - Update keepalived.spec.in build-requires.
    The kernel package required for building keepalived is kernel-headers
    not kernel-devel. Also, it is superfluous to have package kernel in
    the build-requires!
  - Add missing file (build.setup) to tarball.
  - Fix calculating print format to rlim_t in configure.ac.
  - Fix compiler warnings on 32 bit systems re HASH_UPDATE.
    Removing all the casts stopped the warnings.
  - Use PRI_rlim_t when printing rlim_t types.
  - Use %zd/%zu for ssize_t/size_t to avoid warnings on 32 bit systems.
  - Fix some space/tab formatting.
  - Stop declaring some timer definitions unsigned to stop compiler
    warnings.
    TIMER_HZ, TIMER_CENTI_HZ, NSEC_PER_SEC were causing some compiler warnings
    on some systems due to being defined with a 'U' unsigned suffix. Removing
    the unsigned specifier stopped the compiler warnings.
  - Fix compiler warning due to incorrect format specifier.
    An int64_t should use % PRIi64 and not %ld
  - Stop an uninitialized variable compiler warning.
  - Fix MEM_CHECK debugging on processors without unaligned memory
    access.
  - Don't attempt to use unopened socket for getting ipset version.
  - Tidy up an error message.
  - vrrp: make vrrp_dispatcher_read() async while catching error.
    During investigations we decided to update previous patch to resubmit
    into I/O MUX on read error. It will make read procedure I/O MUX freindly
    by removing potential sync operation potentially leading to a global
    I/O MUX desync. We aggreed, the situation is really and very exceptionnal
    but could happen.
  - vrrp: vrrp_arp_thread split.
    Split the function for maintainability purpose.</changelog>
  <changelog author="mrueckert@suse.de" date="1554292800">- update to 2.0.14
  - Add compiler warning -Wfloat-conversion and fix new warnings.
    It was discovered that passing 0.000001 as a parameter
    specified as uint32_t to a function did not generate any
    warning of type mismatch, or loss of precision.  This commit
    adds -Wfloat-conversion and fixes 3 instances of new warnings
    that were generated.
  - For non systemd enviroment, it occurs syntax error 'fi'.  To
    avoid syntax error, modify keepalived.spec.in.
  - When uninstall keepalived with init upstart, stop keepalived
    process.
  - Fix type re LOG_INGO should be LOG_INFO - 6git stash --cached.
    The code was actualy in a #ifdef INCLUDE_UNUSED_CODE block, and
    so isn't currently compiled.
  - Register missing thread function for thread debugging.
  - Fix reutrn value of notify_script_compare misusing issue.
  - Fix typo in keepalived.conf man page re BFD min_rx.
  - Fix segfault when bfd process reloads config.  Issue #1145
    reported the bdf process was segfaulting when reloading.  The
    bfd process was freeing and allocating a new thread_master_t
    when reloading, which doesn't work. This commit changes the bfd
    process to clean and reinitialise the thread_master_t.
  - Fix segfault in handle_proc_ev().  On Linux 3.10 the ack bit
    can be set in a connector message, and the CPU number is set to
    UINT32_MAX. This commit skips acks, and also checks that CPU
    number is within range of the number of CPUs on the system.
  - Fix OpenSSL init failure with OpenSSL v1.1.1.  OpenSSL v1.1.1,
    but not v1.1.0h or v1.1.1b failed in SSL_CTX_new() if
    OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG) had previously
    been called.  This commit doesn't call OPENSSL_init_crypto() if
    doing so causes SSL_CTX_new() to fail.
  - Remove all references to libnfnetlink.  Commit 2899da6 (Stop
    using linbl for mcast group membership and setting rx buf
    sizes) stopped using libnfnetlink, but INSTALL and
    keepalived.spec.in were not updated accordingly.
  - Fix genhash re OPENSSL_init_crypto bug and improve
    configure.ac.  Commit fe6d6ac (Fix OpenSSL init failure with
    OpenSSL v1.1.1) didn't update the identical code in
    genhash/ssl.c. Also, an improvement for the test in
    configure.ac was suggested.
  - Fix log output when real server removed.  FMT_VS() and FMT_RS()
    both call inet_sockaddrtotrio which uses a static buffer to
    return the formatted string, but since FMT_VS(), wheich simply
    calls format_vs() copies the returned string to its own static
    buffer, if FMT_VS() was called before FMT_RS() then the
    returned strings from both could be used.  The problem occurs
    when both FMT_VS() and FMT_RS() are used as parameters to
    log_message() (or printf etc). It appeared to work fine on
    x86_64, but was writing the same IP address for both the real
    server and virtual server on ARM architectures. This is due to
    the compiler evaluating parameters to the log_message()
    function call in a different order on the different
    architectures.  This commit adds inet_sockaddrtotrio_r() which
    allows the output to be in a buffer specified by the caller,
    and so FMT_VS() and FMT_RS() can now be called in either order
    without one overwriting a buffer used by the other.
  - Streamline some string formatting with FMT_RS() and FMR_VS().
    Following commit 9fe353d (Fix log output when real server
    removed) some code can be streamlined now that the order of
    calling FMT_VS() and FMT_RS() does not matter.
  - Replace FMT_HTTP_RS(), FMT_TCP_RS() and FMT_DNS_RS() with
    FMT_CHK().  They were all simply defined to be FMT_CHK() so
    just replace them with that. This made it much simpler to find
    all used of FMT_CHK().
  - Fix building with gcc 4.4.7 (Centos 6.5).  gcc v4.4.7 doesn't
    support -Wfloat-conversion, so check for it at configure time.
  - Add dumping checker config/status when receive SIGUSR1.
  - Don't put alpha mode checkers into failed state at reload If a
    new checker is added at a reload, unless the real server aleady
    has failed checkers, then ignore the alpha mode of the checker.
    This means that the real server, if up, won't be taken down and
    then brought back up again almost straight away. If the real
    server already has failed checkers, then setting an alpha mode
    checker down initially won't take down the real server, so we
    can allow the alpha mode setting to apply.
  - Handle alpha mode checkers initial failure at startup better.
  - Fix compile failure discovered by Travis-CI.
  - Fix calling syslog when not using signalfd().  Pull request
    [#1149] identified that syslog is AS-Unsafe (see signal-safety
    man page), and that therefore signals should be blocked when
    calling it.  This commit blocks signals when calling
    syslog()/vsyslog() when signalfd() is not being used.
  - Rationalise function attributes.
  - Fix enable-optimise configure option.
  - Use AS_HELP_STRING for all options in configure.ac.
  - Streamline genhash -h option.
  - Make genhash -v version match keepalived.
  - Fix config check of virtual server quorum against weights of
    real servers.
  - Fix some configure tested checks for OPENSSL_init_crypto.
  - Add infrastructure for adding additional compiler warnings.
  - Add standard and extra compiler warnings.
  - Add and resolve missing-declarations and missing-prototypes
    warnings Approximately 16 additional functions are now declared
    static.
  - Add and resolve old-style-definitions warnings
  - Add and resolve redundant-decls warnings
  - Add and resolve jump-misses-init warnings
  - Add and resolve shadow warnings
  - Add and resolve unsuffixed-float-constants warnings
  - Add and resolve suggest-attribute=const warnings
  - Add and resolve suggest-attribute=format warnings
  - Add and resolve suggest-attribute=malloc warnings
  - Add and resolve suggest-attribute=noreturn warnings
  - Add and resolve suggest-attribute=pure warnings
  - Add and resolve unused-macros warnings
  - Add and resolve null-dereference warnings
  - Add and resolve float-equal warnings
  - Add and resolve stack-protector warnings
  - Add and resolve strict-overflow=4 warnings
  - Add and resolve pointer-arith warnings This particularly
    includes adding a number of bytes to a void -.
  - Add and resolve cast-qual warnings
  - Resolve additional warnings identified on Centos 6.5/gcc 4.4.7
  - Remove static from zalloc()
  - Fix some compiler warnings on Ubuntu Xenial, and add comments
    re others.
  - Rename LIST parameters to lst in list_head.h to avoid upper
    case.
  - Fix real server checkers moving from failed to OK on reload.
  - add rs judgement in migrate_checkers.
  - Detect connection failure in genhash and exit rather than loop.
  - Add another function pure attribute.
  - Fix sending notifies for vrrp instances at startup when in sync
    group Issue #1155 idenfified that notify scripts for vrrp
    instance transition to backup state when keepalived started up
    were not being sent if the vrrp instance was in a sync group.
    It was also the case that SNMP traps, SMTP alerts and FIFO
    notifies were not being sent either.  This commit make
    keepalived send the initial notifies when the vrrp instance is
    in a sync group.
  - Fix building keepalived RPM on Fedora 26.  For some reason
  - fPIC is needed when testing for the presence of setns().
  - Add vrrp_startup_delay configuration option.  Some systems that
    start keepalived at boot time need to delay the startup of the
    vrrp instances, due to network interfaces taking time to
    properly come up. This commit adds a global configuration
    option vrrp_startup_delay that delays the vrrp instances
    starting up, for the specified number of seconds.
  - Handle checkers properly when reload immediately after startup.
  - Streamline some of the SMTP checker code.
  - Create separate checker for each host in SMTP_CHECK block
    Having multiple host entries in an SMTP_CHECK block is
    deprecated.  This commit streamlines the SMTP_CHECK code by
    creating a separate SMTP checker for each host declared in the
    SMTP_CHECK block, so that apart from parsing the configuration,
    the code no longer handles multiple hosts per checker.  The
    support for parsing configuration with multiple hosts is only
    enabled if WITH_HOST_ENTRIES is defined in check_smtp.c. It is
    currently enabled, but when support for multiple hosts in the
    SMTP_CHECK block is finally removed, it will simply be a matter
    of deleting all code in the WITH_HOST_ENTRIES conditional
    blocks.
  - Make checker fail if ENETUNREACH returned by connect().  The
    connect() call can return some immediate errors such as
    ENETUNREACH.  These were not being treated as a failure of the
    checker, since the code used to assume that any non success
    return by connect() meant that the connection was in progress.
    keepalived will now treat ENETUNREACH, EHOSTUNREACH,
    ECONNREFUSED, EHOSTDOWN, ENETDOWN, ECONNRESET, ECONNABORTED,
    ETIMEDOUT, when returned by connect(), as meaning that the
    checker has failed.
  - Don't set SO_LINGER with a timeout of 0 SO_LINGER with a
    timeout of 0 causes a TCP connection to be reset rather than
    cleanly closed. Instead of specifying a timeout of 0, use 5
    seconds, so that there is an orderly shutdown of the TCP
    connection, but the close socket doesn't remain in TIMED_WAIT
    state for more than a short time.
  - nftables: fix build with kernel lower than 4.1.
  - Remove dead code and cosmectics.  Remove code marked as UNUSED
    where things simply go nowhere even if define is set. We keep
    for the moment UNUSED code related to debug helpers used during
    coding process.</changelog>
  <changelog author="mrueckert@suse.de" date="1554292801">- add buildrequires for file-devel
  - used in the checker to verify scripts</changelog>
  <changelog author="mrueckert@suse.de" date="1555416000">- update to 2.0.15
  - Fix uninitialised variable.
  - Fix rpmbuild on CentOS7, and rely on auto-requires.
  - Add option to flush lvs on shutdown.  Currently all known
    virtual servers and their real servers are removed one at a
    time at shutdown. With large configurations on a busy system,
    this can take some time.  Add an option just like the existing
    'lvs_flush' which operates on shutdown. Typical environments
    with a single keepalived instance can take advantage of this
    option to achieve a faster shutdown or restart cycle.
  - Make alpha mode checkers on new real servers start down on
    reload.  Patch #1180 identified that new real servers with
    alpha mode checkers were being added online immediately, and if
    the checker then failed were being removed. This commit makes
    real servers that didn't exist before the reload start in down
    state if they have alpha mode checkers.
  - Remove duplicate config dump entry.
  - Make new real servers at reload start down if have alpha mode
    checkers.
  - Close checker and smtp_alert sockets on reload.  Issue #1177
    identified that sockets were being left open (lost) after a
    reload. It transpired that these were sockets opened by
    TCP_CHECK, HTTP_GET, SSL_GET, DNS_CHECK and SMTP_CHECK
    checkers, and by smtp_alerts in the process of being sent.
    This commit adds an extra parameter to thread_add_read() and
    thread_add_write() to allow indicating that the scheduler
    should close the socket when destroying threads.
  - Send vrrp group backup notifies at startup.
  - Make inhibit_on_failure be inherited by real server from
    virtual server.
  - Allow real and sorry servers to be configured with port 0 This
    is to maintain backwards compatibility with keepalived prior to
    commit d87f07c - "Ensure always check return from
    inet_stosockaddr when parsing config".  The proper way to
    configure this is to omit the port, which requires the next
    commit.
  - Don't setup IPVS config with real and virtual servers ports
    different.  If the real server is using DR or TUN, the port of
    the real server must be the same as the port of the virtual
    server. This commit uses the virtual server port for the real
    server when configuring IPVS.
  - Log warnings if real server and virtual server ports don't
    match This commit adds logging warnings if virtual and real
    server ports, when using TUN or DR, don't match.  It also sets
    the real server ports to be the same as the virtual server
    ports. Although listing the IPVS configuration with ipvsadm
    will look different, the kernel ignored the port of a real
    server when using DR or TUN, so the behaviour isn't changed,
    but when looking at the configuration it now shows what is
    actually happening.
  - Fix warning when protocol specified for virtual server with
    fwmark.
  - Add log message that nb_get_retry is deprecated.
  - Fix whitespace in configure.ac.
  - Fix configure error when systemd not installed configure was
    trying to execute pkg-config --variable=systemdsystemunitdir
    systemd even if systemd was not available.  This commit makes
    configure only execute the above if it has determined that
    systemd is the correct init package to use.
  - Correct references to RFC6527 (VRRPv3 SNMP RFC).
  - nsure checker-&gt;has_run is always set once a checker has run.
  - Fix some indentation in configure.ac.
  - Update fopen_safe() to open temporary file in destination
    directory rename() in fopen_safe() was failing if the file
    being created was not on the same filesystem as /tmp.
  - Add ${_RANDOM} configuration keyword.  It might seem strange to
    introduce random elements to configuration files, but it can be
    useful for testing.
  - Fix using ~SEQ() in multiline configuration definitions.
  - Make blank lines terminate a multiline definition.
  - Minor updates for lvs_flush_on_stop.
  - Add option to skip deleting real servers on shutdown or reload
    If a virtual server is removed, the kernel will remove its real
    servers, so keepalived doesn't explicitly need to do so.  The
    lvs_flush_onstop option removes all LVS configuration, whereas
    this new option will only remove the virtual servers managed by
    keepalived.
  - Correct error message re checker_log_all_failures.
  - Fix syntax error in configure.ac.
  - Fix track_process initialisation for processes with PIDs
    starting 9.
  - Remove debugging log message.
  - Remove inappropriate function const attributes They were
    causing iptables/ipsets not to be initialised.
  - Stop warning: function might be candidate for attribute
    "const" Depending on what configure options are selected,
    gcc can output the above warning for
    initialise_debug_options().  This commit ensures that the
    warning is not produced.
  - Enable strict-config-checks option in keepalived.spec RPM file.
  - vrrp: relax attribute 'const' warning at iptables helpers.
  - Propagate libm to KA_LIBS.
  - Fix building on Alpine Linux.  Alpine (musl) doesn't have a
    definition of __GNU_PREREQ, so create a dummy definition.</changelog>
  <changelog author="mrueckert@suse.de" date="1555416001">- added systemd-after-snmp.patch:
  If you want to use the snmp support the masterx socket needs be
  available otherwise the snmp support is broken
  strictly speaking we would need to use BindsTo= here but that
  would require that add a Requires for net-snmp to the keepalived
  package. to be discussed.</changelog>
  <changelog author="chris@computersalat.de" date="1563883200">- Update to 2.0.17 (2019-06-25)
  * https://www.keepalived.org/changelog.html
- remove obsolete patch
  * systemd-after-snmp.patch
- rebase patch
  * linux-4.15.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1573128000">- update to 2.0.19
  Fix minor IPVS features support. Extend BFD to support more than
  one BFD instance with a neighnour. Extend nftable support. Script
  timeout extension. Properly filter IGMP/MLD packets on VMAC
  interface. Refer to ChangeLog for more infos.
  https://keepalived.org/changelog.html
- changes from 2.0.18
  Add support to IPVS new GUE tunnel type. New feature 'weight
  reverse' available in all trackers. Resolve all outstanding
  coverity issues. Some fixes and performance extensions. Refer to
  ChangeLog for more infos.
  https://keepalived.org/changelog.html</changelog>
  <changelog author="mrueckert@suse.de" date="1573128001">- new BR pkgconfig(libnftnl) to fix nftables support</changelog>
  <changelog author="dakechi@suse.com" date="1584100800">- Inclusion into SLE as ACC supported packages
  (bsc#1158280, ECO#223)</changelog>
  <changelog author="mrueckert@suse.de" date="1611662400">- Update to 2.2.1
  https://www.keepalived.org/release-notes/Release-2.2.1.html
  https://www.keepalived.org/release-notes/Release-2.2.0.html
  https://www.keepalived.org/release-notes/Release-2.1.5.html
  https://www.keepalived.org/release-notes/Release-2.1.4.html
  https://www.keepalived.org/release-notes/Release-2.1.3.html
  https://www.keepalived.org/release-notes/Release-2.1.2.html
  https://www.keepalived.org/release-notes/Release-2.1.1.html
  https://www.keepalived.org/release-notes/Release-2.1.0.html
- enable systemd integration via libsystemd (new BR: libsystemd)
- switch to systemd_ordering instead of systemd_requires
- sync configure options with the configure script</changelog>
  <changelog author="mrueckert@suse.de" date="1613649600">- Make sure we pull in the libraries we need for dlopen, by
  following the symlinks from the .so symlinks with the
  requires_file macro.</changelog>
  <changelog author="mrueckert@suse.de" date="1615118400">- Update to 2.2.2
  https://www.keepalived.org/release-notes/Release-2.2.2.html
- change how we install documentation to avoid duplicated files
- Link all the files for ipset, iptables, libnl instead of dlopen.
  Drop the previous workaround for generating requires for the
  dlopen-ed libaries.
- remove unsupported configure option: --enable-libiptc</changelog>
  <changelog author="mrueckert@suse.de" date="1615204800">- drop linux-4.15.patch: No longer needed as it was a backport from
  upstream
- Cleanup configure options after consultation with upstream:
  - --enable-regex-timers is for debugging purposes
  - --enable-snmp-checker and --enable-snmp-vrrp are enabled by
  - -enable-snmp
  - --enable-snmp-rfcv2 and --enable-snmp-rfcv3 anre enabled by
  - -enable-snmp-rfc
  - --enable-stacktrace is definitely a debugging option
- on systems where we have nftables support we will only ship with
  nftables support (&gt;= 15.0) and use iptables support only on older
  distributions.</changelog>
  <changelog author="dmueller@suse.com" date="1626868800">- add 1915.patch to fix build on tumbleweed</changelog>
  <changelog author="jsegitz@suse.com" date="1632744000">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_keepalived.service.patch</changelog>
  <changelog author="varkoly@suse.com" date="1659960000">- VUL-0: CVE-2021-44225: keepalived: possible privilege escalation
  due to insufficient control in the D-Bus policy (bsc#1193115)
  apply upstream patch:
  * 0001-dbus-fix-policy-to-not-be-overly-broad.patch</changelog>
  <changelog author="varkoly@suse.com" date="1661774400">- FATAL: Module ip_vs not found in directory /lib/modules/5.14.21-150400.24.18-default
  (bsc#1202808)
  Set ProtectKernelModules to false in service file</changelog>
</package>
<package pkgid="66061a9f7a5090844fdb78b26d622d86cc754557e583caed1e96a9ebe9a5b70e" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.14.21" rel="150400.24.38.1"/>
  <changelog author="fdmanana@suse.com" date="1670241600">- btrfs: send: remove unused found_type parameter to
  lookup_dir_item_inode() (bsc#1206036).
- commit 7f2d376</changelog>
  <changelog author="fdmanana@suse.com" date="1670241601">- btrfs: send: remove unused type parameter to iterate_inode_ref_t
  (bsc#1206036).
- commit 0e9e4f2</changelog>
  <changelog author="lhenriques@suse.de" date="1670241602">- ceph: avoid putting the realm twice when decoding snaps fails
  (bsc#1206051).
- ceph: allow ceph.dir.rctime xattr to be updatable (bsc#1206050).
- ceph: fix memory leak in ceph_readdir when note_last_dentry
  returns  error (bsc#1206049).
- ceph: fix inode reference leakage in ceph_get_snapdir()
  (bsc#1206048).
- ceph: do not update snapshot context when there is no new
  snapshot (bsc#1206047).
- ceph: switch netfs read ops to use rreq-&gt;inode instead of
  rreq-&gt;mapping-&gt;host (bsc#1206046).
- ceph: properly handle statfs on multifs setups (bsc#1206045).
- commit 777e847</changelog>
  <changelog author="fdmanana@suse.com" date="1670241603">- btrfs: send: refactor arguments of get_inode_info()
  (bsc#1206036).
- commit a80bf85</changelog>
  <changelog author="fdmanana@suse.com" date="1670241604">- btrfs: send: use boolean types for current inode status
  (bsc#1206036).
- commit 36f86c0</changelog>
  <changelog author="fdmanana@suse.com" date="1670241605">- btrfs: send: fix failures when processing inodes with no links
  (bsc#1206036).
- commit f017ade</changelog>
  <changelog author="fdmanana@suse.com" date="1670241606">- btrfs: send: fix send failure of a subcase of orphan inodes
  (bsc#1206036).
- commit 90cbaac</changelog>
  <changelog author="fdmanana@suse.com" date="1670241607">- btrfs: fix processing of delayed data refs during backref
  walking (bsc#1206056).
- commit 2ec426f</changelog>
  <changelog author="fdmanana@suse.com" date="1670241608">- btrfs: fix processing of delayed tree block refs during backref
  walking (bsc#1206057).
- commit 83a8ed2</changelog>
  <changelog author="jgross@suse.com" date="1670414400">- xen/netback: Ensure protocol headers don't fall in the
  non-linear area (bsc#1206113, XSA-423, CVE-2022-3643).
- commit 6c8da66</changelog>
  <changelog author="jgross@suse.com" date="1670414401">- xen/netback: don't call kfree_skb() with interrupts disabled
  (bsc#1206114, XSA-424, CVE-2022-42328, CVE-2022-42329).
- commit 90098d3</changelog>
  <changelog author="jslaby@suse.cz" date="1670414402">- x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon
  resume from S3 (bsc#1206037).
- commit 6215cd5</changelog>
  <changelog author="fdmanana@suse.com" date="1670414403">- btrfs: export a helper for compression hard check (bsc#1206149).
- commit f5cf2dc</changelog>
  <changelog author="fdmanana@suse.com" date="1670414404">- btrfs: do not allow compression on nodatacow files
  (bsc#1206149).
- commit 5167f62</changelog>
  <changelog author="fdmanana@suse.com" date="1670414405">- btrfs: check if root is readonly while setting security xattr
  (bsc#1206147).
- commit 50a73ba</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1670500800">- kbuild: Unify options for BTF generation for vmlinux and modules
  (bsc#1204693).
- Refresh patches.suse/kbuild-Add-skip_encoding_btf_enum64-option-to-pahole.patch
- commit 5addeac</changelog>
  <changelog author="tiwai@suse.de" date="1670587200">- macsec: add missing attribute validation for offload
  (git-fixes).
- net: thunderbolt: fix memory leak in tbnet_open() (git-fixes).
- mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  (git-fixes).
- ca8210: Fix crash by zero initializing data (git-fixes).
- ieee802154: cc2520: Fix error return code in cc2520_hw_init()
  (git-fixes).
- net: mdio: fix unbalanced fwnode reference count in
  mdio_device_release() (git-fixes).
- NFC: nci: Bounds check struct nfc_target arrays (git-fixes).
- Bluetooth: Fix not cleanup led when bt_init fails (git-fixes).
- Bluetooth: 6LoWPAN: add missing hci_dev_put() in
  get_l2cap_conn() (git-fixes).
- e1000e: Fix TX dispatch condition (git-fixes).
- HID: core: fix shift-out-of-bounds in hid_report_raw_event
  (git-fixes).
- HID: hid-lg4ff: Add check for empty lbuf (git-fixes).
- gpio: amd8111: Fix PCI device reference count leak (git-fixes).
- ACPI: HMAT: Fix initiator registration for single-initiator
  systems (git-fixes).
- ACPI: HMAT: remove unnecessary variable initialization
  (git-fixes).
- pinctrl: intel: Save and restore pins in "direct IRQ" mode
  (git-fixes).
- nilfs2: fix NULL pointer dereference in
  nilfs_palloc_commit_free_entry() (git-fixes).
- commit a0e4929</changelog>
  <changelog author="tiwai@suse.de" date="1670587201">- selftests: rtnetlink: correct xfrm policy rule in
  kci_test_ipsec_offload (git-fixes).
- vmxnet3: use correct intrConf reference when using extended
  queues (git-fixes).
- vmxnet3: correctly report encapsulated LRO packet (git-fixes).
- proc: proc_skip_spaces() shouldn't think it is working on C
  strings (git-fixes).
- proc: avoid integer type confusion in get_proc_long (git-fixes).
- commit 3a866aa</changelog>
  <changelog author="tzimmermann@suse.de" date="1670587202">- Revert "drm/vc4: hvs: Reset muxes at probe time (git-fixes)." (bsc#1202341)
  This reverts commit 303122d0f2160411fa1068220bc59849d848550d.
  The reverted change clears hardware state on the RPi4, which leaves the
  screen blank. Without it, the display works correctly.
- commit 957f968</changelog>
  <changelog author="tiwai@suse.de" date="1670587203">- Update patch reference for proc fixes (CVE-2022-4378 bsc#1206207)
- commit cab6fa7</changelog>
</package>
<package pkgid="d4ec44f364748e8dbb7cfa74b5c6bdc8c9ddc35869b889231cdc58642bca8c33" name="kernel-default" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.24.38.1"/>
  <changelog author="fdmanana@suse.com" date="1670241600">- btrfs: send: remove unused found_type parameter to
  lookup_dir_item_inode() (bsc#1206036).
- commit 7f2d376</changelog>
  <changelog author="fdmanana@suse.com" date="1670241601">- btrfs: send: remove unused type parameter to iterate_inode_ref_t
  (bsc#1206036).
- commit 0e9e4f2</changelog>
  <changelog author="lhenriques@suse.de" date="1670241602">- ceph: avoid putting the realm twice when decoding snaps fails
  (bsc#1206051).
- ceph: allow ceph.dir.rctime xattr to be updatable (bsc#1206050).
- ceph: fix memory leak in ceph_readdir when note_last_dentry
  returns  error (bsc#1206049).
- ceph: fix inode reference leakage in ceph_get_snapdir()
  (bsc#1206048).
- ceph: do not update snapshot context when there is no new
  snapshot (bsc#1206047).
- ceph: switch netfs read ops to use rreq-&gt;inode instead of
  rreq-&gt;mapping-&gt;host (bsc#1206046).
- ceph: properly handle statfs on multifs setups (bsc#1206045).
- commit 777e847</changelog>
  <changelog author="fdmanana@suse.com" date="1670241603">- btrfs: send: refactor arguments of get_inode_info()
  (bsc#1206036).
- commit a80bf85</changelog>
  <changelog author="fdmanana@suse.com" date="1670241604">- btrfs: send: use boolean types for current inode status
  (bsc#1206036).
- commit 36f86c0</changelog>
  <changelog author="fdmanana@suse.com" date="1670241605">- btrfs: send: fix failures when processing inodes with no links
  (bsc#1206036).
- commit f017ade</changelog>
  <changelog author="fdmanana@suse.com" date="1670241606">- btrfs: send: fix send failure of a subcase of orphan inodes
  (bsc#1206036).
- commit 90cbaac</changelog>
  <changelog author="fdmanana@suse.com" date="1670241607">- btrfs: fix processing of delayed data refs during backref
  walking (bsc#1206056).
- commit 2ec426f</changelog>
  <changelog author="fdmanana@suse.com" date="1670241608">- btrfs: fix processing of delayed tree block refs during backref
  walking (bsc#1206057).
- commit 83a8ed2</changelog>
  <changelog author="jgross@suse.com" date="1670414400">- xen/netback: Ensure protocol headers don't fall in the
  non-linear area (bsc#1206113, XSA-423, CVE-2022-3643).
- commit 6c8da66</changelog>
  <changelog author="jgross@suse.com" date="1670414401">- xen/netback: don't call kfree_skb() with interrupts disabled
  (bsc#1206114, XSA-424, CVE-2022-42328, CVE-2022-42329).
- commit 90098d3</changelog>
  <changelog author="jslaby@suse.cz" date="1670414402">- x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon
  resume from S3 (bsc#1206037).
- commit 6215cd5</changelog>
  <changelog author="fdmanana@suse.com" date="1670414403">- btrfs: export a helper for compression hard check (bsc#1206149).
- commit f5cf2dc</changelog>
  <changelog author="fdmanana@suse.com" date="1670414404">- btrfs: do not allow compression on nodatacow files
  (bsc#1206149).
- commit 5167f62</changelog>
  <changelog author="fdmanana@suse.com" date="1670414405">- btrfs: check if root is readonly while setting security xattr
  (bsc#1206147).
- commit 50a73ba</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1670500800">- kbuild: Unify options for BTF generation for vmlinux and modules
  (bsc#1204693).
- Refresh patches.suse/kbuild-Add-skip_encoding_btf_enum64-option-to-pahole.patch
- commit 5addeac</changelog>
  <changelog author="tiwai@suse.de" date="1670587200">- macsec: add missing attribute validation for offload
  (git-fixes).
- net: thunderbolt: fix memory leak in tbnet_open() (git-fixes).
- mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  (git-fixes).
- ca8210: Fix crash by zero initializing data (git-fixes).
- ieee802154: cc2520: Fix error return code in cc2520_hw_init()
  (git-fixes).
- net: mdio: fix unbalanced fwnode reference count in
  mdio_device_release() (git-fixes).
- NFC: nci: Bounds check struct nfc_target arrays (git-fixes).
- Bluetooth: Fix not cleanup led when bt_init fails (git-fixes).
- Bluetooth: 6LoWPAN: add missing hci_dev_put() in
  get_l2cap_conn() (git-fixes).
- e1000e: Fix TX dispatch condition (git-fixes).
- HID: core: fix shift-out-of-bounds in hid_report_raw_event
  (git-fixes).
- HID: hid-lg4ff: Add check for empty lbuf (git-fixes).
- gpio: amd8111: Fix PCI device reference count leak (git-fixes).
- ACPI: HMAT: Fix initiator registration for single-initiator
  systems (git-fixes).
- ACPI: HMAT: remove unnecessary variable initialization
  (git-fixes).
- pinctrl: intel: Save and restore pins in "direct IRQ" mode
  (git-fixes).
- nilfs2: fix NULL pointer dereference in
  nilfs_palloc_commit_free_entry() (git-fixes).
- commit a0e4929</changelog>
  <changelog author="tiwai@suse.de" date="1670587201">- selftests: rtnetlink: correct xfrm policy rule in
  kci_test_ipsec_offload (git-fixes).
- vmxnet3: use correct intrConf reference when using extended
  queues (git-fixes).
- vmxnet3: correctly report encapsulated LRO packet (git-fixes).
- proc: proc_skip_spaces() shouldn't think it is working on C
  strings (git-fixes).
- proc: avoid integer type confusion in get_proc_long (git-fixes).
- commit 3a866aa</changelog>
  <changelog author="tzimmermann@suse.de" date="1670587202">- Revert "drm/vc4: hvs: Reset muxes at probe time (git-fixes)." (bsc#1202341)
  This reverts commit 303122d0f2160411fa1068220bc59849d848550d.
  The reverted change clears hardware state on the RPi4, which leaves the
  screen blank. Without it, the display works correctly.
- commit 957f968</changelog>
  <changelog author="tiwai@suse.de" date="1670587203">- Update patch reference for proc fixes (CVE-2022-4378 bsc#1206207)
- commit cab6fa7</changelog>
</package>
<package pkgid="bea7be089f46751554dbc76d01712a0b7ae6fdda41fee0875dddde07899181b8" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.24.38.1"/>
  <changelog author="fdmanana@suse.com" date="1670241600">- btrfs: send: remove unused found_type parameter to
  lookup_dir_item_inode() (bsc#1206036).
- commit 7f2d376</changelog>
  <changelog author="fdmanana@suse.com" date="1670241601">- btrfs: send: remove unused type parameter to iterate_inode_ref_t
  (bsc#1206036).
- commit 0e9e4f2</changelog>
  <changelog author="lhenriques@suse.de" date="1670241602">- ceph: avoid putting the realm twice when decoding snaps fails
  (bsc#1206051).
- ceph: allow ceph.dir.rctime xattr to be updatable (bsc#1206050).
- ceph: fix memory leak in ceph_readdir when note_last_dentry
  returns  error (bsc#1206049).
- ceph: fix inode reference leakage in ceph_get_snapdir()
  (bsc#1206048).
- ceph: do not update snapshot context when there is no new
  snapshot (bsc#1206047).
- ceph: switch netfs read ops to use rreq-&gt;inode instead of
  rreq-&gt;mapping-&gt;host (bsc#1206046).
- ceph: properly handle statfs on multifs setups (bsc#1206045).
- commit 777e847</changelog>
  <changelog author="fdmanana@suse.com" date="1670241603">- btrfs: send: refactor arguments of get_inode_info()
  (bsc#1206036).
- commit a80bf85</changelog>
  <changelog author="fdmanana@suse.com" date="1670241604">- btrfs: send: use boolean types for current inode status
  (bsc#1206036).
- commit 36f86c0</changelog>
  <changelog author="fdmanana@suse.com" date="1670241605">- btrfs: send: fix failures when processing inodes with no links
  (bsc#1206036).
- commit f017ade</changelog>
  <changelog author="fdmanana@suse.com" date="1670241606">- btrfs: send: fix send failure of a subcase of orphan inodes
  (bsc#1206036).
- commit 90cbaac</changelog>
  <changelog author="fdmanana@suse.com" date="1670241607">- btrfs: fix processing of delayed data refs during backref
  walking (bsc#1206056).
- commit 2ec426f</changelog>
  <changelog author="fdmanana@suse.com" date="1670241608">- btrfs: fix processing of delayed tree block refs during backref
  walking (bsc#1206057).
- commit 83a8ed2</changelog>
  <changelog author="jgross@suse.com" date="1670414400">- xen/netback: Ensure protocol headers don't fall in the
  non-linear area (bsc#1206113, XSA-423, CVE-2022-3643).
- commit 6c8da66</changelog>
  <changelog author="jgross@suse.com" date="1670414401">- xen/netback: don't call kfree_skb() with interrupts disabled
  (bsc#1206114, XSA-424, CVE-2022-42328, CVE-2022-42329).
- commit 90098d3</changelog>
  <changelog author="jslaby@suse.cz" date="1670414402">- x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon
  resume from S3 (bsc#1206037).
- commit 6215cd5</changelog>
  <changelog author="fdmanana@suse.com" date="1670414403">- btrfs: export a helper for compression hard check (bsc#1206149).
- commit f5cf2dc</changelog>
  <changelog author="fdmanana@suse.com" date="1670414404">- btrfs: do not allow compression on nodatacow files
  (bsc#1206149).
- commit 5167f62</changelog>
  <changelog author="fdmanana@suse.com" date="1670414405">- btrfs: check if root is readonly while setting security xattr
  (bsc#1206147).
- commit 50a73ba</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1670500800">- kbuild: Unify options for BTF generation for vmlinux and modules
  (bsc#1204693).
- Refresh patches.suse/kbuild-Add-skip_encoding_btf_enum64-option-to-pahole.patch
- commit 5addeac</changelog>
  <changelog author="tiwai@suse.de" date="1670587200">- macsec: add missing attribute validation for offload
  (git-fixes).
- net: thunderbolt: fix memory leak in tbnet_open() (git-fixes).
- mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
  (git-fixes).
- ca8210: Fix crash by zero initializing data (git-fixes).
- ieee802154: cc2520: Fix error return code in cc2520_hw_init()
  (git-fixes).
- net: mdio: fix unbalanced fwnode reference count in
  mdio_device_release() (git-fixes).
- NFC: nci: Bounds check struct nfc_target arrays (git-fixes).
- Bluetooth: Fix not cleanup led when bt_init fails (git-fixes).
- Bluetooth: 6LoWPAN: add missing hci_dev_put() in
  get_l2cap_conn() (git-fixes).
- e1000e: Fix TX dispatch condition (git-fixes).
- HID: core: fix shift-out-of-bounds in hid_report_raw_event
  (git-fixes).
- HID: hid-lg4ff: Add check for empty lbuf (git-fixes).
- gpio: amd8111: Fix PCI device reference count leak (git-fixes).
- ACPI: HMAT: Fix initiator registration for single-initiator
  systems (git-fixes).
- ACPI: HMAT: remove unnecessary variable initialization
  (git-fixes).
- pinctrl: intel: Save and restore pins in "direct IRQ" mode
  (git-fixes).
- nilfs2: fix NULL pointer dereference in
  nilfs_palloc_commit_free_entry() (git-fixes).
- commit a0e4929</changelog>
  <changelog author="tiwai@suse.de" date="1670587201">- selftests: rtnetlink: correct xfrm policy rule in
  kci_test_ipsec_offload (git-fixes).
- vmxnet3: use correct intrConf reference when using extended
  queues (git-fixes).
- vmxnet3: correctly report encapsulated LRO packet (git-fixes).
- proc: proc_skip_spaces() shouldn't think it is working on C
  strings (git-fixes).
- proc: avoid integer type confusion in get_proc_long (git-fixes).
- commit 3a866aa</changelog>
  <changelog author="tzimmermann@suse.de" date="1670587202">- Revert "drm/vc4: hvs: Reset muxes at probe time (git-fixes)." (bsc#1202341)
  This reverts commit 303122d0f2160411fa1068220bc59849d848550d.
  The reverted change clears hardware state on the RPi4, which leaves the
  screen blank. Without it, the display works correctly.
- commit 957f968</changelog>
  <changelog author="tiwai@suse.de" date="1670587203">- Update patch reference for proc fixes (CVE-2022-4378 bsc#1206207)
- commit cab6fa7</changelog>
</package>
<package pkgid="53b4fc5d772ba6d61e41c4c7774a3ee95d6e59eaff4ae9dd9ca7f71e55ac3ebf" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.14.21" rel="150400.24.41.1"/>
  <changelog author="msuchanek@suse.de" date="1673006400">- powerpc/powernv: add missing of_node_put (bsc#1065729).
- commit 678d5a8</changelog>
  <changelog author="tiwai@suse.de" date="1673265600">- Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout"
  (git-fixes).
- drm/i915/gvt: fix vgpu debugfs clean in remove (git-fixes).
- drm/i915/gvt: fix gvt debugfs destroy (git-fixes).
- drm/i915: unpin on error in intel_vgpu_shadow_mm_pin()
  (git-fixes).
- drm/imx: ipuv3-plane: Fix overlay plane width (git-fixes).
- drm/meson: Reduce the FIFO lines held when AFBC is not used
  (git-fixes).
- drm/panfrost: Fix GEM handle creation ref-counting (git-fixes).
- thermal: int340x: Add missing attribute for data rate base
  (git-fixes).
- caif: fix memory leak in cfctrl_linkup_request() (git-fixes).
- usb: rndis_host: Secure rndis_query check against int overflow
  (git-fixes).
- dt-bindings: net: sun8i-emac: Add phy-supply property
  (git-fixes).
- net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe
  (git-fixes).
- nfc: Fix potential resource leaks (git-fixes).
- vmxnet3: correctly report csum_level for encapsulated packet
  (git-fixes).
- gpio: sifive: Fix refcount leak in sifive_gpio_probe
  (git-fixes).
- fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB
  (git-fixes).
- commit ac1915a</changelog>
  <changelog author="palcantara@suse.de" date="1673265601">- cifs: Fix kmap_local_page() unmapping (git-fixes).
- commit ff2c079</changelog>
  <changelog author="oneukum@suse.com" date="1673438400">- blacklist.conf: misattributed, we do not have this bug
- commit bc3473d</changelog>
  <changelog author="oneukum@suse.com" date="1673438401">- blacklist.conf: too risky
- commit 51ffe7a</changelog>
  <changelog author="oneukum@suse.com" date="1673438402">- blacklist.conf: misattributed
- commit ee5f25a</changelog>
  <changelog author="msuchanek@suse.de" date="1673438403">- powerpc: Take in account addition CPU node when building kexec
  FDT (bsc#1207016 ltc#201108).
- powerpc: export the CPU node count (bsc#1207016 ltc#201108).
- commit 4ca3eba</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1673438404">- Refresh
  patches.suse/octeontx2-Move-devlink-registration-to-be-last-devli.patch.
  Added missing hunk in backport.
- commit 9b34e71</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673438405">- cpufreq: ACPI: Defer setting boost MSRs (bsc#1205485).
- commit 32f938b</changelog>
  <changelog author="msuchanek@suse.de" date="1673438406">- ibmveth: Always stop tx queues during close (bsc#1065729).
- commit 11e0f4a</changelog>
  <changelog author="lduncan@suse.com" date="1673438407">- blacklist.conf: add two drbd git-fixes to ignore
- commit d03d927</changelog>
  <changelog author="oneukum@suse.com" date="1673438408">- Update
  patches.suse/dmaengine-idxd-Fix-crc_val-field-for-completion-reco.patch
  (bsc#1206554).
  Added bugzilla number
- commit 1fe5012</changelog>
  <changelog author="lduncan@suse.com" date="1673438409">- drbd: destroy workqueue when drbd device was freed (git-fixes).
- drbd: remove call to memset before free
  device/resource/connection (git-fixes).
- drbd: use after free in drbd_create_device() (git-fixes).
- drbd: set QUEUE_FLAG_STABLE_WRITES (git-fixes).
- drbd: remove usage of list iterator variable after loop
  (git-fixes).
- commit 26591d7</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524800">- cpufreq: ACPI: Remove unused variables 'acpi_cpufreq_online'
  and 'ret' (bsc#1205485).
- commit bac712b</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524801">- cpufreq: ACPI: Only set boost MSRs on supported CPUs
  (bsc#1205485).
- commit 2fc91f1</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524802">- cpufreq: intel_pstate: Add Sapphire Rapids support in no-HWP
  mode (bsc#1201068).
- commit 15e54a9</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1673524803">- octeontx2-pf: Fix lmtst ID used in aura free (jsc#SLE-24682).
- octeontx2-af: Allow mkex profile without DMAC and add L2M/L2B
  header extraction support (jsc#SLE-24682).
- octeontx2-pf: Fix pfc_alloc_status array overflow
  (jsc#SLE-24682).
- octeontx2-pf: Fix SQE threshold checking (jsc#SLE-24682).
- octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT]
  (jsc#SLE-24682).
- octeontx2-pf: Fix unused variable build error (jsc#SLE-24682).
- octeontx2-af: Initialize PTP_SEC_ROLLOVER register properly
  (jsc#SLE-24682).
- octeontx2-af: Add PTP PPS Errata workaround on CN10K silicon
  (jsc#SLE-24682).
- octeontx2-pf: Add support for ptp 1-step mode on CN10K silicon
  (jsc#SLE-24682).
- octeontx2-af: return correct ptp timestamp for CN10K silicon
  (jsc#SLE-24682).
- octeontx2-pf: Add egress PFC support (jsc#SLE-24682).
- octeontx2-pf: Reduce minimum mtu size to 60 (jsc#SLE-24682).
- octeontx2-af: Set NIX link credits based on max LMAC
  (jsc#SLE-24682).
- octeontx2-af: Limit link bringup time at firmware
  (jsc#SLE-24682).
- octeontx2-af: Skip CGX/RPM probe incase of zero lmac count
  (jsc#SLE-24682).
- octeontx2: Modify mbox request and response structures
  (jsc#SLE-24682).
- octeontx2-af: Don't reset previous pfc config (jsc#SLE-24682).
- octeontx2-af: fix operand size in bitwise operation
  (jsc#SLE-24682).
- commit a2de709</changelog>
  <changelog author="krisman@suse.de" date="1673524804">- arm64: Avoid repeated AA64MMFR1_EL1 register read on pagefault
  path (performance bsc#1203219).
- commit 82bc0ed</changelog>
  <changelog author="oneukum@suse.com" date="1673611200">- media: stv0288: use explicitly signed char (git-fixes).
- commit 72af28b</changelog>
  <changelog author="tiwai@suse.de" date="1673611201">- nfc: pn533: Wait for out_urb's completion in
  pn533_usb_send_frame() (git-fixes).
- ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude
  laptops (git-fixes).
- ALSA: line6: fix stack overflow in line6_midi_transmit
  (git-fixes).
- ALSA: line6: correct midi status byte when receiving data from
  podxt (git-fixes).
- ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071
  tablet (git-fixes).
- drm/amdgpu: handle polaris10/11 overlap asics (v2) (git-fixes).
- drm/amdgpu: make display pinning more flexible (v2) (git-fixes).
- HID: plantronics: Additional PIDs for double volume key presses
  quirk (git-fixes).
- HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
  (git-fixes).
- remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
  (git-fixes).
- soundwire: dmi-quirks: add quirk variant for LAPBC710 NUC15
  (git-fixes).
- PCI: Fix pci_device_is_present() for VFs by checking PF
  (git-fixes).
- wifi: wilc1000: sdio: fix module autoloading (git-fixes).
- ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
  (git-fixes).
- ima: Fix a potential NULL pointer access in
  ima_restore_measurement_list (git-fixes).
- ipmi: fix long wait in unload when IPMI disconnect (git-fixes).
- drm/connector: send hotplug uevent on connector cleanup
  (git-fixes).
- ALSA: patch_realtek: Fix Dell Inspiron Plus 16 (git-fixes).
- selftests: Use optional USERCFLAGS and USERLDFLAGS (git-fixes).
- ACPI: resource: Skip IRQ override on Asus Vivobook
  K3402ZA/K3502ZA (git-fixes).
- selftests: set the BUILD variable to absolute path (git-fixes).
- drm/i915/migrate: fix length calculation (git-fixes).
- drm/i915/migrate: fix offset calculation (git-fixes).
- drm/i915/migrate: don't check the scratch page (git-fixes).
- commit 1d4442d</changelog>
</package>
<package pkgid="b891e107ad40f5817b696939222ee67c9bff97566d5839893b048afd1850a6fc" name="kernel-default" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.24.41.1"/>
  <changelog author="msuchanek@suse.de" date="1673006400">- powerpc/powernv: add missing of_node_put (bsc#1065729).
- commit 678d5a8</changelog>
  <changelog author="tiwai@suse.de" date="1673265600">- Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout"
  (git-fixes).
- drm/i915/gvt: fix vgpu debugfs clean in remove (git-fixes).
- drm/i915/gvt: fix gvt debugfs destroy (git-fixes).
- drm/i915: unpin on error in intel_vgpu_shadow_mm_pin()
  (git-fixes).
- drm/imx: ipuv3-plane: Fix overlay plane width (git-fixes).
- drm/meson: Reduce the FIFO lines held when AFBC is not used
  (git-fixes).
- drm/panfrost: Fix GEM handle creation ref-counting (git-fixes).
- thermal: int340x: Add missing attribute for data rate base
  (git-fixes).
- caif: fix memory leak in cfctrl_linkup_request() (git-fixes).
- usb: rndis_host: Secure rndis_query check against int overflow
  (git-fixes).
- dt-bindings: net: sun8i-emac: Add phy-supply property
  (git-fixes).
- net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe
  (git-fixes).
- nfc: Fix potential resource leaks (git-fixes).
- vmxnet3: correctly report csum_level for encapsulated packet
  (git-fixes).
- gpio: sifive: Fix refcount leak in sifive_gpio_probe
  (git-fixes).
- fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB
  (git-fixes).
- commit ac1915a</changelog>
  <changelog author="palcantara@suse.de" date="1673265601">- cifs: Fix kmap_local_page() unmapping (git-fixes).
- commit ff2c079</changelog>
  <changelog author="oneukum@suse.com" date="1673438400">- blacklist.conf: misattributed, we do not have this bug
- commit bc3473d</changelog>
  <changelog author="oneukum@suse.com" date="1673438401">- blacklist.conf: too risky
- commit 51ffe7a</changelog>
  <changelog author="oneukum@suse.com" date="1673438402">- blacklist.conf: misattributed
- commit ee5f25a</changelog>
  <changelog author="msuchanek@suse.de" date="1673438403">- powerpc: Take in account addition CPU node when building kexec
  FDT (bsc#1207016 ltc#201108).
- powerpc: export the CPU node count (bsc#1207016 ltc#201108).
- commit 4ca3eba</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1673438404">- Refresh
  patches.suse/octeontx2-Move-devlink-registration-to-be-last-devli.patch.
  Added missing hunk in backport.
- commit 9b34e71</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673438405">- cpufreq: ACPI: Defer setting boost MSRs (bsc#1205485).
- commit 32f938b</changelog>
  <changelog author="msuchanek@suse.de" date="1673438406">- ibmveth: Always stop tx queues during close (bsc#1065729).
- commit 11e0f4a</changelog>
  <changelog author="lduncan@suse.com" date="1673438407">- blacklist.conf: add two drbd git-fixes to ignore
- commit d03d927</changelog>
  <changelog author="oneukum@suse.com" date="1673438408">- Update
  patches.suse/dmaengine-idxd-Fix-crc_val-field-for-completion-reco.patch
  (bsc#1206554).
  Added bugzilla number
- commit 1fe5012</changelog>
  <changelog author="lduncan@suse.com" date="1673438409">- drbd: destroy workqueue when drbd device was freed (git-fixes).
- drbd: remove call to memset before free
  device/resource/connection (git-fixes).
- drbd: use after free in drbd_create_device() (git-fixes).
- drbd: set QUEUE_FLAG_STABLE_WRITES (git-fixes).
- drbd: remove usage of list iterator variable after loop
  (git-fixes).
- commit 26591d7</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524800">- cpufreq: ACPI: Remove unused variables 'acpi_cpufreq_online'
  and 'ret' (bsc#1205485).
- commit bac712b</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524801">- cpufreq: ACPI: Only set boost MSRs on supported CPUs
  (bsc#1205485).
- commit 2fc91f1</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524802">- cpufreq: intel_pstate: Add Sapphire Rapids support in no-HWP
  mode (bsc#1201068).
- commit 15e54a9</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1673524803">- octeontx2-pf: Fix lmtst ID used in aura free (jsc#SLE-24682).
- octeontx2-af: Allow mkex profile without DMAC and add L2M/L2B
  header extraction support (jsc#SLE-24682).
- octeontx2-pf: Fix pfc_alloc_status array overflow
  (jsc#SLE-24682).
- octeontx2-pf: Fix SQE threshold checking (jsc#SLE-24682).
- octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT]
  (jsc#SLE-24682).
- octeontx2-pf: Fix unused variable build error (jsc#SLE-24682).
- octeontx2-af: Initialize PTP_SEC_ROLLOVER register properly
  (jsc#SLE-24682).
- octeontx2-af: Add PTP PPS Errata workaround on CN10K silicon
  (jsc#SLE-24682).
- octeontx2-pf: Add support for ptp 1-step mode on CN10K silicon
  (jsc#SLE-24682).
- octeontx2-af: return correct ptp timestamp for CN10K silicon
  (jsc#SLE-24682).
- octeontx2-pf: Add egress PFC support (jsc#SLE-24682).
- octeontx2-pf: Reduce minimum mtu size to 60 (jsc#SLE-24682).
- octeontx2-af: Set NIX link credits based on max LMAC
  (jsc#SLE-24682).
- octeontx2-af: Limit link bringup time at firmware
  (jsc#SLE-24682).
- octeontx2-af: Skip CGX/RPM probe incase of zero lmac count
  (jsc#SLE-24682).
- octeontx2: Modify mbox request and response structures
  (jsc#SLE-24682).
- octeontx2-af: Don't reset previous pfc config (jsc#SLE-24682).
- octeontx2-af: fix operand size in bitwise operation
  (jsc#SLE-24682).
- commit a2de709</changelog>
  <changelog author="krisman@suse.de" date="1673524804">- arm64: Avoid repeated AA64MMFR1_EL1 register read on pagefault
  path (performance bsc#1203219).
- commit 82bc0ed</changelog>
  <changelog author="oneukum@suse.com" date="1673611200">- media: stv0288: use explicitly signed char (git-fixes).
- commit 72af28b</changelog>
  <changelog author="tiwai@suse.de" date="1673611201">- nfc: pn533: Wait for out_urb's completion in
  pn533_usb_send_frame() (git-fixes).
- ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude
  laptops (git-fixes).
- ALSA: line6: fix stack overflow in line6_midi_transmit
  (git-fixes).
- ALSA: line6: correct midi status byte when receiving data from
  podxt (git-fixes).
- ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071
  tablet (git-fixes).
- drm/amdgpu: handle polaris10/11 overlap asics (v2) (git-fixes).
- drm/amdgpu: make display pinning more flexible (v2) (git-fixes).
- HID: plantronics: Additional PIDs for double volume key presses
  quirk (git-fixes).
- HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
  (git-fixes).
- remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
  (git-fixes).
- soundwire: dmi-quirks: add quirk variant for LAPBC710 NUC15
  (git-fixes).
- PCI: Fix pci_device_is_present() for VFs by checking PF
  (git-fixes).
- wifi: wilc1000: sdio: fix module autoloading (git-fixes).
- ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
  (git-fixes).
- ima: Fix a potential NULL pointer access in
  ima_restore_measurement_list (git-fixes).
- ipmi: fix long wait in unload when IPMI disconnect (git-fixes).
- drm/connector: send hotplug uevent on connector cleanup
  (git-fixes).
- ALSA: patch_realtek: Fix Dell Inspiron Plus 16 (git-fixes).
- selftests: Use optional USERCFLAGS and USERLDFLAGS (git-fixes).
- ACPI: resource: Skip IRQ override on Asus Vivobook
  K3402ZA/K3502ZA (git-fixes).
- selftests: set the BUILD variable to absolute path (git-fixes).
- drm/i915/migrate: fix length calculation (git-fixes).
- drm/i915/migrate: fix offset calculation (git-fixes).
- drm/i915/migrate: don't check the scratch page (git-fixes).
- commit 1d4442d</changelog>
</package>
<package pkgid="2cb35b8333350af22b98bd0abcc318d5a034e7ece5151bc05c20e2a3daa3818d" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.24.41.1"/>
  <changelog author="msuchanek@suse.de" date="1673006400">- powerpc/powernv: add missing of_node_put (bsc#1065729).
- commit 678d5a8</changelog>
  <changelog author="tiwai@suse.de" date="1673265600">- Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout"
  (git-fixes).
- drm/i915/gvt: fix vgpu debugfs clean in remove (git-fixes).
- drm/i915/gvt: fix gvt debugfs destroy (git-fixes).
- drm/i915: unpin on error in intel_vgpu_shadow_mm_pin()
  (git-fixes).
- drm/imx: ipuv3-plane: Fix overlay plane width (git-fixes).
- drm/meson: Reduce the FIFO lines held when AFBC is not used
  (git-fixes).
- drm/panfrost: Fix GEM handle creation ref-counting (git-fixes).
- thermal: int340x: Add missing attribute for data rate base
  (git-fixes).
- caif: fix memory leak in cfctrl_linkup_request() (git-fixes).
- usb: rndis_host: Secure rndis_query check against int overflow
  (git-fixes).
- dt-bindings: net: sun8i-emac: Add phy-supply property
  (git-fixes).
- net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe
  (git-fixes).
- nfc: Fix potential resource leaks (git-fixes).
- vmxnet3: correctly report csum_level for encapsulated packet
  (git-fixes).
- gpio: sifive: Fix refcount leak in sifive_gpio_probe
  (git-fixes).
- fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB
  (git-fixes).
- commit ac1915a</changelog>
  <changelog author="palcantara@suse.de" date="1673265601">- cifs: Fix kmap_local_page() unmapping (git-fixes).
- commit ff2c079</changelog>
  <changelog author="oneukum@suse.com" date="1673438400">- blacklist.conf: misattributed, we do not have this bug
- commit bc3473d</changelog>
  <changelog author="oneukum@suse.com" date="1673438401">- blacklist.conf: too risky
- commit 51ffe7a</changelog>
  <changelog author="oneukum@suse.com" date="1673438402">- blacklist.conf: misattributed
- commit ee5f25a</changelog>
  <changelog author="msuchanek@suse.de" date="1673438403">- powerpc: Take in account addition CPU node when building kexec
  FDT (bsc#1207016 ltc#201108).
- powerpc: export the CPU node count (bsc#1207016 ltc#201108).
- commit 4ca3eba</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1673438404">- Refresh
  patches.suse/octeontx2-Move-devlink-registration-to-be-last-devli.patch.
  Added missing hunk in backport.
- commit 9b34e71</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673438405">- cpufreq: ACPI: Defer setting boost MSRs (bsc#1205485).
- commit 32f938b</changelog>
  <changelog author="msuchanek@suse.de" date="1673438406">- ibmveth: Always stop tx queues during close (bsc#1065729).
- commit 11e0f4a</changelog>
  <changelog author="lduncan@suse.com" date="1673438407">- blacklist.conf: add two drbd git-fixes to ignore
- commit d03d927</changelog>
  <changelog author="oneukum@suse.com" date="1673438408">- Update
  patches.suse/dmaengine-idxd-Fix-crc_val-field-for-completion-reco.patch
  (bsc#1206554).
  Added bugzilla number
- commit 1fe5012</changelog>
  <changelog author="lduncan@suse.com" date="1673438409">- drbd: destroy workqueue when drbd device was freed (git-fixes).
- drbd: remove call to memset before free
  device/resource/connection (git-fixes).
- drbd: use after free in drbd_create_device() (git-fixes).
- drbd: set QUEUE_FLAG_STABLE_WRITES (git-fixes).
- drbd: remove usage of list iterator variable after loop
  (git-fixes).
- commit 26591d7</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524800">- cpufreq: ACPI: Remove unused variables 'acpi_cpufreq_online'
  and 'ret' (bsc#1205485).
- commit bac712b</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524801">- cpufreq: ACPI: Only set boost MSRs on supported CPUs
  (bsc#1205485).
- commit 2fc91f1</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524802">- cpufreq: intel_pstate: Add Sapphire Rapids support in no-HWP
  mode (bsc#1201068).
- commit 15e54a9</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1673524803">- octeontx2-pf: Fix lmtst ID used in aura free (jsc#SLE-24682).
- octeontx2-af: Allow mkex profile without DMAC and add L2M/L2B
  header extraction support (jsc#SLE-24682).
- octeontx2-pf: Fix pfc_alloc_status array overflow
  (jsc#SLE-24682).
- octeontx2-pf: Fix SQE threshold checking (jsc#SLE-24682).
- octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT]
  (jsc#SLE-24682).
- octeontx2-pf: Fix unused variable build error (jsc#SLE-24682).
- octeontx2-af: Initialize PTP_SEC_ROLLOVER register properly
  (jsc#SLE-24682).
- octeontx2-af: Add PTP PPS Errata workaround on CN10K silicon
  (jsc#SLE-24682).
- octeontx2-pf: Add support for ptp 1-step mode on CN10K silicon
  (jsc#SLE-24682).
- octeontx2-af: return correct ptp timestamp for CN10K silicon
  (jsc#SLE-24682).
- octeontx2-pf: Add egress PFC support (jsc#SLE-24682).
- octeontx2-pf: Reduce minimum mtu size to 60 (jsc#SLE-24682).
- octeontx2-af: Set NIX link credits based on max LMAC
  (jsc#SLE-24682).
- octeontx2-af: Limit link bringup time at firmware
  (jsc#SLE-24682).
- octeontx2-af: Skip CGX/RPM probe incase of zero lmac count
  (jsc#SLE-24682).
- octeontx2: Modify mbox request and response structures
  (jsc#SLE-24682).
- octeontx2-af: Don't reset previous pfc config (jsc#SLE-24682).
- octeontx2-af: fix operand size in bitwise operation
  (jsc#SLE-24682).
- commit a2de709</changelog>
  <changelog author="krisman@suse.de" date="1673524804">- arm64: Avoid repeated AA64MMFR1_EL1 register read on pagefault
  path (performance bsc#1203219).
- commit 82bc0ed</changelog>
  <changelog author="oneukum@suse.com" date="1673611200">- media: stv0288: use explicitly signed char (git-fixes).
- commit 72af28b</changelog>
  <changelog author="tiwai@suse.de" date="1673611201">- nfc: pn533: Wait for out_urb's completion in
  pn533_usb_send_frame() (git-fixes).
- ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude
  laptops (git-fixes).
- ALSA: line6: fix stack overflow in line6_midi_transmit
  (git-fixes).
- ALSA: line6: correct midi status byte when receiving data from
  podxt (git-fixes).
- ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071
  tablet (git-fixes).
- drm/amdgpu: handle polaris10/11 overlap asics (v2) (git-fixes).
- drm/amdgpu: make display pinning more flexible (v2) (git-fixes).
- HID: plantronics: Additional PIDs for double volume key presses
  quirk (git-fixes).
- HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
  (git-fixes).
- remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
  (git-fixes).
- soundwire: dmi-quirks: add quirk variant for LAPBC710 NUC15
  (git-fixes).
- PCI: Fix pci_device_is_present() for VFs by checking PF
  (git-fixes).
- wifi: wilc1000: sdio: fix module autoloading (git-fixes).
- ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
  (git-fixes).
- ima: Fix a potential NULL pointer access in
  ima_restore_measurement_list (git-fixes).
- ipmi: fix long wait in unload when IPMI disconnect (git-fixes).
- drm/connector: send hotplug uevent on connector cleanup
  (git-fixes).
- ALSA: patch_realtek: Fix Dell Inspiron Plus 16 (git-fixes).
- selftests: Use optional USERCFLAGS and USERLDFLAGS (git-fixes).
- ACPI: resource: Skip IRQ override on Asus Vivobook
  K3402ZA/K3502ZA (git-fixes).
- selftests: set the BUILD variable to absolute path (git-fixes).
- drm/i915/migrate: fix length calculation (git-fixes).
- drm/i915/migrate: fix offset calculation (git-fixes).
- drm/i915/migrate: don't check the scratch page (git-fixes).
- commit 1d4442d</changelog>
</package>
<package pkgid="f6e9c69352e2e6ed44e6482786832995df1b2b8b217dbb458689db4a35deabad" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.14.21" rel="150400.24.46.1"/>
  <changelog author="nmorey@suse.com" date="1675771200">- RDMA/core: Fix ib block iterator counter overflow (git-fixes)
- commit dd46f2f</changelog>
  <changelog author="nmorey@suse.com" date="1675771201">- IB/hfi1: Reject a zero-length user expected buffer (git-fixes)
- commit 09b161d</changelog>
  <changelog author="nmorey@suse.com" date="1675771202">- IB/hfi1: Reserve user expected TIDs (git-fixes)
- commit fe650ef</changelog>
  <changelog author="nmorey@suse.com" date="1675771203">- IB/hfi1: Fix expected receive setup error exit issues (git-fixes)
- commit b274778</changelog>
  <changelog author="nmorey@suse.com" date="1675771204">- IB/hfi1: Immediately remove invalid memory from hardware (git-fixes)
- commit 9a77ebc</changelog>
  <changelog author="nmorey@suse.com" date="1675771205">- IB/hfi1: Remove user expected buffer invalidate race (git-fixes)
- commit 02f72aa</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1675771206">- net/mlx5: Dynamically resize flow counters query buffer
  (bsc#1195175).
- commit 6a283ad</changelog>
  <changelog author="colyli@suse.de" date="1675771207">- Delete for regression addressed (bsc#1207933) patches.suse/0029-zram-do-not-lookup-algorithm-in-backends-table.patch.
- commit bebd4c7</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1675771208">- RDMA/core: Fix ib block iterator counter overflow (bsc#1207878).
- commit 6de96d2</changelog>
  <changelog author="ohering@suse.de" date="1675771209">- drm/hyperv: Add error message for fb size greater than allocated
  (git-fixes).
- commit cafd34d</changelog>
  <changelog author="ohering@suse.de" date="1675771210">- scsi: storvsc: Correct reporting of Hyper-V I/O size limits
  (git-fixes).
- commit 7c7cc75</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1675857600">- net: sched: cbq: dont intepret cls results when asked to drop
  (bsc#1207036 CVE-2023-23454).
- commit 6b9dae7</changelog>
  <changelog author="oneukum@suse.com" date="1675857601">- blacklist.conf: kABI
- commit 2978c58</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1675857602">- net: sched: atm: dont intepret cls results when asked to drop
  (bsc#1207125 CVE-2023-23455).
- commit 7c3cc04</changelog>
  <changelog author="dwagner@suse.de" date="1675857603">- nvmet-auth: add missing goto in nvmet_setup_auth() (bsc#1207050
  CVE-2023-0122).
- commit bf95e5e</changelog>
  <changelog author="ohering@suse.de" date="1675857604">- Remove duplicate Git-commit tag in patch file
- commit e53c839</changelog>
  <changelog author="oneukum@suse.com" date="1675857605">- usb: gadget: f_hid: fix f_hidg lifetime vs cdev (git-fixes).
- commit b8e6a95</changelog>
  <changelog author="mkubecek@suse.cz" date="1675857606">- net: sched: fix race condition in qdisc_graft() (CVE-2023-0590
  bsc#1207795).
- net_sched: add __rcu annotation to netdev-&gt;qdisc (CVE-2023-0590
  bsc#1207795).
- commit 37e8915</changelog>
  <changelog author="palcantara@suse.de" date="1675857607">- cifs: do not include page data when checking signature
  (git-fixes).
- commit 371ed21</changelog>
  <changelog author="tiwai@suse.de" date="1675944000">- of/address: Return an error when no valid dma-ranges are found
  (git-fixes).
- usb: gadget: f_hid: fix refcount leak on error path (git-fixes).
- commit 787429a</changelog>
</package>
<package pkgid="c66db67bbf4c9874c245bb0053baada32bb0fcd64cd61df536a79d10f2209143" name="kernel-default" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.24.46.1"/>
  <changelog author="nmorey@suse.com" date="1675771200">- RDMA/core: Fix ib block iterator counter overflow (git-fixes)
- commit dd46f2f</changelog>
  <changelog author="nmorey@suse.com" date="1675771201">- IB/hfi1: Reject a zero-length user expected buffer (git-fixes)
- commit 09b161d</changelog>
  <changelog author="nmorey@suse.com" date="1675771202">- IB/hfi1: Reserve user expected TIDs (git-fixes)
- commit fe650ef</changelog>
  <changelog author="nmorey@suse.com" date="1675771203">- IB/hfi1: Fix expected receive setup error exit issues (git-fixes)
- commit b274778</changelog>
  <changelog author="nmorey@suse.com" date="1675771204">- IB/hfi1: Immediately remove invalid memory from hardware (git-fixes)
- commit 9a77ebc</changelog>
  <changelog author="nmorey@suse.com" date="1675771205">- IB/hfi1: Remove user expected buffer invalidate race (git-fixes)
- commit 02f72aa</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1675771206">- net/mlx5: Dynamically resize flow counters query buffer
  (bsc#1195175).
- commit 6a283ad</changelog>
  <changelog author="colyli@suse.de" date="1675771207">- Delete for regression addressed (bsc#1207933) patches.suse/0029-zram-do-not-lookup-algorithm-in-backends-table.patch.
- commit bebd4c7</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1675771208">- RDMA/core: Fix ib block iterator counter overflow (bsc#1207878).
- commit 6de96d2</changelog>
  <changelog author="ohering@suse.de" date="1675771209">- drm/hyperv: Add error message for fb size greater than allocated
  (git-fixes).
- commit cafd34d</changelog>
  <changelog author="ohering@suse.de" date="1675771210">- scsi: storvsc: Correct reporting of Hyper-V I/O size limits
  (git-fixes).
- commit 7c7cc75</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1675857600">- net: sched: cbq: dont intepret cls results when asked to drop
  (bsc#1207036 CVE-2023-23454).
- commit 6b9dae7</changelog>
  <changelog author="oneukum@suse.com" date="1675857601">- blacklist.conf: kABI
- commit 2978c58</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1675857602">- net: sched: atm: dont intepret cls results when asked to drop
  (bsc#1207125 CVE-2023-23455).
- commit 7c3cc04</changelog>
  <changelog author="dwagner@suse.de" date="1675857603">- nvmet-auth: add missing goto in nvmet_setup_auth() (bsc#1207050
  CVE-2023-0122).
- commit bf95e5e</changelog>
  <changelog author="ohering@suse.de" date="1675857604">- Remove duplicate Git-commit tag in patch file
- commit e53c839</changelog>
  <changelog author="oneukum@suse.com" date="1675857605">- usb: gadget: f_hid: fix f_hidg lifetime vs cdev (git-fixes).
- commit b8e6a95</changelog>
  <changelog author="mkubecek@suse.cz" date="1675857606">- net: sched: fix race condition in qdisc_graft() (CVE-2023-0590
  bsc#1207795).
- net_sched: add __rcu annotation to netdev-&gt;qdisc (CVE-2023-0590
  bsc#1207795).
- commit 37e8915</changelog>
  <changelog author="palcantara@suse.de" date="1675857607">- cifs: do not include page data when checking signature
  (git-fixes).
- commit 371ed21</changelog>
  <changelog author="tiwai@suse.de" date="1675944000">- of/address: Return an error when no valid dma-ranges are found
  (git-fixes).
- usb: gadget: f_hid: fix refcount leak on error path (git-fixes).
- commit 787429a</changelog>
</package>
<package pkgid="747d8a92df81995ade8a8b41594b26de780c712baf44aedef27767f2d9f13f02" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.24.46.1"/>
  <changelog author="nmorey@suse.com" date="1675771200">- RDMA/core: Fix ib block iterator counter overflow (git-fixes)
- commit dd46f2f</changelog>
  <changelog author="nmorey@suse.com" date="1675771201">- IB/hfi1: Reject a zero-length user expected buffer (git-fixes)
- commit 09b161d</changelog>
  <changelog author="nmorey@suse.com" date="1675771202">- IB/hfi1: Reserve user expected TIDs (git-fixes)
- commit fe650ef</changelog>
  <changelog author="nmorey@suse.com" date="1675771203">- IB/hfi1: Fix expected receive setup error exit issues (git-fixes)
- commit b274778</changelog>
  <changelog author="nmorey@suse.com" date="1675771204">- IB/hfi1: Immediately remove invalid memory from hardware (git-fixes)
- commit 9a77ebc</changelog>
  <changelog author="nmorey@suse.com" date="1675771205">- IB/hfi1: Remove user expected buffer invalidate race (git-fixes)
- commit 02f72aa</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1675771206">- net/mlx5: Dynamically resize flow counters query buffer
  (bsc#1195175).
- commit 6a283ad</changelog>
  <changelog author="colyli@suse.de" date="1675771207">- Delete for regression addressed (bsc#1207933) patches.suse/0029-zram-do-not-lookup-algorithm-in-backends-table.patch.
- commit bebd4c7</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1675771208">- RDMA/core: Fix ib block iterator counter overflow (bsc#1207878).
- commit 6de96d2</changelog>
  <changelog author="ohering@suse.de" date="1675771209">- drm/hyperv: Add error message for fb size greater than allocated
  (git-fixes).
- commit cafd34d</changelog>
  <changelog author="ohering@suse.de" date="1675771210">- scsi: storvsc: Correct reporting of Hyper-V I/O size limits
  (git-fixes).
- commit 7c7cc75</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1675857600">- net: sched: cbq: dont intepret cls results when asked to drop
  (bsc#1207036 CVE-2023-23454).
- commit 6b9dae7</changelog>
  <changelog author="oneukum@suse.com" date="1675857601">- blacklist.conf: kABI
- commit 2978c58</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1675857602">- net: sched: atm: dont intepret cls results when asked to drop
  (bsc#1207125 CVE-2023-23455).
- commit 7c3cc04</changelog>
  <changelog author="dwagner@suse.de" date="1675857603">- nvmet-auth: add missing goto in nvmet_setup_auth() (bsc#1207050
  CVE-2023-0122).
- commit bf95e5e</changelog>
  <changelog author="ohering@suse.de" date="1675857604">- Remove duplicate Git-commit tag in patch file
- commit e53c839</changelog>
  <changelog author="oneukum@suse.com" date="1675857605">- usb: gadget: f_hid: fix f_hidg lifetime vs cdev (git-fixes).
- commit b8e6a95</changelog>
  <changelog author="mkubecek@suse.cz" date="1675857606">- net: sched: fix race condition in qdisc_graft() (CVE-2023-0590
  bsc#1207795).
- net_sched: add __rcu annotation to netdev-&gt;qdisc (CVE-2023-0590
  bsc#1207795).
- commit 37e8915</changelog>
  <changelog author="palcantara@suse.de" date="1675857607">- cifs: do not include page data when checking signature
  (git-fixes).
- commit 371ed21</changelog>
  <changelog author="tiwai@suse.de" date="1675944000">- of/address: Return an error when no valid dma-ranges are found
  (git-fixes).
- usb: gadget: f_hid: fix refcount leak on error path (git-fixes).
- commit 787429a</changelog>
</package>
<package pkgid="c9921b133c23968f4dc910712d06386fdc16f0a3a5b0dc6c8e093e4c6810d334" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.14.21" rel="150400.24.49.3"/>
  <changelog author="jwiesner@suse.de" date="1677844800">- locking/rwsem: Disable preemption in all down_read*() and
  up_read() code paths (bsc#1207270).
- commit c4762ff</changelog>
  <changelog author="jwiesner@suse.de" date="1677844801">- locking/rwsem: Disable preemption in all down_write*() and
  up_write() code paths (bsc#1207270).
- commit 87b3e0b</changelog>
  <changelog author="neilb@suse.de" date="1678104000">- NFSv3: handle out-of-order write replies (bsc#1205544).
- commit 96398e7</changelog>
  <changelog author="neilb@suse.de" date="1678104001">- KABI fix for:  NFSv3: handle out-of-order write replies
  (bsc#1205544).
- commit 931f6bd</changelog>
  <changelog author="clin@suse.com" date="1678104002">- Refresh
  patches.suse/ipmi-ssif-Add-a-timer-between-request-retries.patch.
- Refresh patches.suse/ipmi-ssif-Remove-rtc_us_timer.patch.
- Refresh patches.suse/ipmi-ssif-resend_msg-cannot-fail.patch.
- Refresh
  patches.suse/ipmi_ssif-Rename-idle-state-and-check.patch.
- commit 39421c5</changelog>
  <changelog author="tiwai@suse.de" date="1678104003">- ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
  (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Odroid HC1 (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Odroid XU (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Exynos5250 (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Exynos4210 (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Exynos4 (git-fixes).
- ARM: dts: spear320-hmi: correct STMPE GPIO compatible
  (git-fixes).
- applicom: Fix PCI device refcount leak in applicom_init()
  (git-fixes).
- arm64: efi: Make efi_rt_lock a raw_spinlock (git-fixes).
- ASoC: mchp-spdifrx: disable all interrupts in
  mchp_spdifrx_dai_remove() (git-fixes).
- ASoC: mchp-spdifrx: fix controls which rely on rsr register
  (git-fixes).
- ASoC: soc-compress.c: fixup private_data on
  snd_soc_new_compress() (git-fixes).
- ALSA: hda/ca0132: minor fix for allocation size (git-fixes).
- ACPI: battery: Fix missing NUL-termination with large strings
  (git-fixes).
- ACPICA: nsrepair: handle cases without a return value correctly
  (git-fixes).
- ACPICA: Drop port I/O validation for some regions (git-fixes).
- ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for
  IOMMU node (git-fixes).
- arm64: dts: ti: k3-j7200: Fix wakeup pinmux range (git-fixes).
- arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
  (git-fixes).
- arm64: dts: mt8192: Fix CPU map for single-cluster SoC
  (git-fixes).
- arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock
  description (git-fixes).
- arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
  (git-fixes).
- arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan
  thermal trip (git-fixes).
- arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
  (git-fixes).
- arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit
  address (git-fixes).
- arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
  (git-fixes).
- arm64: dts: meson-gx: Fix Ethernet MAC address unit name
  (git-fixes).
- arm64: dts: imx8m: Align SoC unique ID node unit address
  (git-fixes).
- ARM: dts: imx7s: correct iomuxc gpr mux controller cells
  (git-fixes).
- ARM: dts: exynos: correct HDMI phy compatible in Exynos4
  (git-fixes).
- ARM: dts: exynos: correct wr-active property in Exynos3250
  Rinato (git-fixes).
- ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
  (git-fixes).
- arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
  (git-fixes).
- arm64: dts: qcom: ipq8074: fix Gen3 PCIe node (git-fixes).
- arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges (git-fixes).
- arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output
  names (git-fixes).
- arm64: dts: qcom: sc7280: correct SPMI bus address cells
  (git-fixes).
- arm64: dts: qcom: sc7180: correct SPMI bus address cells
  (git-fixes).
- arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt
  pin name (git-fixes).
- arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k
  instead of 4k (git-fixes).
- arm64: dts: qcom: qcs404: use symbol names for PCIe resets
  (git-fixes).
- ARM: bcm2835_defconfig: Enable the framebuffer (git-fixes).
- ARM: zynq: Fix refcount leak in zynq_early_slcr_init
  (git-fixes).
- ARM: imx: Call ida_simple_remove() for ida_simple_get
  (git-fixes).
- ARM: s3c: fix s3c64xx_set_timer_source prototype (git-fixes).
- ARM: OMAP1: call platform_device_put() in error case in
  omap1_dm_timer_init() (git-fixes).
- ARM: OMAP2+: Fix memory leak in realtime_counter_init()
  (git-fixes).
- ALSA: hda/realtek - fixed wrong gpio assigned (git-fixes).
- ALSA: hda/conexant: add a new hda codec SN6180 (git-fixes).
- ACPI: NFIT: fix a potential deadlock during NFIT teardown
  (git-fixes).
- ARM: dts: rockchip: add power-domains property to dp node on
  rk3288 (git-fixes).
- arm64: dts: rockchip: drop unused LED mode property from
  rk3328-roc-cc (git-fixes).
- ASoC: rt715-sdca: fix clock stop prepare timeout issue
  (git-fixes).
- ASoC: cs42l56: fix DT probe (git-fixes).
- ASoC: Intel: sof_cs42l42: always set dpcm_capture for amplifiers
  (git-fixes).
- ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers
  (git-fixes).
- ALSA: hda: Do not unset preset when cleaning up codec
  (git-fixes).
- ACPI / x86: Add support for LPS0 callback handler (git-fixes).
- commit b514cae</changelog>
  <changelog author="tiwai@suse.de" date="1678104004">- auxdisplay: hd44780: Fix potential memory leak in
  hd44780_remove() (git-fixes).
- Documentation: simplify and clarify DCO contribution example
  language (git-fixes).
- clk: qcom: gcc-qcs404: fix names of the DSI clocks used as
  parents (git-fixes).
- clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents
  (git-fixes).
- clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
  (git-fixes).
- clk: imx: avoid memory leak (git-fixes).
- clk: renesas: cpg-mssr: Remove superfluous check in resume code
  (git-fixes).
- clk: renesas: cpg-mssr: Fix use after free if
  cpg_mssr_common_init() failed (git-fixes).
- clk: ralink: fix 'mt7621_gate_is_enabled()' function
  (git-fixes).
- dmaengine: ptdma: check for null desc before calling
  pt_cmd_callback (git-fixes).
- dmaengine: dw-axi-dmac: Do not dereference NULL structure
  (git-fixes).
- dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
  (git-fixes).
- dmaengine: dw-edma: Fix readq_ch() return value truncation
  (git-fixes).
- dmaengine: dw-edma: Drop chancnt initialization (git-fixes).
- dmaengine: dw-edma: Fix invalid interleaved xfers semantics
  (git-fixes).
- dmaengine: dw-edma: Don't permit non-inc interleaved xfers
  (git-fixes).
- dmaengine: dw-edma: Fix missing src/dst address of interleaved
  xfers (git-fixes).
- driver core: fw_devlink: Add DL_FLAG_CYCLE support to device
  links (git-fixes).
- drivers: base: transport_class: fix resource leak when
  transport_add_device() fails (git-fixes).
- drivers: base: transport_class: fix possible memory leak
  (git-fixes).
- driver core: fix resource leak in device_add() (git-fixes).
- driver core: fix potential null-ptr-deref in device_add()
  (git-fixes).
- comedi: use menuconfig for main Comedi menu (git-fixes).
- Revert "char: pcmcia: cm4000_cs: Replace mdelay with
  usleep_range in set_protocol" (git-fixes).
- backlight: backlight: Fix doc for backlight_device_get_by_name
  (git-fixes).
- docs: gdbmacros: print newest record (git-fixes).
- drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
  (git-fixes).
- drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
  (git-fixes).
- drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
  (git-fixes).
- audit: update the mailing list in MAINTAINERS (git-fixes).
- docs: ftrace: fix a issue with duplicated subtitle number
  (git-fixes).
- ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not
  declared (git-fixes).
- ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
  (git-fixes).
- ASoC: dt-bindings: meson: fix gx-card codec node regex
  (git-fixes).
- ASoC: rsnd: Remove unnecessary rsnd_dbg_dai_call() (git-fixes).
- ASoC: rsnd: fixup #endif position (git-fixes).
- Bluetooth: hci_qca: get wakeup status from serdev device handle
  (git-fixes).
- Bluetooth: L2CAP: Fix potential user-after-free (git-fixes).
- crypto: crypto4xx - Call dma_unmap_page when done (git-fixes).
- crypto: rsa-pkcs1pad - Use akcipher_request_complete
  (git-fixes).
- crypto: qat - fix out-of-bounds read (git-fixes).
- Revert "crypto: rsa-pkcs1pad - Replace GFP_ATOMIC with
  GFP_KERNEL in pkcs1pad_encrypt_sign_complete" (git-fixes).
- crypto: xts - Handle EBUSY correctly (git-fixes).
- crypto: seqiv - Handle EBUSY correctly (git-fixes).
- crypto: essiv - Handle EBUSY correctly (git-fixes).
- crypto: ccp - Failure on re-initialization due to duplicate
  sysfs filename (git-fixes).
- crypto: ccp - Avoid page allocation failure warning for
  SEV_GET_ID2 (git-fixes).
- crypto: x86/ghash - fix unaligned access in ghash_setkey()
  (git-fixes).
- drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list
  (git-fixes).
- drm/amd/display: Properly handle additional cases where DCN
  is not supported (git-fixes).
- drm/nouveau/devinit/tu102-: wait for GFW_BOOT_PROGRESS ==
  COMPLETED (git-fixes).
- clk: mxl: syscon_node_to_regmap() returns error pointers
  (git-fixes).
- clk: mxl: Fix a clk entry by adding relevant flags (git-fixes).
- clk: mxl: Add option to override gate clks (git-fixes).
- clk: mxl: Remove redundant spinlocks (git-fixes).
- clk: mxl: Switch from direct readl/writel based IO to regmap
  based IO (git-fixes).
- drm/i915/gen11: Moving WAs to icl_gt_workarounds_init()
  (git-fixes).
- commit d5e5686</changelog>
  <changelog author="tiwai@suse.de" date="1678104005">- drm/i915: Don't use BAR mappings for ring buffers with LLC
  (git-fixes).
- dt-bindings: hwlock: sun6i: Add missing #hwlock-cells
  (git-fixes).
- dt-bindings: input: iqs626a: Redefine trackpad property types
  (git-fixes).
- dt-bindings: power: supply: pm8941-coincell: Don't require
  charging properties (git-fixes).
- firmware: coreboot: Remove GOOGLE_COREBOOT_TABLE_ACPI/OF
  Kconfig entries (git-fixes).
- firmware: dmi-sysfs: Fix null-ptr-deref in
  dmi_sysfs_register_handle (git-fixes).
- firmware: stratix10-svc: add missing gen_pool_destroy() in
  stratix10_svc_drv_probe() (git-fixes).
- eeprom: idt_89hpesx: Fix error handling in idt_init()
  (git-fixes).
- dt-bindings: usb: amlogic,meson-g12a-usb-ctrl: make G12A
  usb3-phy0 optional (git-fixes).
- drm/amdgpu: fix enum odm_combine_mode mismatch (git-fixes).
- drm/amd/display: reduce else-if to else in
  dcn10_blank_pixel_data() (git-fixes).
- drm/msm/dpu: set pdpu-&gt;is_rt_pipe early in
  dpu_plane_sspp_atomic_update() (git-fixes).
- drm/msm/mdp5: Add check for kzalloc (git-fixes).
- drm/msm/dpu: Add check for pstates (git-fixes).
- drm/msm/dpu: Add check for cstate (git-fixes).
- drm/msm/dpu: drop stale comment from struct dpu_mdp_cfg doc
  (git-fixes).
- drm/msm: use strscpy instead of strncpy (git-fixes).
- drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
  (git-fixes).
- dt-bindings: msm: dsi-controller-main: Add vdd* descriptions
  back in (git-fixes).
- drm/msm/dpu: Disallow unallocated resources to be returned
  (git-fixes).
- drm/msm/gem: Add check for kmalloc (git-fixes).
- drm/msm: clean event_thread-&gt;worker in case of an error
  (git-fixes).
- drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
  (git-fixes).
- drm/mediatek: Clean dangling pointer on bind error path
  (git-fixes).
- drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
  (git-fixes).
- drm/mediatek: Drop unbalanced obj unref (git-fixes).
- drm/mediatek: Use NULL instead of 0 for NULL pointer
  (git-fixes).
- drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending
  cmd (git-fixes).
- drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
  (git-fixes).
- drm/bridge: lt9611: pass a pointer to the of node (git-fixes).
- drm/bridge: lt9611: fix clock calculation (git-fixes).
- drm/bridge: lt9611: fix programming of video modes (git-fixes).
- drm/bridge: lt9611: fix polarity programming (git-fixes).
- drm/bridge: lt9611: fix HPD reenablement (git-fixes).
- drm/bridge: lt9611: fix sleep mode setup (git-fixes).
- drm/vc4: hdmi: Correct interlaced timings again (git-fixes).
- drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 (git-fixes).
- drm/vc4: hvs: Set AXI panic modes (git-fixes).
- drm/omapdrm: Remove unused struct csc_coef_rgb2yuv (git-fixes).
- drm: tidss: Fix pixel format definition (git-fixes).
- drm/bridge: lt8912b: Add hot plug detection (git-fixes).
- drm/vkms: Fix null-ptr-deref in vkms_release() (git-fixes).
- drm/vkms: Fix memory leak in vkms_init() (git-fixes).
- drm/bridge: megachips: Fix error handling in
  i2c_register_driver() (git-fixes).
- drm/vc4: vec: Use pm_runtime_resume_and_get() in
  vc4_vec_encoder_enable() (git-fixes).
- gpio: vf610: connect GPIO label to dev name (git-fixes).
- dt-bindings: net: snps,dwmac: Fix snps,reset-delays-us
  dependency (git-fixes).
- dt-bindings: arm: fsl: Fix bindings for APF28Dev board
  (git-fixes).
- commit 3467b1b</changelog>
  <changelog author="tiwai@suse.de" date="1678104006">- media: saa7134: Use video_unregister_device for radio_dev
  (git-fixes).
- media: usb: siano: Fix use after free bugs caused by
  do_submit_urb (git-fixes).
- media: i2c: ov7670: 0 instead of -EINVAL was returned
  (git-fixes).
- media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
  (git-fixes).
- media: v4l2-jpeg: ignore the unknown APP14 marker (git-fixes).
- media: v4l2-jpeg: correct the skip count in
  jpeg_parse_app14_data (git-fixes).
- media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
  (git-fixes).
- media: i2c: ov772x: Fix memleak in ov772x_probe() (git-fixes).
- media: ov5675: Fix memleak in ov5675_init_controls()
  (git-fixes).
- media: ov2740: Fix memleak in ov2740_init_controls()
  (git-fixes).
- media: max9286: Fix memleak in max9286_v4l2_register()
  (git-fixes).
- Input: iqs626a - drop unused device node references (git-fixes).
- Input: ads7846 - don't check penirq immediately for 7845
  (git-fixes).
- Input: ads7846 - always set last command to PWRDOWN (git-fixes).
- Input: ads7846 - don't report pressure for ads7845 (git-fixes).
- Input: iqs269a - configure device with a single block write
  (git-fixes).
- Input: iqs269a - increase interrupt handler return delay
  (git-fixes).
- Input: iqs269a - drop unused device node references (git-fixes).
- i2c: designware: fix i2c_dw_clk_rate() return size to be u32
  (git-fixes).
- iio: light: tsl2563: Do not hardcode interrupt trigger type
  (git-fixes).
- misc/mei/hdcp: Use correct macros to initialize uuid_le
  (git-fixes).
- misc: enclosure: Fix doc for enclosure_find() (git-fixes).
- lib/zlib: remove redundation assignement of avail_in
  dfltcc_gdht() (git-fixes).
- leds: led-core: Fix refcount leak in of_led_get() (git-fixes).
- mfd: pcf50633-adc: Fix potential memleak in
  pcf50633_adc_async_read() (git-fixes).
- mfd: cs5535: Don't build on UML (git-fixes).
- gpu: host1x: Don't skip assigning syncpoints to channels
  (git-fixes).
- gpu: ipu-v3: common: Add of_node_put() for reference returned
  by of_graph_get_port_by_id() (git-fixes).
- hwmon: (mlxreg-fan) Return zero speed for broken fan
  (git-fixes).
- hwmon: (ltc2945) Handle error case in ltc2945_value_store
  (git-fixes).
- hwmon: (ftsteutates) Fix scaling of measurements (git-fixes).
- Revert "HID: logitech-hidpp: add a module parameter to keep
  firmware gestures" (git-fixes).
- hid: bigben_probe(): validate report count (git-fixes).
- HID: bigben: use spinlock to safely schedule workers
  (git-fixes).
- HID: bigben_worker() remove unneeded check on report_field
  (git-fixes).
- HID: bigben: use spinlock to protect concurrent accesses
  (git-fixes).
- HID: asus: use spinlock to safely schedule workers (git-fixes).
- HID: asus: use spinlock to protect concurrent accesses
  (git-fixes).
- gpio: tegra186: remove unneeded loop in
  tegra186_gpio_init_route_mapping() (git-fixes).
- lib/mpi: Fix buffer overrun when SG is too long (git-fixes).
- leds: led-class: Add missing put_device() to led_put()
  (git-fixes).
- mmc: jz4740: Work around bug on JZ4760(B) (git-fixes).
- mmc: mmc_spi: fix error handling in mmc_spi_probe() (git-fixes).
- mmc: sdio: fix possible resource leaks in some error paths
  (git-fixes).
- HID: core: Fix deadloop in hid_apply_multiplier (git-fixes).
- HID: elecom: add support for TrackBall 056E:011C (git-fixes).
- staging: mt7621-dts: change palmbus address to lower case
  (git-fixes).
- commit ed4a4d9</changelog>
  <changelog author="tiwai@suse.de" date="1678104007">- thermal: intel: BXT_PMIC: select REGMAP instead of depending
  on it (git-fixes).
- thermal: intel: quark_dts: fix error pointer dereference
  (git-fixes).
- rtc: allow rtc_read_alarm without read_alarm callback
  (git-fixes).
- rtc: pm8xxx: fix set-alarm race (git-fixes).
- rtc: sun6i: Always export the internal oscillator (git-fixes).
- spi: tegra210-quad: Fix validate combined sequence (git-fixes).
- nfc: fix memory leak of se_io context in nfc_genl_se_io
  (git-fixes).
- remoteproc: qcom_q6v5_mss: Use a carveout to authenticate
  modem headers (git-fixes).
- remoteproc/mtk_scp: Move clk ops outside send_lock (git-fixes).
- mtd: rawnand: fsl_elbc: Propagate HW ECC settings to HW
  (git-fixes).
- mtd: rawnand: sunxi: Fix the size of the last OOB region
  (git-fixes).
- mtd: rawnand: sunxi: Clean up chips after failed init
  (git-fixes).
- mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
  (git-fixes).
- mtd: spi-nor: spansion: Consider reserved bits in CFR5 register
  (git-fixes).
- mtd: spi-nor: core: fix implicit declaration warning
  (git-fixes).
- mtd: spi-nor: sfdp: Fix index value for SCCR dwords (git-fixes).
- mtd: dataflash: remove duplicate SPI ID table (git-fixes).
- soundwire: cadence: Don't overflow the command FIFOs
  (git-fixes).
- phy: rockchip-typec: fix tcphy_get_mode error case (git-fixes).
- PCI: switchtec: Return -EFAULT for copy_to_user() errors
  (git-fixes).
- PCI: Fix dropping valid root bus resources with .end = zero
  (git-fixes).
- PCI/PM: Observe reset delay irrespective of bridge_d3
  (git-fixes).
- PCI/IOV: Enlarge virtfn sysfs name buffer (git-fixes).
- PCI: hotplug: Allow marking devices as disconnected during
  bind/unbind (git-fixes).
- serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
  (git-fixes).
- serial: tegra: Add missing clk_disable_unprepare() in
  tegra_uart_hw_init() (git-fixes).
- tty: serial: fsl_lpuart: disable Rx/Tx DMA in
  lpuart32_shutdown() (git-fixes).
- printf: fix errname.c list (git-fixes).
- pinctrl: mediatek: Initialize variable *buf to zero (git-fixes).
- pinctrl: rockchip: Fix refcount leak in
  rockchip_pinctrl_parse_groups (git-fixes).
- pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
  (git-fixes).
- pinctrl: qcom: pinctrl-msm8976: Correct function names for
  wcss pins (git-fixes).
- spi: synquacer: Fix timeout handling in
  synquacer_spi_transfer_one() (git-fixes).
- spi: bcm63xx-hsspi: Endianness fix for ARM based SoC
  (git-fixes).
- sefltests: netdevsim: wait for devlink instance after netns
  removal (git-fixes).
- thermal/drivers/hisi: Drop second sensor hi3660 (git-fixes).
- thermal: intel: powerclamp: Fix cur_state for multi package
  system (git-fixes).
- thermal/drivers/tsens: limit num_sensors to 9 for msm8939
  (git-fixes).
- thermal/drivers/tsens: fix slope values for msm8939 (git-fixes).
- thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
  (git-fixes).
- thermal/drivers/tsens: Drop msm8976-specific defines
  (git-fixes).
- net/rose: Fix to not accept on connected socket (git-fixes).
- platform/x86: touchscreen_dmi: Add Chuwi Vi8 (CWI501) DMI match
  (git-fixes).
- platform/x86: amd-pmc: Correct usage of SMU version (git-fixes).
- selftest/lkdtm: Skip stack-entropy test if lkdtm is not
  available (git-fixes).
- platform/x86: amd-pmc: Fix compilation when CONFIG_DEBUGFS is
  disabled (git-fixes).
- platform/x86: amd-pmc: Export Idlemask values based on the APU
  (git-fixes).
- commit 14a6c6a</changelog>
  <changelog author="tiwai@suse.de" date="1678104008">- ALSA: ice1712: Delete unreachable code in aureon_add_controls()
  (git-fixes).
- ALSA: ice1712: Do not left ice-&gt;gpio_mutex locked in
  aureon_add_controls() (git-fixes).
- ASoC: adau7118: don't disable regulators on device unbind
  (git-fixes).
- watchdog: sbsa_wdog: Make sure the timeout programming is
  within the limits (git-fixes).
- watchdog: pcwd_usb: Fix attempting to access uninitialized
  memory (git-fixes).
- watchdog: Fix kmemleak in watchdog_cdev_register (git-fixes).
- watchdog: at91sam9_wdt: use devm_request_irq to avoid missing
  free_irq() in error path (git-fixes).
- vc_screen: don't clobber return value in vcs_read (git-fixes).
- vc_screen: modify vcs_size() handling in vcs_read() (git-fixes).
- wifi: ath11k: allow system suspend to survive ath11k
  (git-fixes).
- vdpa_sim: not reset state in vdpasim_queue_ready (git-fixes).
- VMCI: check context-&gt;notify_page after call to
  get_user_pages_fast() to avoid GPF (git-fixes).
- tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx
  dma case (git-fixes).
- tty: serial: qcom-geni-serial: stop operations in progress at
  shutdown (git-fixes).
- tty: serial: fsl_lpuart: clear LPUART Status Register in
  lpuart32_shutdown() (git-fixes).
- USB: serial: option: add support for VW/Skoda "Carstick LTE"
  (git-fixes).
- usb: dwc3: pci: add support for the Intel Meteor Lake-M
  (git-fixes).
- usb: max-3421: Fix setting of I/O pins (git-fixes).
- usb: musb: mediatek: don't unregister something that wasn't
  registered (git-fixes).
- USB: core: Don't hold device lock while reading the
  "descriptors" sysfs file (git-fixes).
- usb: early: xhci-dbc: Fix a potential out-of-bound memory access
  (git-fixes).
- usb: gadget: fusb300_udc: free irq on the error path in
  fusb300_probe() (git-fixes).
- wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
  (git-fixes).
- wifi: cfg80211: Fix use after free for wext (git-fixes).
- wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
  (git-fixes).
- wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there
  is no callback function (git-fixes).
- wifi: mwifiex: fix loop iterator in
  mwifiex_update_ampdu_txwinsize() (git-fixes).
- wifi: mwifiex: Add missing compatible string for SD8787
  (git-fixes).
- wifi: iwl4965: Add missing check for
  create_singlethread_workqueue() (git-fixes).
- wifi: iwl3945: Add missing check for
  create_singlethread_workqueue (git-fixes).
- wifi: cfg80211: Fix extended KCK key length check in
  nl80211_set_rekey_data() (git-fixes).
- wifi: orinoco: check return value of hermes_write_wordrec()
  (git-fixes).
- wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
  (git-fixes).
- wifi: rtw89: Add missing check for alloc_workqueue (git-fixes).
- wifi: wl3501_cs: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas: cmdresp: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas: main: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas: if_usb: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas_tf: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
  (git-fixes).
- wifi: brcmfmac: fix potential memory leak in
  brcmf_netdev_start_xmit() (git-fixes).
- wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
  (git-fixes).
- wifi: ipw2200: fix memory leak in ipw_wdev_init() (git-fixes).
- wifi: ipw2x00: don't call dev_kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rtlwifi: Fix global-out-of-bounds bug in
  _rtl8812ae_phy_set_txpower_limit() (git-fixes).
- wifi: rtl8xxxu: don't call dev_kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas: fix memory leak in lbs_init_adapter()
  (git-fixes).
- wifi: iwlegacy: common: don't call dev_kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rtlwifi: rtl8723be: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rsi: Fix memory leak in rsi_coex_attach() (git-fixes).
- commit 795b424</changelog>
  <changelog author="tiwai@suse.de" date="1678104009">- ASoC: mchp-spdifrx: Fix uninitialized use of mr in
  mchp_spdifrx_hw_params() (git-fixes).
- commit ef46bcf</changelog>
  <changelog author="ohering@suse.de" date="1678104010">- hv_netvsc: Check status in SEND_RNDIS_PKT completion message
  (git-fixes).
- commit cf78232</changelog>
  <changelog author="dwagner@suse.de" date="1678104011">- nvme-fabrics: show well known discovery name (bsc#1200054).
- commit 0dc6ff3</changelog>
  <changelog author="jack@suse.cz" date="1678104012">- ocfs2: Fix data corruption after failed write (bsc#1208542).
- commit 92f0180</changelog>
  <changelog author="tiwai@suse.de" date="1678104013">- Move upstreamed i915 and media fixes into sorted section
- commit f79acc7</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1678104014">- Refresh
  patches.suse/ice-Do-not-skip-not-enabled-queues-in-ice_vc_dis_qs_.patch.
- Refresh
  patches.suse/ice-clear-stale-Tx-queue-settings-before-configuring.patch.
  Fix bug introduced by broken backport (bsc#1208628).
- commit d902e3e</changelog>
  <changelog author="msuchanek@suse.de" date="1678104015">- selftests/ftrace: Convert tracer tests to use 'requires'
  to specify program dependency (bsc#1204993 ltc#200103).
- selftests/ftrace: Add check for ping command for trigger tests
  (bsc#1204993 ltc#200103).
- commit 11e08ba</changelog>
  <changelog author="tonyj@suse.de" date="1678104016">- selftests/powerpc: Account for offline cpus in perf-hwbreak test
  (bsc#1206232).
- selftests/powerpc: Bump up rlimit for perf-hwbreak test
  (bsc#1206232).
- selftests/powerpc: Move perror closer to its use (bsc#1206232).
- commit cc3db6d</changelog>
  <changelog author="mkubecek@suse.cz" date="1678190400">- net/ulp: use consistent error code when blocking ULP
  (CVE-2023-0461 bsc#1208787).
- net/ulp: prevent ULP without clone op from entering the LISTEN
  status (CVE-2023-0461 bsc#1208787).
- commit bad820e</changelog>
</package>
<package pkgid="fa7587ff0f69a32a5665ebbe9666148b329788dcb41b8fe5e7c16118c64ab72e" name="kernel-default" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.24.49.3"/>
  <changelog author="jwiesner@suse.de" date="1677844800">- locking/rwsem: Disable preemption in all down_read*() and
  up_read() code paths (bsc#1207270).
- commit c4762ff</changelog>
  <changelog author="jwiesner@suse.de" date="1677844801">- locking/rwsem: Disable preemption in all down_write*() and
  up_write() code paths (bsc#1207270).
- commit 87b3e0b</changelog>
  <changelog author="neilb@suse.de" date="1678104000">- NFSv3: handle out-of-order write replies (bsc#1205544).
- commit 96398e7</changelog>
  <changelog author="neilb@suse.de" date="1678104001">- KABI fix for:  NFSv3: handle out-of-order write replies
  (bsc#1205544).
- commit 931f6bd</changelog>
  <changelog author="clin@suse.com" date="1678104002">- Refresh
  patches.suse/ipmi-ssif-Add-a-timer-between-request-retries.patch.
- Refresh patches.suse/ipmi-ssif-Remove-rtc_us_timer.patch.
- Refresh patches.suse/ipmi-ssif-resend_msg-cannot-fail.patch.
- Refresh
  patches.suse/ipmi_ssif-Rename-idle-state-and-check.patch.
- commit 39421c5</changelog>
  <changelog author="tiwai@suse.de" date="1678104003">- ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
  (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Odroid HC1 (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Odroid XU (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Exynos5250 (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Exynos4210 (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Exynos4 (git-fixes).
- ARM: dts: spear320-hmi: correct STMPE GPIO compatible
  (git-fixes).
- applicom: Fix PCI device refcount leak in applicom_init()
  (git-fixes).
- arm64: efi: Make efi_rt_lock a raw_spinlock (git-fixes).
- ASoC: mchp-spdifrx: disable all interrupts in
  mchp_spdifrx_dai_remove() (git-fixes).
- ASoC: mchp-spdifrx: fix controls which rely on rsr register
  (git-fixes).
- ASoC: soc-compress.c: fixup private_data on
  snd_soc_new_compress() (git-fixes).
- ALSA: hda/ca0132: minor fix for allocation size (git-fixes).
- ACPI: battery: Fix missing NUL-termination with large strings
  (git-fixes).
- ACPICA: nsrepair: handle cases without a return value correctly
  (git-fixes).
- ACPICA: Drop port I/O validation for some regions (git-fixes).
- ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for
  IOMMU node (git-fixes).
- arm64: dts: ti: k3-j7200: Fix wakeup pinmux range (git-fixes).
- arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
  (git-fixes).
- arm64: dts: mt8192: Fix CPU map for single-cluster SoC
  (git-fixes).
- arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock
  description (git-fixes).
- arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
  (git-fixes).
- arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan
  thermal trip (git-fixes).
- arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
  (git-fixes).
- arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit
  address (git-fixes).
- arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
  (git-fixes).
- arm64: dts: meson-gx: Fix Ethernet MAC address unit name
  (git-fixes).
- arm64: dts: imx8m: Align SoC unique ID node unit address
  (git-fixes).
- ARM: dts: imx7s: correct iomuxc gpr mux controller cells
  (git-fixes).
- ARM: dts: exynos: correct HDMI phy compatible in Exynos4
  (git-fixes).
- ARM: dts: exynos: correct wr-active property in Exynos3250
  Rinato (git-fixes).
- ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
  (git-fixes).
- arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
  (git-fixes).
- arm64: dts: qcom: ipq8074: fix Gen3 PCIe node (git-fixes).
- arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges (git-fixes).
- arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output
  names (git-fixes).
- arm64: dts: qcom: sc7280: correct SPMI bus address cells
  (git-fixes).
- arm64: dts: qcom: sc7180: correct SPMI bus address cells
  (git-fixes).
- arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt
  pin name (git-fixes).
- arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k
  instead of 4k (git-fixes).
- arm64: dts: qcom: qcs404: use symbol names for PCIe resets
  (git-fixes).
- ARM: bcm2835_defconfig: Enable the framebuffer (git-fixes).
- ARM: zynq: Fix refcount leak in zynq_early_slcr_init
  (git-fixes).
- ARM: imx: Call ida_simple_remove() for ida_simple_get
  (git-fixes).
- ARM: s3c: fix s3c64xx_set_timer_source prototype (git-fixes).
- ARM: OMAP1: call platform_device_put() in error case in
  omap1_dm_timer_init() (git-fixes).
- ARM: OMAP2+: Fix memory leak in realtime_counter_init()
  (git-fixes).
- ALSA: hda/realtek - fixed wrong gpio assigned (git-fixes).
- ALSA: hda/conexant: add a new hda codec SN6180 (git-fixes).
- ACPI: NFIT: fix a potential deadlock during NFIT teardown
  (git-fixes).
- ARM: dts: rockchip: add power-domains property to dp node on
  rk3288 (git-fixes).
- arm64: dts: rockchip: drop unused LED mode property from
  rk3328-roc-cc (git-fixes).
- ASoC: rt715-sdca: fix clock stop prepare timeout issue
  (git-fixes).
- ASoC: cs42l56: fix DT probe (git-fixes).
- ASoC: Intel: sof_cs42l42: always set dpcm_capture for amplifiers
  (git-fixes).
- ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers
  (git-fixes).
- ALSA: hda: Do not unset preset when cleaning up codec
  (git-fixes).
- ACPI / x86: Add support for LPS0 callback handler (git-fixes).
- commit b514cae</changelog>
  <changelog author="tiwai@suse.de" date="1678104004">- auxdisplay: hd44780: Fix potential memory leak in
  hd44780_remove() (git-fixes).
- Documentation: simplify and clarify DCO contribution example
  language (git-fixes).
- clk: qcom: gcc-qcs404: fix names of the DSI clocks used as
  parents (git-fixes).
- clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents
  (git-fixes).
- clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
  (git-fixes).
- clk: imx: avoid memory leak (git-fixes).
- clk: renesas: cpg-mssr: Remove superfluous check in resume code
  (git-fixes).
- clk: renesas: cpg-mssr: Fix use after free if
  cpg_mssr_common_init() failed (git-fixes).
- clk: ralink: fix 'mt7621_gate_is_enabled()' function
  (git-fixes).
- dmaengine: ptdma: check for null desc before calling
  pt_cmd_callback (git-fixes).
- dmaengine: dw-axi-dmac: Do not dereference NULL structure
  (git-fixes).
- dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
  (git-fixes).
- dmaengine: dw-edma: Fix readq_ch() return value truncation
  (git-fixes).
- dmaengine: dw-edma: Drop chancnt initialization (git-fixes).
- dmaengine: dw-edma: Fix invalid interleaved xfers semantics
  (git-fixes).
- dmaengine: dw-edma: Don't permit non-inc interleaved xfers
  (git-fixes).
- dmaengine: dw-edma: Fix missing src/dst address of interleaved
  xfers (git-fixes).
- driver core: fw_devlink: Add DL_FLAG_CYCLE support to device
  links (git-fixes).
- drivers: base: transport_class: fix resource leak when
  transport_add_device() fails (git-fixes).
- drivers: base: transport_class: fix possible memory leak
  (git-fixes).
- driver core: fix resource leak in device_add() (git-fixes).
- driver core: fix potential null-ptr-deref in device_add()
  (git-fixes).
- comedi: use menuconfig for main Comedi menu (git-fixes).
- Revert "char: pcmcia: cm4000_cs: Replace mdelay with
  usleep_range in set_protocol" (git-fixes).
- backlight: backlight: Fix doc for backlight_device_get_by_name
  (git-fixes).
- docs: gdbmacros: print newest record (git-fixes).
- drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
  (git-fixes).
- drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
  (git-fixes).
- drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
  (git-fixes).
- audit: update the mailing list in MAINTAINERS (git-fixes).
- docs: ftrace: fix a issue with duplicated subtitle number
  (git-fixes).
- ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not
  declared (git-fixes).
- ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
  (git-fixes).
- ASoC: dt-bindings: meson: fix gx-card codec node regex
  (git-fixes).
- ASoC: rsnd: Remove unnecessary rsnd_dbg_dai_call() (git-fixes).
- ASoC: rsnd: fixup #endif position (git-fixes).
- Bluetooth: hci_qca: get wakeup status from serdev device handle
  (git-fixes).
- Bluetooth: L2CAP: Fix potential user-after-free (git-fixes).
- crypto: crypto4xx - Call dma_unmap_page when done (git-fixes).
- crypto: rsa-pkcs1pad - Use akcipher_request_complete
  (git-fixes).
- crypto: qat - fix out-of-bounds read (git-fixes).
- Revert "crypto: rsa-pkcs1pad - Replace GFP_ATOMIC with
  GFP_KERNEL in pkcs1pad_encrypt_sign_complete" (git-fixes).
- crypto: xts - Handle EBUSY correctly (git-fixes).
- crypto: seqiv - Handle EBUSY correctly (git-fixes).
- crypto: essiv - Handle EBUSY correctly (git-fixes).
- crypto: ccp - Failure on re-initialization due to duplicate
  sysfs filename (git-fixes).
- crypto: ccp - Avoid page allocation failure warning for
  SEV_GET_ID2 (git-fixes).
- crypto: x86/ghash - fix unaligned access in ghash_setkey()
  (git-fixes).
- drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list
  (git-fixes).
- drm/amd/display: Properly handle additional cases where DCN
  is not supported (git-fixes).
- drm/nouveau/devinit/tu102-: wait for GFW_BOOT_PROGRESS ==
  COMPLETED (git-fixes).
- clk: mxl: syscon_node_to_regmap() returns error pointers
  (git-fixes).
- clk: mxl: Fix a clk entry by adding relevant flags (git-fixes).
- clk: mxl: Add option to override gate clks (git-fixes).
- clk: mxl: Remove redundant spinlocks (git-fixes).
- clk: mxl: Switch from direct readl/writel based IO to regmap
  based IO (git-fixes).
- drm/i915/gen11: Moving WAs to icl_gt_workarounds_init()
  (git-fixes).
- commit d5e5686</changelog>
  <changelog author="tiwai@suse.de" date="1678104005">- drm/i915: Don't use BAR mappings for ring buffers with LLC
  (git-fixes).
- dt-bindings: hwlock: sun6i: Add missing #hwlock-cells
  (git-fixes).
- dt-bindings: input: iqs626a: Redefine trackpad property types
  (git-fixes).
- dt-bindings: power: supply: pm8941-coincell: Don't require
  charging properties (git-fixes).
- firmware: coreboot: Remove GOOGLE_COREBOOT_TABLE_ACPI/OF
  Kconfig entries (git-fixes).
- firmware: dmi-sysfs: Fix null-ptr-deref in
  dmi_sysfs_register_handle (git-fixes).
- firmware: stratix10-svc: add missing gen_pool_destroy() in
  stratix10_svc_drv_probe() (git-fixes).
- eeprom: idt_89hpesx: Fix error handling in idt_init()
  (git-fixes).
- dt-bindings: usb: amlogic,meson-g12a-usb-ctrl: make G12A
  usb3-phy0 optional (git-fixes).
- drm/amdgpu: fix enum odm_combine_mode mismatch (git-fixes).
- drm/amd/display: reduce else-if to else in
  dcn10_blank_pixel_data() (git-fixes).
- drm/msm/dpu: set pdpu-&gt;is_rt_pipe early in
  dpu_plane_sspp_atomic_update() (git-fixes).
- drm/msm/mdp5: Add check for kzalloc (git-fixes).
- drm/msm/dpu: Add check for pstates (git-fixes).
- drm/msm/dpu: Add check for cstate (git-fixes).
- drm/msm/dpu: drop stale comment from struct dpu_mdp_cfg doc
  (git-fixes).
- drm/msm: use strscpy instead of strncpy (git-fixes).
- drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
  (git-fixes).
- dt-bindings: msm: dsi-controller-main: Add vdd* descriptions
  back in (git-fixes).
- drm/msm/dpu: Disallow unallocated resources to be returned
  (git-fixes).
- drm/msm/gem: Add check for kmalloc (git-fixes).
- drm/msm: clean event_thread-&gt;worker in case of an error
  (git-fixes).
- drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
  (git-fixes).
- drm/mediatek: Clean dangling pointer on bind error path
  (git-fixes).
- drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
  (git-fixes).
- drm/mediatek: Drop unbalanced obj unref (git-fixes).
- drm/mediatek: Use NULL instead of 0 for NULL pointer
  (git-fixes).
- drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending
  cmd (git-fixes).
- drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
  (git-fixes).
- drm/bridge: lt9611: pass a pointer to the of node (git-fixes).
- drm/bridge: lt9611: fix clock calculation (git-fixes).
- drm/bridge: lt9611: fix programming of video modes (git-fixes).
- drm/bridge: lt9611: fix polarity programming (git-fixes).
- drm/bridge: lt9611: fix HPD reenablement (git-fixes).
- drm/bridge: lt9611: fix sleep mode setup (git-fixes).
- drm/vc4: hdmi: Correct interlaced timings again (git-fixes).
- drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 (git-fixes).
- drm/vc4: hvs: Set AXI panic modes (git-fixes).
- drm/omapdrm: Remove unused struct csc_coef_rgb2yuv (git-fixes).
- drm: tidss: Fix pixel format definition (git-fixes).
- drm/bridge: lt8912b: Add hot plug detection (git-fixes).
- drm/vkms: Fix null-ptr-deref in vkms_release() (git-fixes).
- drm/vkms: Fix memory leak in vkms_init() (git-fixes).
- drm/bridge: megachips: Fix error handling in
  i2c_register_driver() (git-fixes).
- drm/vc4: vec: Use pm_runtime_resume_and_get() in
  vc4_vec_encoder_enable() (git-fixes).
- gpio: vf610: connect GPIO label to dev name (git-fixes).
- dt-bindings: net: snps,dwmac: Fix snps,reset-delays-us
  dependency (git-fixes).
- dt-bindings: arm: fsl: Fix bindings for APF28Dev board
  (git-fixes).
- commit 3467b1b</changelog>
  <changelog author="tiwai@suse.de" date="1678104006">- media: saa7134: Use video_unregister_device for radio_dev
  (git-fixes).
- media: usb: siano: Fix use after free bugs caused by
  do_submit_urb (git-fixes).
- media: i2c: ov7670: 0 instead of -EINVAL was returned
  (git-fixes).
- media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
  (git-fixes).
- media: v4l2-jpeg: ignore the unknown APP14 marker (git-fixes).
- media: v4l2-jpeg: correct the skip count in
  jpeg_parse_app14_data (git-fixes).
- media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
  (git-fixes).
- media: i2c: ov772x: Fix memleak in ov772x_probe() (git-fixes).
- media: ov5675: Fix memleak in ov5675_init_controls()
  (git-fixes).
- media: ov2740: Fix memleak in ov2740_init_controls()
  (git-fixes).
- media: max9286: Fix memleak in max9286_v4l2_register()
  (git-fixes).
- Input: iqs626a - drop unused device node references (git-fixes).
- Input: ads7846 - don't check penirq immediately for 7845
  (git-fixes).
- Input: ads7846 - always set last command to PWRDOWN (git-fixes).
- Input: ads7846 - don't report pressure for ads7845 (git-fixes).
- Input: iqs269a - configure device with a single block write
  (git-fixes).
- Input: iqs269a - increase interrupt handler return delay
  (git-fixes).
- Input: iqs269a - drop unused device node references (git-fixes).
- i2c: designware: fix i2c_dw_clk_rate() return size to be u32
  (git-fixes).
- iio: light: tsl2563: Do not hardcode interrupt trigger type
  (git-fixes).
- misc/mei/hdcp: Use correct macros to initialize uuid_le
  (git-fixes).
- misc: enclosure: Fix doc for enclosure_find() (git-fixes).
- lib/zlib: remove redundation assignement of avail_in
  dfltcc_gdht() (git-fixes).
- leds: led-core: Fix refcount leak in of_led_get() (git-fixes).
- mfd: pcf50633-adc: Fix potential memleak in
  pcf50633_adc_async_read() (git-fixes).
- mfd: cs5535: Don't build on UML (git-fixes).
- gpu: host1x: Don't skip assigning syncpoints to channels
  (git-fixes).
- gpu: ipu-v3: common: Add of_node_put() for reference returned
  by of_graph_get_port_by_id() (git-fixes).
- hwmon: (mlxreg-fan) Return zero speed for broken fan
  (git-fixes).
- hwmon: (ltc2945) Handle error case in ltc2945_value_store
  (git-fixes).
- hwmon: (ftsteutates) Fix scaling of measurements (git-fixes).
- Revert "HID: logitech-hidpp: add a module parameter to keep
  firmware gestures" (git-fixes).
- hid: bigben_probe(): validate report count (git-fixes).
- HID: bigben: use spinlock to safely schedule workers
  (git-fixes).
- HID: bigben_worker() remove unneeded check on report_field
  (git-fixes).
- HID: bigben: use spinlock to protect concurrent accesses
  (git-fixes).
- HID: asus: use spinlock to safely schedule workers (git-fixes).
- HID: asus: use spinlock to protect concurrent accesses
  (git-fixes).
- gpio: tegra186: remove unneeded loop in
  tegra186_gpio_init_route_mapping() (git-fixes).
- lib/mpi: Fix buffer overrun when SG is too long (git-fixes).
- leds: led-class: Add missing put_device() to led_put()
  (git-fixes).
- mmc: jz4740: Work around bug on JZ4760(B) (git-fixes).
- mmc: mmc_spi: fix error handling in mmc_spi_probe() (git-fixes).
- mmc: sdio: fix possible resource leaks in some error paths
  (git-fixes).
- HID: core: Fix deadloop in hid_apply_multiplier (git-fixes).
- HID: elecom: add support for TrackBall 056E:011C (git-fixes).
- staging: mt7621-dts: change palmbus address to lower case
  (git-fixes).
- commit ed4a4d9</changelog>
  <changelog author="tiwai@suse.de" date="1678104007">- thermal: intel: BXT_PMIC: select REGMAP instead of depending
  on it (git-fixes).
- thermal: intel: quark_dts: fix error pointer dereference
  (git-fixes).
- rtc: allow rtc_read_alarm without read_alarm callback
  (git-fixes).
- rtc: pm8xxx: fix set-alarm race (git-fixes).
- rtc: sun6i: Always export the internal oscillator (git-fixes).
- spi: tegra210-quad: Fix validate combined sequence (git-fixes).
- nfc: fix memory leak of se_io context in nfc_genl_se_io
  (git-fixes).
- remoteproc: qcom_q6v5_mss: Use a carveout to authenticate
  modem headers (git-fixes).
- remoteproc/mtk_scp: Move clk ops outside send_lock (git-fixes).
- mtd: rawnand: fsl_elbc: Propagate HW ECC settings to HW
  (git-fixes).
- mtd: rawnand: sunxi: Fix the size of the last OOB region
  (git-fixes).
- mtd: rawnand: sunxi: Clean up chips after failed init
  (git-fixes).
- mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
  (git-fixes).
- mtd: spi-nor: spansion: Consider reserved bits in CFR5 register
  (git-fixes).
- mtd: spi-nor: core: fix implicit declaration warning
  (git-fixes).
- mtd: spi-nor: sfdp: Fix index value for SCCR dwords (git-fixes).
- mtd: dataflash: remove duplicate SPI ID table (git-fixes).
- soundwire: cadence: Don't overflow the command FIFOs
  (git-fixes).
- phy: rockchip-typec: fix tcphy_get_mode error case (git-fixes).
- PCI: switchtec: Return -EFAULT for copy_to_user() errors
  (git-fixes).
- PCI: Fix dropping valid root bus resources with .end = zero
  (git-fixes).
- PCI/PM: Observe reset delay irrespective of bridge_d3
  (git-fixes).
- PCI/IOV: Enlarge virtfn sysfs name buffer (git-fixes).
- PCI: hotplug: Allow marking devices as disconnected during
  bind/unbind (git-fixes).
- serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
  (git-fixes).
- serial: tegra: Add missing clk_disable_unprepare() in
  tegra_uart_hw_init() (git-fixes).
- tty: serial: fsl_lpuart: disable Rx/Tx DMA in
  lpuart32_shutdown() (git-fixes).
- printf: fix errname.c list (git-fixes).
- pinctrl: mediatek: Initialize variable *buf to zero (git-fixes).
- pinctrl: rockchip: Fix refcount leak in
  rockchip_pinctrl_parse_groups (git-fixes).
- pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
  (git-fixes).
- pinctrl: qcom: pinctrl-msm8976: Correct function names for
  wcss pins (git-fixes).
- spi: synquacer: Fix timeout handling in
  synquacer_spi_transfer_one() (git-fixes).
- spi: bcm63xx-hsspi: Endianness fix for ARM based SoC
  (git-fixes).
- sefltests: netdevsim: wait for devlink instance after netns
  removal (git-fixes).
- thermal/drivers/hisi: Drop second sensor hi3660 (git-fixes).
- thermal: intel: powerclamp: Fix cur_state for multi package
  system (git-fixes).
- thermal/drivers/tsens: limit num_sensors to 9 for msm8939
  (git-fixes).
- thermal/drivers/tsens: fix slope values for msm8939 (git-fixes).
- thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
  (git-fixes).
- thermal/drivers/tsens: Drop msm8976-specific defines
  (git-fixes).
- net/rose: Fix to not accept on connected socket (git-fixes).
- platform/x86: touchscreen_dmi: Add Chuwi Vi8 (CWI501) DMI match
  (git-fixes).
- platform/x86: amd-pmc: Correct usage of SMU version (git-fixes).
- selftest/lkdtm: Skip stack-entropy test if lkdtm is not
  available (git-fixes).
- platform/x86: amd-pmc: Fix compilation when CONFIG_DEBUGFS is
  disabled (git-fixes).
- platform/x86: amd-pmc: Export Idlemask values based on the APU
  (git-fixes).
- commit 14a6c6a</changelog>
  <changelog author="tiwai@suse.de" date="1678104008">- ALSA: ice1712: Delete unreachable code in aureon_add_controls()
  (git-fixes).
- ALSA: ice1712: Do not left ice-&gt;gpio_mutex locked in
  aureon_add_controls() (git-fixes).
- ASoC: adau7118: don't disable regulators on device unbind
  (git-fixes).
- watchdog: sbsa_wdog: Make sure the timeout programming is
  within the limits (git-fixes).
- watchdog: pcwd_usb: Fix attempting to access uninitialized
  memory (git-fixes).
- watchdog: Fix kmemleak in watchdog_cdev_register (git-fixes).
- watchdog: at91sam9_wdt: use devm_request_irq to avoid missing
  free_irq() in error path (git-fixes).
- vc_screen: don't clobber return value in vcs_read (git-fixes).
- vc_screen: modify vcs_size() handling in vcs_read() (git-fixes).
- wifi: ath11k: allow system suspend to survive ath11k
  (git-fixes).
- vdpa_sim: not reset state in vdpasim_queue_ready (git-fixes).
- VMCI: check context-&gt;notify_page after call to
  get_user_pages_fast() to avoid GPF (git-fixes).
- tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx
  dma case (git-fixes).
- tty: serial: qcom-geni-serial: stop operations in progress at
  shutdown (git-fixes).
- tty: serial: fsl_lpuart: clear LPUART Status Register in
  lpuart32_shutdown() (git-fixes).
- USB: serial: option: add support for VW/Skoda "Carstick LTE"
  (git-fixes).
- usb: dwc3: pci: add support for the Intel Meteor Lake-M
  (git-fixes).
- usb: max-3421: Fix setting of I/O pins (git-fixes).
- usb: musb: mediatek: don't unregister something that wasn't
  registered (git-fixes).
- USB: core: Don't hold device lock while reading the
  "descriptors" sysfs file (git-fixes).
- usb: early: xhci-dbc: Fix a potential out-of-bound memory access
  (git-fixes).
- usb: gadget: fusb300_udc: free irq on the error path in
  fusb300_probe() (git-fixes).
- wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
  (git-fixes).
- wifi: cfg80211: Fix use after free for wext (git-fixes).
- wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
  (git-fixes).
- wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there
  is no callback function (git-fixes).
- wifi: mwifiex: fix loop iterator in
  mwifiex_update_ampdu_txwinsize() (git-fixes).
- wifi: mwifiex: Add missing compatible string for SD8787
  (git-fixes).
- wifi: iwl4965: Add missing check for
  create_singlethread_workqueue() (git-fixes).
- wifi: iwl3945: Add missing check for
  create_singlethread_workqueue (git-fixes).
- wifi: cfg80211: Fix extended KCK key length check in
  nl80211_set_rekey_data() (git-fixes).
- wifi: orinoco: check return value of hermes_write_wordrec()
  (git-fixes).
- wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
  (git-fixes).
- wifi: rtw89: Add missing check for alloc_workqueue (git-fixes).
- wifi: wl3501_cs: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas: cmdresp: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas: main: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas: if_usb: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas_tf: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
  (git-fixes).
- wifi: brcmfmac: fix potential memory leak in
  brcmf_netdev_start_xmit() (git-fixes).
- wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
  (git-fixes).
- wifi: ipw2200: fix memory leak in ipw_wdev_init() (git-fixes).
- wifi: ipw2x00: don't call dev_kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rtlwifi: Fix global-out-of-bounds bug in
  _rtl8812ae_phy_set_txpower_limit() (git-fixes).
- wifi: rtl8xxxu: don't call dev_kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas: fix memory leak in lbs_init_adapter()
  (git-fixes).
- wifi: iwlegacy: common: don't call dev_kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rtlwifi: rtl8723be: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rsi: Fix memory leak in rsi_coex_attach() (git-fixes).
- commit 795b424</changelog>
  <changelog author="tiwai@suse.de" date="1678104009">- ASoC: mchp-spdifrx: Fix uninitialized use of mr in
  mchp_spdifrx_hw_params() (git-fixes).
- commit ef46bcf</changelog>
  <changelog author="ohering@suse.de" date="1678104010">- hv_netvsc: Check status in SEND_RNDIS_PKT completion message
  (git-fixes).
- commit cf78232</changelog>
  <changelog author="dwagner@suse.de" date="1678104011">- nvme-fabrics: show well known discovery name (bsc#1200054).
- commit 0dc6ff3</changelog>
  <changelog author="jack@suse.cz" date="1678104012">- ocfs2: Fix data corruption after failed write (bsc#1208542).
- commit 92f0180</changelog>
  <changelog author="tiwai@suse.de" date="1678104013">- Move upstreamed i915 and media fixes into sorted section
- commit f79acc7</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1678104014">- Refresh
  patches.suse/ice-Do-not-skip-not-enabled-queues-in-ice_vc_dis_qs_.patch.
- Refresh
  patches.suse/ice-clear-stale-Tx-queue-settings-before-configuring.patch.
  Fix bug introduced by broken backport (bsc#1208628).
- commit d902e3e</changelog>
  <changelog author="msuchanek@suse.de" date="1678104015">- selftests/ftrace: Convert tracer tests to use 'requires'
  to specify program dependency (bsc#1204993 ltc#200103).
- selftests/ftrace: Add check for ping command for trigger tests
  (bsc#1204993 ltc#200103).
- commit 11e08ba</changelog>
  <changelog author="tonyj@suse.de" date="1678104016">- selftests/powerpc: Account for offline cpus in perf-hwbreak test
  (bsc#1206232).
- selftests/powerpc: Bump up rlimit for perf-hwbreak test
  (bsc#1206232).
- selftests/powerpc: Move perror closer to its use (bsc#1206232).
- commit cc3db6d</changelog>
  <changelog author="mkubecek@suse.cz" date="1678190400">- net/ulp: use consistent error code when blocking ULP
  (CVE-2023-0461 bsc#1208787).
- net/ulp: prevent ULP without clone op from entering the LISTEN
  status (CVE-2023-0461 bsc#1208787).
- commit bad820e</changelog>
</package>
<package pkgid="e15cb32708c6c2b33192d4aca5a075b6f0d98d4e537d4b281aa7c6d5e999f023" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.24.49.3"/>
  <changelog author="jwiesner@suse.de" date="1677844800">- locking/rwsem: Disable preemption in all down_read*() and
  up_read() code paths (bsc#1207270).
- commit c4762ff</changelog>
  <changelog author="jwiesner@suse.de" date="1677844801">- locking/rwsem: Disable preemption in all down_write*() and
  up_write() code paths (bsc#1207270).
- commit 87b3e0b</changelog>
  <changelog author="neilb@suse.de" date="1678104000">- NFSv3: handle out-of-order write replies (bsc#1205544).
- commit 96398e7</changelog>
  <changelog author="neilb@suse.de" date="1678104001">- KABI fix for:  NFSv3: handle out-of-order write replies
  (bsc#1205544).
- commit 931f6bd</changelog>
  <changelog author="clin@suse.com" date="1678104002">- Refresh
  patches.suse/ipmi-ssif-Add-a-timer-between-request-retries.patch.
- Refresh patches.suse/ipmi-ssif-Remove-rtc_us_timer.patch.
- Refresh patches.suse/ipmi-ssif-resend_msg-cannot-fail.patch.
- Refresh
  patches.suse/ipmi_ssif-Rename-idle-state-and-check.patch.
- commit 39421c5</changelog>
  <changelog author="tiwai@suse.de" date="1678104003">- ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
  (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Odroid HC1 (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Odroid XU (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Exynos5250 (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Exynos4210 (git-fixes).
- ARM: dts: exynos: correct TMU phandle in Exynos4 (git-fixes).
- ARM: dts: spear320-hmi: correct STMPE GPIO compatible
  (git-fixes).
- applicom: Fix PCI device refcount leak in applicom_init()
  (git-fixes).
- arm64: efi: Make efi_rt_lock a raw_spinlock (git-fixes).
- ASoC: mchp-spdifrx: disable all interrupts in
  mchp_spdifrx_dai_remove() (git-fixes).
- ASoC: mchp-spdifrx: fix controls which rely on rsr register
  (git-fixes).
- ASoC: soc-compress.c: fixup private_data on
  snd_soc_new_compress() (git-fixes).
- ALSA: hda/ca0132: minor fix for allocation size (git-fixes).
- ACPI: battery: Fix missing NUL-termination with large strings
  (git-fixes).
- ACPICA: nsrepair: handle cases without a return value correctly
  (git-fixes).
- ACPICA: Drop port I/O validation for some regions (git-fixes).
- ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for
  IOMMU node (git-fixes).
- arm64: dts: ti: k3-j7200: Fix wakeup pinmux range (git-fixes).
- arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
  (git-fixes).
- arm64: dts: mt8192: Fix CPU map for single-cluster SoC
  (git-fixes).
- arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock
  description (git-fixes).
- arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
  (git-fixes).
- arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan
  thermal trip (git-fixes).
- arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
  (git-fixes).
- arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit
  address (git-fixes).
- arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
  (git-fixes).
- arm64: dts: meson-gx: Fix Ethernet MAC address unit name
  (git-fixes).
- arm64: dts: imx8m: Align SoC unique ID node unit address
  (git-fixes).
- ARM: dts: imx7s: correct iomuxc gpr mux controller cells
  (git-fixes).
- ARM: dts: exynos: correct HDMI phy compatible in Exynos4
  (git-fixes).
- ARM: dts: exynos: correct wr-active property in Exynos3250
  Rinato (git-fixes).
- ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
  (git-fixes).
- arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
  (git-fixes).
- arm64: dts: qcom: ipq8074: fix Gen3 PCIe node (git-fixes).
- arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges (git-fixes).
- arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output
  names (git-fixes).
- arm64: dts: qcom: sc7280: correct SPMI bus address cells
  (git-fixes).
- arm64: dts: qcom: sc7180: correct SPMI bus address cells
  (git-fixes).
- arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt
  pin name (git-fixes).
- arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k
  instead of 4k (git-fixes).
- arm64: dts: qcom: qcs404: use symbol names for PCIe resets
  (git-fixes).
- ARM: bcm2835_defconfig: Enable the framebuffer (git-fixes).
- ARM: zynq: Fix refcount leak in zynq_early_slcr_init
  (git-fixes).
- ARM: imx: Call ida_simple_remove() for ida_simple_get
  (git-fixes).
- ARM: s3c: fix s3c64xx_set_timer_source prototype (git-fixes).
- ARM: OMAP1: call platform_device_put() in error case in
  omap1_dm_timer_init() (git-fixes).
- ARM: OMAP2+: Fix memory leak in realtime_counter_init()
  (git-fixes).
- ALSA: hda/realtek - fixed wrong gpio assigned (git-fixes).
- ALSA: hda/conexant: add a new hda codec SN6180 (git-fixes).
- ACPI: NFIT: fix a potential deadlock during NFIT teardown
  (git-fixes).
- ARM: dts: rockchip: add power-domains property to dp node on
  rk3288 (git-fixes).
- arm64: dts: rockchip: drop unused LED mode property from
  rk3328-roc-cc (git-fixes).
- ASoC: rt715-sdca: fix clock stop prepare timeout issue
  (git-fixes).
- ASoC: cs42l56: fix DT probe (git-fixes).
- ASoC: Intel: sof_cs42l42: always set dpcm_capture for amplifiers
  (git-fixes).
- ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers
  (git-fixes).
- ALSA: hda: Do not unset preset when cleaning up codec
  (git-fixes).
- ACPI / x86: Add support for LPS0 callback handler (git-fixes).
- commit b514cae</changelog>
  <changelog author="tiwai@suse.de" date="1678104004">- auxdisplay: hd44780: Fix potential memory leak in
  hd44780_remove() (git-fixes).
- Documentation: simplify and clarify DCO contribution example
  language (git-fixes).
- clk: qcom: gcc-qcs404: fix names of the DSI clocks used as
  parents (git-fixes).
- clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents
  (git-fixes).
- clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
  (git-fixes).
- clk: imx: avoid memory leak (git-fixes).
- clk: renesas: cpg-mssr: Remove superfluous check in resume code
  (git-fixes).
- clk: renesas: cpg-mssr: Fix use after free if
  cpg_mssr_common_init() failed (git-fixes).
- clk: ralink: fix 'mt7621_gate_is_enabled()' function
  (git-fixes).
- dmaengine: ptdma: check for null desc before calling
  pt_cmd_callback (git-fixes).
- dmaengine: dw-axi-dmac: Do not dereference NULL structure
  (git-fixes).
- dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
  (git-fixes).
- dmaengine: dw-edma: Fix readq_ch() return value truncation
  (git-fixes).
- dmaengine: dw-edma: Drop chancnt initialization (git-fixes).
- dmaengine: dw-edma: Fix invalid interleaved xfers semantics
  (git-fixes).
- dmaengine: dw-edma: Don't permit non-inc interleaved xfers
  (git-fixes).
- dmaengine: dw-edma: Fix missing src/dst address of interleaved
  xfers (git-fixes).
- driver core: fw_devlink: Add DL_FLAG_CYCLE support to device
  links (git-fixes).
- drivers: base: transport_class: fix resource leak when
  transport_add_device() fails (git-fixes).
- drivers: base: transport_class: fix possible memory leak
  (git-fixes).
- driver core: fix resource leak in device_add() (git-fixes).
- driver core: fix potential null-ptr-deref in device_add()
  (git-fixes).
- comedi: use menuconfig for main Comedi menu (git-fixes).
- Revert "char: pcmcia: cm4000_cs: Replace mdelay with
  usleep_range in set_protocol" (git-fixes).
- backlight: backlight: Fix doc for backlight_device_get_by_name
  (git-fixes).
- docs: gdbmacros: print newest record (git-fixes).
- drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
  (git-fixes).
- drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
  (git-fixes).
- drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
  (git-fixes).
- audit: update the mailing list in MAINTAINERS (git-fixes).
- docs: ftrace: fix a issue with duplicated subtitle number
  (git-fixes).
- ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not
  declared (git-fixes).
- ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
  (git-fixes).
- ASoC: dt-bindings: meson: fix gx-card codec node regex
  (git-fixes).
- ASoC: rsnd: Remove unnecessary rsnd_dbg_dai_call() (git-fixes).
- ASoC: rsnd: fixup #endif position (git-fixes).
- Bluetooth: hci_qca: get wakeup status from serdev device handle
  (git-fixes).
- Bluetooth: L2CAP: Fix potential user-after-free (git-fixes).
- crypto: crypto4xx - Call dma_unmap_page when done (git-fixes).
- crypto: rsa-pkcs1pad - Use akcipher_request_complete
  (git-fixes).
- crypto: qat - fix out-of-bounds read (git-fixes).
- Revert "crypto: rsa-pkcs1pad - Replace GFP_ATOMIC with
  GFP_KERNEL in pkcs1pad_encrypt_sign_complete" (git-fixes).
- crypto: xts - Handle EBUSY correctly (git-fixes).
- crypto: seqiv - Handle EBUSY correctly (git-fixes).
- crypto: essiv - Handle EBUSY correctly (git-fixes).
- crypto: ccp - Failure on re-initialization due to duplicate
  sysfs filename (git-fixes).
- crypto: ccp - Avoid page allocation failure warning for
  SEV_GET_ID2 (git-fixes).
- crypto: x86/ghash - fix unaligned access in ghash_setkey()
  (git-fixes).
- drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list
  (git-fixes).
- drm/amd/display: Properly handle additional cases where DCN
  is not supported (git-fixes).
- drm/nouveau/devinit/tu102-: wait for GFW_BOOT_PROGRESS ==
  COMPLETED (git-fixes).
- clk: mxl: syscon_node_to_regmap() returns error pointers
  (git-fixes).
- clk: mxl: Fix a clk entry by adding relevant flags (git-fixes).
- clk: mxl: Add option to override gate clks (git-fixes).
- clk: mxl: Remove redundant spinlocks (git-fixes).
- clk: mxl: Switch from direct readl/writel based IO to regmap
  based IO (git-fixes).
- drm/i915/gen11: Moving WAs to icl_gt_workarounds_init()
  (git-fixes).
- commit d5e5686</changelog>
  <changelog author="tiwai@suse.de" date="1678104005">- drm/i915: Don't use BAR mappings for ring buffers with LLC
  (git-fixes).
- dt-bindings: hwlock: sun6i: Add missing #hwlock-cells
  (git-fixes).
- dt-bindings: input: iqs626a: Redefine trackpad property types
  (git-fixes).
- dt-bindings: power: supply: pm8941-coincell: Don't require
  charging properties (git-fixes).
- firmware: coreboot: Remove GOOGLE_COREBOOT_TABLE_ACPI/OF
  Kconfig entries (git-fixes).
- firmware: dmi-sysfs: Fix null-ptr-deref in
  dmi_sysfs_register_handle (git-fixes).
- firmware: stratix10-svc: add missing gen_pool_destroy() in
  stratix10_svc_drv_probe() (git-fixes).
- eeprom: idt_89hpesx: Fix error handling in idt_init()
  (git-fixes).
- dt-bindings: usb: amlogic,meson-g12a-usb-ctrl: make G12A
  usb3-phy0 optional (git-fixes).
- drm/amdgpu: fix enum odm_combine_mode mismatch (git-fixes).
- drm/amd/display: reduce else-if to else in
  dcn10_blank_pixel_data() (git-fixes).
- drm/msm/dpu: set pdpu-&gt;is_rt_pipe early in
  dpu_plane_sspp_atomic_update() (git-fixes).
- drm/msm/mdp5: Add check for kzalloc (git-fixes).
- drm/msm/dpu: Add check for pstates (git-fixes).
- drm/msm/dpu: Add check for cstate (git-fixes).
- drm/msm/dpu: drop stale comment from struct dpu_mdp_cfg doc
  (git-fixes).
- drm/msm: use strscpy instead of strncpy (git-fixes).
- drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
  (git-fixes).
- dt-bindings: msm: dsi-controller-main: Add vdd* descriptions
  back in (git-fixes).
- drm/msm/dpu: Disallow unallocated resources to be returned
  (git-fixes).
- drm/msm/gem: Add check for kmalloc (git-fixes).
- drm/msm: clean event_thread-&gt;worker in case of an error
  (git-fixes).
- drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
  (git-fixes).
- drm/mediatek: Clean dangling pointer on bind error path
  (git-fixes).
- drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
  (git-fixes).
- drm/mediatek: Drop unbalanced obj unref (git-fixes).
- drm/mediatek: Use NULL instead of 0 for NULL pointer
  (git-fixes).
- drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending
  cmd (git-fixes).
- drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
  (git-fixes).
- drm/bridge: lt9611: pass a pointer to the of node (git-fixes).
- drm/bridge: lt9611: fix clock calculation (git-fixes).
- drm/bridge: lt9611: fix programming of video modes (git-fixes).
- drm/bridge: lt9611: fix polarity programming (git-fixes).
- drm/bridge: lt9611: fix HPD reenablement (git-fixes).
- drm/bridge: lt9611: fix sleep mode setup (git-fixes).
- drm/vc4: hdmi: Correct interlaced timings again (git-fixes).
- drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 (git-fixes).
- drm/vc4: hvs: Set AXI panic modes (git-fixes).
- drm/omapdrm: Remove unused struct csc_coef_rgb2yuv (git-fixes).
- drm: tidss: Fix pixel format definition (git-fixes).
- drm/bridge: lt8912b: Add hot plug detection (git-fixes).
- drm/vkms: Fix null-ptr-deref in vkms_release() (git-fixes).
- drm/vkms: Fix memory leak in vkms_init() (git-fixes).
- drm/bridge: megachips: Fix error handling in
  i2c_register_driver() (git-fixes).
- drm/vc4: vec: Use pm_runtime_resume_and_get() in
  vc4_vec_encoder_enable() (git-fixes).
- gpio: vf610: connect GPIO label to dev name (git-fixes).
- dt-bindings: net: snps,dwmac: Fix snps,reset-delays-us
  dependency (git-fixes).
- dt-bindings: arm: fsl: Fix bindings for APF28Dev board
  (git-fixes).
- commit 3467b1b</changelog>
  <changelog author="tiwai@suse.de" date="1678104006">- media: saa7134: Use video_unregister_device for radio_dev
  (git-fixes).
- media: usb: siano: Fix use after free bugs caused by
  do_submit_urb (git-fixes).
- media: i2c: ov7670: 0 instead of -EINVAL was returned
  (git-fixes).
- media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
  (git-fixes).
- media: v4l2-jpeg: ignore the unknown APP14 marker (git-fixes).
- media: v4l2-jpeg: correct the skip count in
  jpeg_parse_app14_data (git-fixes).
- media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
  (git-fixes).
- media: i2c: ov772x: Fix memleak in ov772x_probe() (git-fixes).
- media: ov5675: Fix memleak in ov5675_init_controls()
  (git-fixes).
- media: ov2740: Fix memleak in ov2740_init_controls()
  (git-fixes).
- media: max9286: Fix memleak in max9286_v4l2_register()
  (git-fixes).
- Input: iqs626a - drop unused device node references (git-fixes).
- Input: ads7846 - don't check penirq immediately for 7845
  (git-fixes).
- Input: ads7846 - always set last command to PWRDOWN (git-fixes).
- Input: ads7846 - don't report pressure for ads7845 (git-fixes).
- Input: iqs269a - configure device with a single block write
  (git-fixes).
- Input: iqs269a - increase interrupt handler return delay
  (git-fixes).
- Input: iqs269a - drop unused device node references (git-fixes).
- i2c: designware: fix i2c_dw_clk_rate() return size to be u32
  (git-fixes).
- iio: light: tsl2563: Do not hardcode interrupt trigger type
  (git-fixes).
- misc/mei/hdcp: Use correct macros to initialize uuid_le
  (git-fixes).
- misc: enclosure: Fix doc for enclosure_find() (git-fixes).
- lib/zlib: remove redundation assignement of avail_in
  dfltcc_gdht() (git-fixes).
- leds: led-core: Fix refcount leak in of_led_get() (git-fixes).
- mfd: pcf50633-adc: Fix potential memleak in
  pcf50633_adc_async_read() (git-fixes).
- mfd: cs5535: Don't build on UML (git-fixes).
- gpu: host1x: Don't skip assigning syncpoints to channels
  (git-fixes).
- gpu: ipu-v3: common: Add of_node_put() for reference returned
  by of_graph_get_port_by_id() (git-fixes).
- hwmon: (mlxreg-fan) Return zero speed for broken fan
  (git-fixes).
- hwmon: (ltc2945) Handle error case in ltc2945_value_store
  (git-fixes).
- hwmon: (ftsteutates) Fix scaling of measurements (git-fixes).
- Revert "HID: logitech-hidpp: add a module parameter to keep
  firmware gestures" (git-fixes).
- hid: bigben_probe(): validate report count (git-fixes).
- HID: bigben: use spinlock to safely schedule workers
  (git-fixes).
- HID: bigben_worker() remove unneeded check on report_field
  (git-fixes).
- HID: bigben: use spinlock to protect concurrent accesses
  (git-fixes).
- HID: asus: use spinlock to safely schedule workers (git-fixes).
- HID: asus: use spinlock to protect concurrent accesses
  (git-fixes).
- gpio: tegra186: remove unneeded loop in
  tegra186_gpio_init_route_mapping() (git-fixes).
- lib/mpi: Fix buffer overrun when SG is too long (git-fixes).
- leds: led-class: Add missing put_device() to led_put()
  (git-fixes).
- mmc: jz4740: Work around bug on JZ4760(B) (git-fixes).
- mmc: mmc_spi: fix error handling in mmc_spi_probe() (git-fixes).
- mmc: sdio: fix possible resource leaks in some error paths
  (git-fixes).
- HID: core: Fix deadloop in hid_apply_multiplier (git-fixes).
- HID: elecom: add support for TrackBall 056E:011C (git-fixes).
- staging: mt7621-dts: change palmbus address to lower case
  (git-fixes).
- commit ed4a4d9</changelog>
  <changelog author="tiwai@suse.de" date="1678104007">- thermal: intel: BXT_PMIC: select REGMAP instead of depending
  on it (git-fixes).
- thermal: intel: quark_dts: fix error pointer dereference
  (git-fixes).
- rtc: allow rtc_read_alarm without read_alarm callback
  (git-fixes).
- rtc: pm8xxx: fix set-alarm race (git-fixes).
- rtc: sun6i: Always export the internal oscillator (git-fixes).
- spi: tegra210-quad: Fix validate combined sequence (git-fixes).
- nfc: fix memory leak of se_io context in nfc_genl_se_io
  (git-fixes).
- remoteproc: qcom_q6v5_mss: Use a carveout to authenticate
  modem headers (git-fixes).
- remoteproc/mtk_scp: Move clk ops outside send_lock (git-fixes).
- mtd: rawnand: fsl_elbc: Propagate HW ECC settings to HW
  (git-fixes).
- mtd: rawnand: sunxi: Fix the size of the last OOB region
  (git-fixes).
- mtd: rawnand: sunxi: Clean up chips after failed init
  (git-fixes).
- mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
  (git-fixes).
- mtd: spi-nor: spansion: Consider reserved bits in CFR5 register
  (git-fixes).
- mtd: spi-nor: core: fix implicit declaration warning
  (git-fixes).
- mtd: spi-nor: sfdp: Fix index value for SCCR dwords (git-fixes).
- mtd: dataflash: remove duplicate SPI ID table (git-fixes).
- soundwire: cadence: Don't overflow the command FIFOs
  (git-fixes).
- phy: rockchip-typec: fix tcphy_get_mode error case (git-fixes).
- PCI: switchtec: Return -EFAULT for copy_to_user() errors
  (git-fixes).
- PCI: Fix dropping valid root bus resources with .end = zero
  (git-fixes).
- PCI/PM: Observe reset delay irrespective of bridge_d3
  (git-fixes).
- PCI/IOV: Enlarge virtfn sysfs name buffer (git-fixes).
- PCI: hotplug: Allow marking devices as disconnected during
  bind/unbind (git-fixes).
- serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
  (git-fixes).
- serial: tegra: Add missing clk_disable_unprepare() in
  tegra_uart_hw_init() (git-fixes).
- tty: serial: fsl_lpuart: disable Rx/Tx DMA in
  lpuart32_shutdown() (git-fixes).
- printf: fix errname.c list (git-fixes).
- pinctrl: mediatek: Initialize variable *buf to zero (git-fixes).
- pinctrl: rockchip: Fix refcount leak in
  rockchip_pinctrl_parse_groups (git-fixes).
- pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
  (git-fixes).
- pinctrl: qcom: pinctrl-msm8976: Correct function names for
  wcss pins (git-fixes).
- spi: synquacer: Fix timeout handling in
  synquacer_spi_transfer_one() (git-fixes).
- spi: bcm63xx-hsspi: Endianness fix for ARM based SoC
  (git-fixes).
- sefltests: netdevsim: wait for devlink instance after netns
  removal (git-fixes).
- thermal/drivers/hisi: Drop second sensor hi3660 (git-fixes).
- thermal: intel: powerclamp: Fix cur_state for multi package
  system (git-fixes).
- thermal/drivers/tsens: limit num_sensors to 9 for msm8939
  (git-fixes).
- thermal/drivers/tsens: fix slope values for msm8939 (git-fixes).
- thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
  (git-fixes).
- thermal/drivers/tsens: Drop msm8976-specific defines
  (git-fixes).
- net/rose: Fix to not accept on connected socket (git-fixes).
- platform/x86: touchscreen_dmi: Add Chuwi Vi8 (CWI501) DMI match
  (git-fixes).
- platform/x86: amd-pmc: Correct usage of SMU version (git-fixes).
- selftest/lkdtm: Skip stack-entropy test if lkdtm is not
  available (git-fixes).
- platform/x86: amd-pmc: Fix compilation when CONFIG_DEBUGFS is
  disabled (git-fixes).
- platform/x86: amd-pmc: Export Idlemask values based on the APU
  (git-fixes).
- commit 14a6c6a</changelog>
  <changelog author="tiwai@suse.de" date="1678104008">- ALSA: ice1712: Delete unreachable code in aureon_add_controls()
  (git-fixes).
- ALSA: ice1712: Do not left ice-&gt;gpio_mutex locked in
  aureon_add_controls() (git-fixes).
- ASoC: adau7118: don't disable regulators on device unbind
  (git-fixes).
- watchdog: sbsa_wdog: Make sure the timeout programming is
  within the limits (git-fixes).
- watchdog: pcwd_usb: Fix attempting to access uninitialized
  memory (git-fixes).
- watchdog: Fix kmemleak in watchdog_cdev_register (git-fixes).
- watchdog: at91sam9_wdt: use devm_request_irq to avoid missing
  free_irq() in error path (git-fixes).
- vc_screen: don't clobber return value in vcs_read (git-fixes).
- vc_screen: modify vcs_size() handling in vcs_read() (git-fixes).
- wifi: ath11k: allow system suspend to survive ath11k
  (git-fixes).
- vdpa_sim: not reset state in vdpasim_queue_ready (git-fixes).
- VMCI: check context-&gt;notify_page after call to
  get_user_pages_fast() to avoid GPF (git-fixes).
- tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx
  dma case (git-fixes).
- tty: serial: qcom-geni-serial: stop operations in progress at
  shutdown (git-fixes).
- tty: serial: fsl_lpuart: clear LPUART Status Register in
  lpuart32_shutdown() (git-fixes).
- USB: serial: option: add support for VW/Skoda "Carstick LTE"
  (git-fixes).
- usb: dwc3: pci: add support for the Intel Meteor Lake-M
  (git-fixes).
- usb: max-3421: Fix setting of I/O pins (git-fixes).
- usb: musb: mediatek: don't unregister something that wasn't
  registered (git-fixes).
- USB: core: Don't hold device lock while reading the
  "descriptors" sysfs file (git-fixes).
- usb: early: xhci-dbc: Fix a potential out-of-bound memory access
  (git-fixes).
- usb: gadget: fusb300_udc: free irq on the error path in
  fusb300_probe() (git-fixes).
- wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
  (git-fixes).
- wifi: cfg80211: Fix use after free for wext (git-fixes).
- wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
  (git-fixes).
- wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there
  is no callback function (git-fixes).
- wifi: mwifiex: fix loop iterator in
  mwifiex_update_ampdu_txwinsize() (git-fixes).
- wifi: mwifiex: Add missing compatible string for SD8787
  (git-fixes).
- wifi: iwl4965: Add missing check for
  create_singlethread_workqueue() (git-fixes).
- wifi: iwl3945: Add missing check for
  create_singlethread_workqueue (git-fixes).
- wifi: cfg80211: Fix extended KCK key length check in
  nl80211_set_rekey_data() (git-fixes).
- wifi: orinoco: check return value of hermes_write_wordrec()
  (git-fixes).
- wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
  (git-fixes).
- wifi: rtw89: Add missing check for alloc_workqueue (git-fixes).
- wifi: wl3501_cs: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas: cmdresp: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas: main: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas: if_usb: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas_tf: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
  (git-fixes).
- wifi: brcmfmac: fix potential memory leak in
  brcmf_netdev_start_xmit() (git-fixes).
- wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
  (git-fixes).
- wifi: ipw2200: fix memory leak in ipw_wdev_init() (git-fixes).
- wifi: ipw2x00: don't call dev_kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rtlwifi: Fix global-out-of-bounds bug in
  _rtl8812ae_phy_set_txpower_limit() (git-fixes).
- wifi: rtl8xxxu: don't call dev_kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: libertas: fix memory leak in lbs_init_adapter()
  (git-fixes).
- wifi: iwlegacy: common: don't call dev_kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rtlwifi: rtl8723be: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under
  spin_lock_irqsave() (git-fixes).
- wifi: rsi: Fix memory leak in rsi_coex_attach() (git-fixes).
- commit 795b424</changelog>
  <changelog author="tiwai@suse.de" date="1678104009">- ASoC: mchp-spdifrx: Fix uninitialized use of mr in
  mchp_spdifrx_hw_params() (git-fixes).
- commit ef46bcf</changelog>
  <changelog author="ohering@suse.de" date="1678104010">- hv_netvsc: Check status in SEND_RNDIS_PKT completion message
  (git-fixes).
- commit cf78232</changelog>
  <changelog author="dwagner@suse.de" date="1678104011">- nvme-fabrics: show well known discovery name (bsc#1200054).
- commit 0dc6ff3</changelog>
  <changelog author="jack@suse.cz" date="1678104012">- ocfs2: Fix data corruption after failed write (bsc#1208542).
- commit 92f0180</changelog>
  <changelog author="tiwai@suse.de" date="1678104013">- Move upstreamed i915 and media fixes into sorted section
- commit f79acc7</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1678104014">- Refresh
  patches.suse/ice-Do-not-skip-not-enabled-queues-in-ice_vc_dis_qs_.patch.
- Refresh
  patches.suse/ice-clear-stale-Tx-queue-settings-before-configuring.patch.
  Fix bug introduced by broken backport (bsc#1208628).
- commit d902e3e</changelog>
  <changelog author="msuchanek@suse.de" date="1678104015">- selftests/ftrace: Convert tracer tests to use 'requires'
  to specify program dependency (bsc#1204993 ltc#200103).
- selftests/ftrace: Add check for ping command for trigger tests
  (bsc#1204993 ltc#200103).
- commit 11e08ba</changelog>
  <changelog author="tonyj@suse.de" date="1678104016">- selftests/powerpc: Account for offline cpus in perf-hwbreak test
  (bsc#1206232).
- selftests/powerpc: Bump up rlimit for perf-hwbreak test
  (bsc#1206232).
- selftests/powerpc: Move perror closer to its use (bsc#1206232).
- commit cc3db6d</changelog>
  <changelog author="mkubecek@suse.cz" date="1678190400">- net/ulp: use consistent error code when blocking ULP
  (CVE-2023-0461 bsc#1208787).
- net/ulp: prevent ULP without clone op from entering the LISTEN
  status (CVE-2023-0461 bsc#1208787).
- commit bad820e</changelog>
</package>
<package pkgid="53f2108b95a22b4e67b1fc9db5771e3c4e17fbe531c1bfb4297d586adc1c3df9" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.14.21" rel="150400.24.38.1.150400.24.13.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="c9a7760e273ae2a5e2df4fb2f7461044ccb9192648e4c99216a361546977b584" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.24.38.1.150400.24.13.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="59900a3bf0f9ca41f3ca36908b93ffa76751c243380fccf087ca9a423dffd523" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.24.38.1.150400.24.13.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="ccf2799ec71fab62a00d07789d2985071b78526b59738102b4318f854bef125f" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.14.21" rel="150400.24.41.1.150400.24.15.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="feae42b376af5b04db176941f0a898a6c3abc8ac30253a0fffeb8bea983f56fc" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.24.41.1.150400.24.15.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="005819b74043546b6cee9c51ea1f5600f39c31c6d26c4034a9f42732a4c0a209" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.24.41.1.150400.24.15.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="861d7b0adcff6879a8dd57f872316952d4960c6c9c53fe99bbdeb5d863b0c40e" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.14.21" rel="150400.24.46.1.150400.24.17.3"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="9f7ff72d7ae089524805fbf09b72635b0445b06c0f501b6e2f13f6ee1aaf0636" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.24.46.1.150400.24.17.3"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="f47134ce652f41a6bccf67982943a33c0739e54a6585b5c72bbf5b1f4427d2c8" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.24.46.1.150400.24.17.3"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="77d320cdec204d7df39cfb46af8b032dadd53a7868e148901e18329fc4695e43" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.14.21" rel="150400.24.49.3.150400.24.19.3"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="73c7540392c08ec16bdff11cdb75f5ac3f25715d6fb9571fb8413177db8850ec" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.24.49.3.150400.24.19.3"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="ea21021ba60f93f489907908fce304682148eda593d3bc5c752329858cc3cddd" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.24.49.3.150400.24.19.3"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="1f9148e99db8ada4ea6b5544312d0177ecd176a1d40b3cae74b692e5839a287c" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.15.11.1"/>
  <changelog author="jslaby@suse.cz" date="1676376000">- x86/bugs: Flush IBP in ib_prctl_set() (bsc#1207773
  CVE-2023-0045).
- commit e08d6f4</changelog>
  <changelog author="jslaby@suse.cz" date="1676376001">- blacklist.conf: add some x86 entries
- commit a9b7553</changelog>
  <changelog author="jslaby@suse.cz" date="1676376002">- x86/boot: Avoid using Intel mnemonics in AT&amp;T syntax asm
  (git-fixes).
- x86/asm: Fix an assembler warning with current binutils
  (git-fixes).
- x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK
  (git-fixes).
- x86/kprobes: Fix kprobes instruction boudary check with
  CONFIG_RETHUNK (git-fixes).
- x86/kvm: Remove unused virt to phys translation in
  kvm_guest_cpu_init() (git-fixes).
- x86/microcode/intel: Do not retry microcode reloading on the
  APs (git-fixes).
- x86/MCE/AMD: Clear DFR errors found in THR handler (git-fixes).
- signal/vm86_32: Properly send SIGSEGV when the vm86 state
  cannot be saved (git-fixes).
- x86: ACPI: cstate: Optimize C3 entry on AMD CPUs (git-fixes).
- commit e419e31</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1676376003">- net: mana: Fix IRQ name - add PCI and queue number
  (bsc#1207875).
- commit da88ecc</changelog>
  <changelog author="mkoutny@suse.com" date="1676376004">- blacklist.conf: Add 4a7ba45b1a43 memcg: fix possible use-after-free in memcg_write_event_control()
- commit 6452dee</changelog>
  <changelog author="mhocko@suse.com" date="1676376005">- exit: Put an upper limit on how often we can oops (bsc#1207328).
- sysctl: add a new register_sysctl_init() interface
  (bsc#1207328).
- exit: Stop poorly open coding do_task_dead in make_task_dead
  (bsc#1207328).
- exit: Move oops specific logic from do_exit into make_task_dead
  (bsc#1207328).
- exit: Add and use make_task_dead (bsc#1207328).
- commit b158add</changelog>
  <changelog author="mhocko@suse.com" date="1676376006">- exit: Move force_uaccess back into do_exit (bsc#1207328).
- blacklist.conf: blacklist fixups for unsupported arches
- exit: Guarantee make_task_dead leaks the tsk when calling
  do_task_exit (bsc#1207328).
- objtool: Add a missing comma to avoid string concatenation
  (bsc#1207328).
- commit a5e521f</changelog>
  <changelog author="tiwai@suse.de" date="1676462400">- usb: core: add quirk for Alcor Link AK9563 smartcard reader
  (git-fixes).
- drm/i915: Fix VBT DSI DVO port handling (git-fixes).
- commit d08ee1f</changelog>
  <changelog author="mhocko@suse.com" date="1676462401">- Update
  patches.suse/0001-exit-Put-an-upper-limit-on-how-often-we-can-oops.patch
  (bsc#1207328, bsc#1208290).
- commit d66a2b6</changelog>
  <changelog author="mhocko@suse.com" date="1676462402">- panic: Introduce warn_limit (bsc#1207328).
- panic: Consolidate open-coded panic_on_warn checks
  (bsc#1207328).
- kasan: no need to unset panic_on_warn in end_report()
  (bsc#1207328).
- ubsan: no need to unset panic_on_warn in ubsan_epilogue()
  (bsc#1207328).
- panic: unset panic_on_warn inside panic() (bsc#1207328).
- commit 2d71785</changelog>
  <changelog author="mhocko@suse.com" date="1676462403">- exit: Use READ_ONCE() for all oops/warn limit reads
  (bsc#1207328).
- exit: Allow oops_limit to be disabled (bsc#1207328).
- commit 75afc24</changelog>
  <changelog author="tzimmermann@suse.de" date="1676548800">- Set references for "drm/vmwgfx: Validate the box size for the snooped cursor" (bsc#1203332 CVE-2022-36280)
- commit 9d6fa3b</changelog>
  <changelog author="tiwai@suse.de" date="1676635200">- drm/amd/display: Fail atomic_check early on normalize_zpos error
  (git-fixes).
- net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  (git-fixes).
- net: openvswitch: fix possible memory leak in
  ovs_meter_cmd_set() (git-fixes).
- commit 305b479</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1676635201">- net: mana: Fix accessing freed irq affinity_hint (bsc#1208153).
- genirq: Provide new interfaces for affinity hints (bsc#1208153).
- commit b973d25</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1676635202">- net: mana: Assign interrupts to CPUs based on NUMA nodes
  (bsc#1208153).
- Refresh
  patches.suse/net-mana-Fix-IRQ-name-add-PCI-and-queue-number.patch.
- commit e0863ac</changelog>
  <changelog author="colyli@suse.de" date="1676635203">- blacklist.conf: add git-fixes commit which won't be backported
- commit 9c78c8a</changelog>
  <changelog author="colyli@suse.de" date="1676635204">- block, bfq: fix uaf for bfqq in bic_set_bfqq() (git-fixes).
- blk-cgroup: fix missing pd_online_fn() while activating policy
  (git-fixes).
- block: don't allow splitting of a REQ_NOWAIT bio (git-fixes).
- block: mq-deadline: Rename deadline_is_seq_writes() (git-fixes).
- blk-mq: fix possible memleak when register 'hctx' failed
  (git-fixes).
- block: mq-deadline: Do not break sequential write streams to
  zoned HDDs (git-fixes).
- block: clear -&gt;slave_dir when dropping the main slave_dir
  reference (git-fixes).
- md/raid1: stop mdx_raid1 thread when raid1 array run failed
  (git-fixes).
- md: fix a crash in mempool_free (git-fixes).
- md/bitmap: Fix bitmap chunk size overflow issues (git-fixes).
- drivers/md/md-bitmap: check the return value of
  md_bitmap_get_counter() (git-fixes).
- block/bfq-iosched.c: use "false" rather than "BLK_RW_ASYNC"
  (git-fixes).
- block: fix and cleanup bio_check_ro (git-fixes).
- commit 1404ba9</changelog>
  <changelog author="lhenriques@suse.de" date="1676635205">- ceph: flush cap releases when the session is flushed
  (bsc#1208428).
- commit 6cc818b</changelog>
  <changelog author="lhenriques@suse.de" date="1676635206">- fscache_cookie_enabled: check cookie is valid before accessing
  it (bsc#1208429).
- commit eb9d928</changelog>
  <changelog author="lhenriques@suse.de" date="1676635207">- blacklist: add commit 752f59637128 ("docs: filesystems: update netfs-api.rst reference")
- commit b636a21</changelog>
</package>
<package pkgid="34933881870ed7bd6a450a985211aee57bbb9b191686a44547cb0abc085f05e2" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.15.11.1"/>
  <changelog author="jslaby@suse.cz" date="1676376000">- x86/bugs: Flush IBP in ib_prctl_set() (bsc#1207773
  CVE-2023-0045).
- commit e08d6f4</changelog>
  <changelog author="jslaby@suse.cz" date="1676376001">- blacklist.conf: add some x86 entries
- commit a9b7553</changelog>
  <changelog author="jslaby@suse.cz" date="1676376002">- x86/boot: Avoid using Intel mnemonics in AT&amp;T syntax asm
  (git-fixes).
- x86/asm: Fix an assembler warning with current binutils
  (git-fixes).
- x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK
  (git-fixes).
- x86/kprobes: Fix kprobes instruction boudary check with
  CONFIG_RETHUNK (git-fixes).
- x86/kvm: Remove unused virt to phys translation in
  kvm_guest_cpu_init() (git-fixes).
- x86/microcode/intel: Do not retry microcode reloading on the
  APs (git-fixes).
- x86/MCE/AMD: Clear DFR errors found in THR handler (git-fixes).
- signal/vm86_32: Properly send SIGSEGV when the vm86 state
  cannot be saved (git-fixes).
- x86: ACPI: cstate: Optimize C3 entry on AMD CPUs (git-fixes).
- commit e419e31</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1676376003">- net: mana: Fix IRQ name - add PCI and queue number
  (bsc#1207875).
- commit da88ecc</changelog>
  <changelog author="mkoutny@suse.com" date="1676376004">- blacklist.conf: Add 4a7ba45b1a43 memcg: fix possible use-after-free in memcg_write_event_control()
- commit 6452dee</changelog>
  <changelog author="mhocko@suse.com" date="1676376005">- exit: Put an upper limit on how often we can oops (bsc#1207328).
- sysctl: add a new register_sysctl_init() interface
  (bsc#1207328).
- exit: Stop poorly open coding do_task_dead in make_task_dead
  (bsc#1207328).
- exit: Move oops specific logic from do_exit into make_task_dead
  (bsc#1207328).
- exit: Add and use make_task_dead (bsc#1207328).
- commit b158add</changelog>
  <changelog author="mhocko@suse.com" date="1676376006">- exit: Move force_uaccess back into do_exit (bsc#1207328).
- blacklist.conf: blacklist fixups for unsupported arches
- exit: Guarantee make_task_dead leaks the tsk when calling
  do_task_exit (bsc#1207328).
- objtool: Add a missing comma to avoid string concatenation
  (bsc#1207328).
- commit a5e521f</changelog>
  <changelog author="tiwai@suse.de" date="1676462400">- usb: core: add quirk for Alcor Link AK9563 smartcard reader
  (git-fixes).
- drm/i915: Fix VBT DSI DVO port handling (git-fixes).
- commit d08ee1f</changelog>
  <changelog author="mhocko@suse.com" date="1676462401">- Update
  patches.suse/0001-exit-Put-an-upper-limit-on-how-often-we-can-oops.patch
  (bsc#1207328, bsc#1208290).
- commit d66a2b6</changelog>
  <changelog author="mhocko@suse.com" date="1676462402">- panic: Introduce warn_limit (bsc#1207328).
- panic: Consolidate open-coded panic_on_warn checks
  (bsc#1207328).
- kasan: no need to unset panic_on_warn in end_report()
  (bsc#1207328).
- ubsan: no need to unset panic_on_warn in ubsan_epilogue()
  (bsc#1207328).
- panic: unset panic_on_warn inside panic() (bsc#1207328).
- commit 2d71785</changelog>
  <changelog author="mhocko@suse.com" date="1676462403">- exit: Use READ_ONCE() for all oops/warn limit reads
  (bsc#1207328).
- exit: Allow oops_limit to be disabled (bsc#1207328).
- commit 75afc24</changelog>
  <changelog author="tzimmermann@suse.de" date="1676548800">- Set references for "drm/vmwgfx: Validate the box size for the snooped cursor" (bsc#1203332 CVE-2022-36280)
- commit 9d6fa3b</changelog>
  <changelog author="tiwai@suse.de" date="1676635200">- drm/amd/display: Fail atomic_check early on normalize_zpos error
  (git-fixes).
- net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
  (git-fixes).
- net: openvswitch: fix possible memory leak in
  ovs_meter_cmd_set() (git-fixes).
- commit 305b479</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1676635201">- net: mana: Fix accessing freed irq affinity_hint (bsc#1208153).
- genirq: Provide new interfaces for affinity hints (bsc#1208153).
- commit b973d25</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1676635202">- net: mana: Assign interrupts to CPUs based on NUMA nodes
  (bsc#1208153).
- Refresh
  patches.suse/net-mana-Fix-IRQ-name-add-PCI-and-queue-number.patch.
- commit e0863ac</changelog>
  <changelog author="colyli@suse.de" date="1676635203">- blacklist.conf: add git-fixes commit which won't be backported
- commit 9c78c8a</changelog>
  <changelog author="colyli@suse.de" date="1676635204">- block, bfq: fix uaf for bfqq in bic_set_bfqq() (git-fixes).
- blk-cgroup: fix missing pd_online_fn() while activating policy
  (git-fixes).
- block: don't allow splitting of a REQ_NOWAIT bio (git-fixes).
- block: mq-deadline: Rename deadline_is_seq_writes() (git-fixes).
- blk-mq: fix possible memleak when register 'hctx' failed
  (git-fixes).
- block: mq-deadline: Do not break sequential write streams to
  zoned HDDs (git-fixes).
- block: clear -&gt;slave_dir when dropping the main slave_dir
  reference (git-fixes).
- md/raid1: stop mdx_raid1 thread when raid1 array run failed
  (git-fixes).
- md: fix a crash in mempool_free (git-fixes).
- md/bitmap: Fix bitmap chunk size overflow issues (git-fixes).
- drivers/md/md-bitmap: check the return value of
  md_bitmap_get_counter() (git-fixes).
- block/bfq-iosched.c: use "false" rather than "BLK_RW_ASYNC"
  (git-fixes).
- block: fix and cleanup bio_check_ro (git-fixes).
- commit 1404ba9</changelog>
  <changelog author="lhenriques@suse.de" date="1676635205">- ceph: flush cap releases when the session is flushed
  (bsc#1208428).
- commit 6cc818b</changelog>
  <changelog author="lhenriques@suse.de" date="1676635206">- fscache_cookie_enabled: check cookie is valid before accessing
  it (bsc#1208429).
- commit eb9d928</changelog>
  <changelog author="lhenriques@suse.de" date="1676635207">- blacklist: add commit 752f59637128 ("docs: filesystems: update netfs-api.rst reference")
- commit b636a21</changelog>
</package>
<package pkgid="e65ae52a0afb8cc6b60c66d45e0a5bb4e9bda4b51cbfb769bf8547a270ee0473" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.15.14.2"/>
  <changelog author="oneukum@suse.com" date="1678190400">- media: coda: Add check for kmalloc (git-fixes).
- commit 8c98f78</changelog>
  <changelog author="oneukum@suse.com" date="1678190401">- media: uvcvideo: Fix race condition with usb_kill_urb
  (git-fixes).
- commit 9dd8ca0</changelog>
  <changelog author="oneukum@suse.com" date="1678190402">- struct uvc_device move flush_status  new member to end
  (git-fixes).
- commit 8ba3f50</changelog>
  <changelog author="oneukum@suse.com" date="1678190403">- media: ti: cal: fix possible memory leak in cal_ctx_create()
  (git-fixes).
- commit 2ff7792</changelog>
  <changelog author="tiwai@suse.de" date="1678190404">- Update patch reference for media fix (CVE-2023-1118 bsc#1208837)
- commit 778b9f2</changelog>
  <changelog author="tiwai@suse.de" date="1678190405">- phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node
  function (CVE-2023-23000 bsc#1208816).
- commit 4632142</changelog>
  <changelog author="oneukum@suse.com" date="1678190406">- media: platform: ti: Add missing check for devm_regulator_get
  (git-fixes).
- commit 08661ee</changelog>
  <changelog author="oneukum@suse.com" date="1678190407">- media: imx: imx7-media-csi: fix missing clk_disable_unprepare()
  in imx7_csi_init() (git-fixes).
- commit e70e8d4</changelog>
  <changelog author="pjakobsson@suse.de" date="1678190408">- drm/virtio: Fix NULL vs IS_ERR checking in
  virtio_gpu_object_shmem_init (bsc#1208776 CVE-2023-22998).
- commit cd9c832</changelog>
  <changelog author="palcantara@suse.de" date="1678190409">- update internal module version number for cifs.ko (bsc#1193629).
- commit c325c43</changelog>
  <changelog author="neilb@suse.de" date="1678276800">- KABI FIX FOR: NFSv4.1 query for fs_location attr on a new file
  system (Never, kabi).
- commit f615f65</changelog>
  <changelog author="neilb@suse.de" date="1678276801">- VFS: filename_create(): fix incorrect intent (bsc#1197534).
- commit a961e32</changelog>
  <changelog author="tiwai@suse.de" date="1678276802">- Add cherry-picked id for nouveau patch
- commit d18ab1d</changelog>
  <changelog author="oneukum@suse.com" date="1678276803">- blacklist.conf: kABI, cosmetic
- commit f03aa8f</changelog>
  <changelog author="dwagner@suse.de" date="1678276804">- nvme-auth: fix an error code in
  nvme_auth_process_dhchap_challenge() (bsc#1202633).
- nvme-auth: don't use NVMe status codes (bsc#1202633).
- nvme-auth: mark nvme_auth_wq static (bsc#1202633).
- nvme-auth: use workqueue dedicated to authentication
  (bsc#1202633).
- nvme-auth: fix smatch warning complaints (bsc#1202633).
- nvme-auth: have dhchap_auth_work wait for queues auth to
  complete (bsc#1202633).
- nvme-auth: remove redundant auth_work flush (bsc#1202633).
- nvme-auth: convert dhchap_auth_list to an array (bsc#1202633).
- nvme-auth: check chap ctrl_key once constructed (bsc#1202633).
- nvme-auth: no need to reset chap contexts on re-authentication
  (bsc#1202633).
- nvme-auth: remove redundant deallocations (bsc#1202633).
- nvme-auth: clear sensitive info right after authentication
  completes (bsc#1202633).
- nvme-auth: guarantee dhchap buffers under memory pressure
  (bsc#1202633).
- nvme-auth: don't keep long lived 4k dhchap buffer (bsc#1202633).
- nvme-auth: remove redundant if statement (bsc#1202633).
- nvme-auth: don't override ctrl keys before validation
  (bsc#1202633).
- nvme-auth: don't ignore key generation failures when
  initializing ctrl keys (bsc#1202633).
- nvme-auth: remove redundant buffer deallocations (bsc#1202633).
- nvme-auth: don't re-authenticate if the controller is not LIVE
  (bsc#1202633).
- nvme-auth: remove symbol export from nvme_auth_reset
  (bsc#1202633).
- nvme-auth: rename authentication work elements (bsc#1202633).
- nvme-auth: rename __nvme_auth_[reset|free] to
  nvme_auth[reset|free]_dhchap (bsc#1202633).
- commit 67a47c5</changelog>
  <changelog author="oneukum@suse.com" date="1678276805">- blacklist.conf: false positive
- commit 086f5da</changelog>
  <changelog author="pjakobsson@suse.de" date="1678276806">- malidp: Fix NULL vs IS_ERR() checking (bsc#1208843
  CVE-2023-23004).
- commit 87efba8</changelog>
  <changelog author="tiwai@suse.de" date="1678363200">- platform: x86: MLX_PLATFORM: select REGMAP instead of depending
  on it (git-fixes).
- commit b403668</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1678363201">- qede: avoid uninitialized entries in coal_entry array
  (bsc#1205846).
- qede: fix interrupt coalescing configuration (bsc#1205846).
- commit bcd42d6</changelog>
  <changelog author="tiwai@suse.de" date="1678363202">- Update patch reference for HID fixes (CVE-2023-25012 bsc#1207560)
- commit ac09f05</changelog>
</package>
<package pkgid="429f4d6c0b2b69a347e6221a6a1c9cfe5467f794f8aebbb77789db3f23a44bdc" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.15.14.2"/>
  <changelog author="oneukum@suse.com" date="1678190400">- media: coda: Add check for kmalloc (git-fixes).
- commit 8c98f78</changelog>
  <changelog author="oneukum@suse.com" date="1678190401">- media: uvcvideo: Fix race condition with usb_kill_urb
  (git-fixes).
- commit 9dd8ca0</changelog>
  <changelog author="oneukum@suse.com" date="1678190402">- struct uvc_device move flush_status  new member to end
  (git-fixes).
- commit 8ba3f50</changelog>
  <changelog author="oneukum@suse.com" date="1678190403">- media: ti: cal: fix possible memory leak in cal_ctx_create()
  (git-fixes).
- commit 2ff7792</changelog>
  <changelog author="tiwai@suse.de" date="1678190404">- Update patch reference for media fix (CVE-2023-1118 bsc#1208837)
- commit 778b9f2</changelog>
  <changelog author="tiwai@suse.de" date="1678190405">- phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node
  function (CVE-2023-23000 bsc#1208816).
- commit 4632142</changelog>
  <changelog author="oneukum@suse.com" date="1678190406">- media: platform: ti: Add missing check for devm_regulator_get
  (git-fixes).
- commit 08661ee</changelog>
  <changelog author="oneukum@suse.com" date="1678190407">- media: imx: imx7-media-csi: fix missing clk_disable_unprepare()
  in imx7_csi_init() (git-fixes).
- commit e70e8d4</changelog>
  <changelog author="pjakobsson@suse.de" date="1678190408">- drm/virtio: Fix NULL vs IS_ERR checking in
  virtio_gpu_object_shmem_init (bsc#1208776 CVE-2023-22998).
- commit cd9c832</changelog>
  <changelog author="palcantara@suse.de" date="1678190409">- update internal module version number for cifs.ko (bsc#1193629).
- commit c325c43</changelog>
  <changelog author="neilb@suse.de" date="1678276800">- KABI FIX FOR: NFSv4.1 query for fs_location attr on a new file
  system (Never, kabi).
- commit f615f65</changelog>
  <changelog author="neilb@suse.de" date="1678276801">- VFS: filename_create(): fix incorrect intent (bsc#1197534).
- commit a961e32</changelog>
  <changelog author="tiwai@suse.de" date="1678276802">- Add cherry-picked id for nouveau patch
- commit d18ab1d</changelog>
  <changelog author="oneukum@suse.com" date="1678276803">- blacklist.conf: kABI, cosmetic
- commit f03aa8f</changelog>
  <changelog author="dwagner@suse.de" date="1678276804">- nvme-auth: fix an error code in
  nvme_auth_process_dhchap_challenge() (bsc#1202633).
- nvme-auth: don't use NVMe status codes (bsc#1202633).
- nvme-auth: mark nvme_auth_wq static (bsc#1202633).
- nvme-auth: use workqueue dedicated to authentication
  (bsc#1202633).
- nvme-auth: fix smatch warning complaints (bsc#1202633).
- nvme-auth: have dhchap_auth_work wait for queues auth to
  complete (bsc#1202633).
- nvme-auth: remove redundant auth_work flush (bsc#1202633).
- nvme-auth: convert dhchap_auth_list to an array (bsc#1202633).
- nvme-auth: check chap ctrl_key once constructed (bsc#1202633).
- nvme-auth: no need to reset chap contexts on re-authentication
  (bsc#1202633).
- nvme-auth: remove redundant deallocations (bsc#1202633).
- nvme-auth: clear sensitive info right after authentication
  completes (bsc#1202633).
- nvme-auth: guarantee dhchap buffers under memory pressure
  (bsc#1202633).
- nvme-auth: don't keep long lived 4k dhchap buffer (bsc#1202633).
- nvme-auth: remove redundant if statement (bsc#1202633).
- nvme-auth: don't override ctrl keys before validation
  (bsc#1202633).
- nvme-auth: don't ignore key generation failures when
  initializing ctrl keys (bsc#1202633).
- nvme-auth: remove redundant buffer deallocations (bsc#1202633).
- nvme-auth: don't re-authenticate if the controller is not LIVE
  (bsc#1202633).
- nvme-auth: remove symbol export from nvme_auth_reset
  (bsc#1202633).
- nvme-auth: rename authentication work elements (bsc#1202633).
- nvme-auth: rename __nvme_auth_[reset|free] to
  nvme_auth[reset|free]_dhchap (bsc#1202633).
- commit 67a47c5</changelog>
  <changelog author="oneukum@suse.com" date="1678276805">- blacklist.conf: false positive
- commit 086f5da</changelog>
  <changelog author="pjakobsson@suse.de" date="1678276806">- malidp: Fix NULL vs IS_ERR() checking (bsc#1208843
  CVE-2023-23004).
- commit 87efba8</changelog>
  <changelog author="tiwai@suse.de" date="1678363200">- platform: x86: MLX_PLATFORM: select REGMAP instead of depending
  on it (git-fixes).
- commit b403668</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1678363201">- qede: avoid uninitialized entries in coal_entry array
  (bsc#1205846).
- qede: fix interrupt coalescing configuration (bsc#1205846).
- commit bcd42d6</changelog>
  <changelog author="tiwai@suse.de" date="1678363202">- Update patch reference for HID fixes (CVE-2023-25012 bsc#1207560)
- commit ac09f05</changelog>
</package>
<package pkgid="df17c27876961ee794f24eaa939e67572350aef65ebc1a412351100571855f53" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.15.18.1"/>
  <changelog author="mkoutny@suse.com" date="1678795200">- blacklist.conf: Add 9df918698408 kernel/panic: move panic sysctls to its own file
- commit 7099ede</changelog>
  <changelog author="mkoutny@suse.com" date="1678795201">- blacklist.conf: Add 9360d035a579 panic: Separate sysctl logic from CONFIG_SMP
- commit 70188a8</changelog>
  <changelog author="mkoutny@suse.com" date="1678795202">- fork: allow CLONE_NEWTIME in clone3 flags (bsc#1209258).
- commit 49f82de</changelog>
  <changelog author="mkoutny@suse.com" date="1678795203">- blacklist.conf: Add cgroup locking optimizations
  be288169712f cgroup: reduce dependency on cgroup_mutex
  671c11f0619e cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree
- commit a274f6f</changelog>
  <changelog author="ddiss@suse.de" date="1678795204">- watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths
  (bsc#1197617).
- commit 34bfa16</changelog>
  <changelog author="mkoutny@suse.com" date="1678795205">- mm: memcg: fix NULL pointer in
  mem_cgroup_track_foreign_dirty_slowpath() (bsc#1209262).
- commit ca9be2b</changelog>
  <changelog author="msuchanek@suse.de" date="1678795206">- Replace mkinitrd dependency with dracut (bsc#1202353).
  Also update mkinitrd refrences in documentation and comments.
- commit e356c9b</changelog>
  <changelog author="msuchanek@suse.de" date="1678795207">- Require suse-kernel-rpm-scriptlets at all times.
  The kernel packages call scriptlets for each stage, add the dependency
  to make it clear to libzypp that the scriptlets are required.
  There is no special dependency for posttrans, these scriptlets run when
  transactions are resolved. The plain dependency has to be used to
  support posttrans.
- commit 56c4dbe</changelog>
  <changelog author="tonyj@suse.de" date="1678795208">- perf/x86/uncore: Don't WARN_ON_ONCE() for a broken discovery
  table (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/uncore: Add a quirk for UPI on SPR (bsc#1206824,
  bsc#1206493, bsc#1206492).
- perf/x86/uncore: Ignore broken units in discovery table
  (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/uncore: Fix potential NULL pointer in
  uncore_get_alias_name (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/uncore: Factor out uncore_device_to_die() (bsc#1206824,
  bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Make set_mapping() procedure void
  (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Update sysfs-devices-mapping file
  (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Enable UPI topology discovery for
  Sapphire Rapids (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Enable UPI topology discovery for
  Icelake Server (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Get UPI NodeID and GroupID (bsc#1206824,
  bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Enable UPI topology discovery for
  Skylake Server (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Generalize get_topology() for SKX PMUs
  (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Disable I/O stacks to PMU mapping on
  ICX-D (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Clear attr_update properly (bsc#1206824,
  bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Introduce UPI topology type (bsc#1206824,
  bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Generalize IIO topology support
  (bsc#1206824, bsc#1206493, bsc#1206492).
- commit 23fd14b</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1678968000">- rpm/group-source-files.pl: Fix output difference when / is in location
  While previous attempt to fix group-source-files.pl in 6d651362c38
  "rpm/group-source-files.pl: Deal with {pre,post}fixed / in location"
  breaks the infinite loop, it does not properly address the issue. Having
  prefixed and/or postfixed forward slash still result in different
  output.
  This commit changes the script to use the Perl core module File::Spec
  for proper path manipulation to give consistent output.
- commit 4161bf9</changelog>
  <changelog author="vkarasulli@suse.de" date="1678968001">- Update references in
  patches.suse/media-dvb-usb-az6027-fix-null-ptr-deref-in-az6027_i2.patch
  (git-fixes bsc#1209291 CVE-2023-28328).
- commit dc99e31</changelog>
  <changelog author="tiwai@suse.de" date="1679054400">- hwmon: (k10temp): Add support for new family 17h and 19h models
  (bsc#1208848).
- x86/amd_nb: Add AMD PCI IDs for SMN communication (bsc#1208848).
- commit c3dd9ac</changelog>
  <changelog author="tiwai@suse.de" date="1679054401">- Delete patches.suse/drm-i915-Don-t-use-BAR-mappings-for-ring-buffers-wit.patch
  Resulted in an Oops / hang at boot (bsc#1209436)
- commit 0da96b0</changelog>
  <changelog author="tiwai@suse.de" date="1679313600">- serial: qcom-geni: fix console shutdown hang (git-fixes).
- serial: 8250_fsl: fix handle_irq locking (git-fixes).
- serial: 8250_em: Fix UART port type (git-fixes).
- interconnect: exynos: fix node leak in probe PM QoS error path
  (git-fixes).
- interconnect: fix mem leak when freeing nodes (git-fixes).
- interconnect: qcom: osm-l3: fix icc_onecell_data allocation
  (git-fixes).
- firmware: xilinx: don't make a sleepable memory allocation
  from an atomic context (git-fixes).
- fbdev: omapfb: cleanup inconsistent indentation (git-fixes).
- hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip (git-fixes).
- hwmon: (adm1266) Set `can_sleep` flag for GPIO chip (git-fixes).
- hwmon: tmp512: drop of_match_ptr for ID table (git-fixes).
- hwmon: (ucd90320) Add minimum delay between bus accesses
  (git-fixes).
- hwmon: (ina3221) return prober error code (git-fixes).
- hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove
  due to race condition (git-fixes).
- hwmon: (adt7475) Fix masking of hysteresis registers
  (git-fixes).
- hwmon: (adt7475) Display smoothing attributes in correct order
  (git-fixes).
- media: m5mols: fix off-by-one loop termination error
  (git-fixes).
- nfc: st-nci: Fix use after free bug in ndlc_remove due to race
  condition (git-fixes).
- nfc: pn533: initialize struct pn533_out_arg properly
  (git-fixes).
- mmc: sdhci_am654: lower power-on failed message severity
  (git-fixes).
- ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
  (git-fixes).
- drm/bridge: Fix returned array size name for
  atomic_get_input_bus_fmts kdoc (git-fixes).
- drm/sun4i: fix missing component unbind on bind errors
  (git-fixes).
- drm/meson: fix 1px pink line on GXM when scaling video overlay
  (git-fixes).
- drm/panfrost: Don't sync rpm suspension after mmu flushing
  (git-fixes).
- drm/shmem-helper: Remove another errant put in error path
  (git-fixes).
- clk: HI655X: select REGMAP instead of depending on it
  (git-fixes).
- docs: Correct missing "d_" prefix for dentry_operations member
  d_weak_revalidate (git-fixes).
- drm/amdgpu: fix error checking in amdgpu_read_mm_registers
  for soc15 (git-fixes).
- drm/connector: print max_requested_bpc in state debugfs
  (git-fixes).
- drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype (git-fixes).
- nfc: change order inside nfc_se_io error path (git-fixes).
- regulator: core: Use ktime_get_boottime() to determine how
  long a regulator was off (git-fixes).
- media: rc: gpio-ir-recv: add remove function (git-fixes).
- media: ov5640: Fix analogue gain control (git-fixes).
- PCI: Add SolidRun vendor ID (git-fixes).
- drm/nouveau/kms/nv50-: remove unused functions (git-fixes).
- regulator: core: Fix off-on-delay-us for always-on/boot-on
  regulators (git-fixes).
- regulator: Flag uncontrollable regulators as always_on
  (git-fixes).
- commit fc61e5c</changelog>
  <changelog author="nmorey@suse.com" date="1679313601">- IB/hfi1: Assign npages earlier (git-fixes)
- commit b6b4a13</changelog>
  <changelog author="nmorey@suse.com" date="1679313602">- IB/hfi1: Update RMT size calculation (git-fixes)
- commit 46a7a1c</changelog>
  <changelog author="msuchanek@suse.de" date="1679313603">- supported.conf: Remove duplicate entry.
- commit 2c93f73</changelog>
  <changelog author="lhenriques@suse.de" date="1679313604">- ceph: update the time stamps and try to drop the suid/sgid
  (bsc#1209504).
- commit e7df378</changelog>
  <changelog author="neilb@suse.de" date="1679400000">- Refresh patches.suse/NFSv3-handle-out-of-order-write-replies.patch.
  Careless typo - might cause bsc#1209457
- commit 1d76618</changelog>
  <changelog author="tonyj@suse.de" date="1679400001">- x86/perf/zhaoxin: Add stepping check for ZXC (git fixes).
- perf/x86/intel: Add Emerald Rapids (git fixes).
- perf/x86/intel/uncore: Add Emerald Rapids (git fixes).
- perf/x86/msr: Add Emerald Rapids (git fixes).
- perf/x86/rapl: Treat Tigerlake like Icelake (git fixes).
- perf/core: Call LSM hook after copying perf_event_attr
  (git fixes).
- perf/x86/amd: fix potential integer overflow on shift of a int
  (git fixes).
- perf/x86/intel/uncore: Fix reference count leak in
  __uncore_imc_init_box() (git fixes).
- perf/x86/intel/uncore: Fix reference count leak in
  snr_uncore_mmio_map() (git fixes).
- perf/x86/intel/uncore: Fix reference count leak in
  hswep_has_limit_sbox() (git fixes).
- perf/x86/intel/uncore: Fix reference count leak in
  sad_cfg_iio_topology() (git fixes).
- perf: Fix possible memleak in pmu_dev_alloc() (git fixes).
- bpf, perf: Use subprog name when reporting subprog ksymbol
  (git fixes).
- perf/x86/intel/pt: Fix sampling using single range output
  (git fixes).
- perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes
  (git fixes).
- perf/x86/intel: Fix pebs event constraints for SPR (git fixes).
- perf/x86/intel: Fix pebs event constraints for ICL (git fixes).
- perf/x86/rapl: Use standard Energy Unit for SPR Dram RAPL domain
  (git fixes).
- x86/cpu: Add several Intel server CPU model numbers (git fixes).
- perf/x86/rapl: Add support for Intel AlderLake-N (git fixes).
- perf/x86/intel/lbr: Use setup_clear_cpu_cap() instead of
  clear_cpu_cap() (git fixes).
- perf/x86/uncore: Add new Raptor Lake S support (git fixes).
- x86/cpu: Add CPU model numbers for Meteor Lake (git fixes).
- x86/cpu: Add new Raptor Lake CPU model number (git fixes).
- perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC
  PMU (git fixes).
- perf/x86/intel: Fix pebs event constraints for ADL (git fixes).
- perf/x86/intel/ds: Fix precise store latency handling (git
  fixes).
- perf/x86/lbr: Enable the branch type for the Arch LBR by default
  (git fixes).
- perf/x86/intel: Fix PEBS data source encoding for ADL (git
  fixes).
- perf/x86/intel: Fix PEBS memory access info encoding for ADL
  (git fixes).
- perf/core: Fix data race between perf_event_set_output()
  and perf_mmap_close() (git fixes).
- perf/x86/intel: Fix event constraints for ICL (git fixes).
- perf/x86/uncore: Add new Alder Lake and Raptor Lake support
  (git fixes).
- perf/x86/uncore: Clean up uncore_pci_ids (git fixes).
- perf/amd/ibs: Use interrupt regs ip for stack unwinding
  (git fixes).
- x86/cpu: Add new Alderlake and Raptorlake CPU model numbers
  (git fixes).
- perf/x86/intel: Don't extend the pseudo-encoding to GP counters
  (git fixes).
- perf/core: Inherit event_caps (git fixes).
- perf/x86/uncore: Add Raptor Lake uncore support (git fixes).
- perf/x86/intel/pt: Relax address filter validation (git fixes).
- x86/perf: Default set FREEZE_ON_SMI for all (git fixes).
- perf: Always wake the parent event (git fixes).
- x86/perf: Avoid warning for Arch LBR without XSAVE (git fixes).
- perf/x86/rapl: fix AMD event handling (git fixes).
- x86/cpu: Drop spurious underscore from RAPTOR_LAKE #define
  (git fixes).
- x86/cpu: Add Raptor Lake to Intel family (git fixes).
- commit 74e398e</changelog>
</package>
<package pkgid="3cbb8ca94944958b0818b9d95a14fe15ed9fbec4690b650fa2f8d5e64dc9050d" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.15.18.1"/>
  <changelog author="mkoutny@suse.com" date="1678795200">- blacklist.conf: Add 9df918698408 kernel/panic: move panic sysctls to its own file
- commit 7099ede</changelog>
  <changelog author="mkoutny@suse.com" date="1678795201">- blacklist.conf: Add 9360d035a579 panic: Separate sysctl logic from CONFIG_SMP
- commit 70188a8</changelog>
  <changelog author="mkoutny@suse.com" date="1678795202">- fork: allow CLONE_NEWTIME in clone3 flags (bsc#1209258).
- commit 49f82de</changelog>
  <changelog author="mkoutny@suse.com" date="1678795203">- blacklist.conf: Add cgroup locking optimizations
  be288169712f cgroup: reduce dependency on cgroup_mutex
  671c11f0619e cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree
- commit a274f6f</changelog>
  <changelog author="ddiss@suse.de" date="1678795204">- watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths
  (bsc#1197617).
- commit 34bfa16</changelog>
  <changelog author="mkoutny@suse.com" date="1678795205">- mm: memcg: fix NULL pointer in
  mem_cgroup_track_foreign_dirty_slowpath() (bsc#1209262).
- commit ca9be2b</changelog>
  <changelog author="msuchanek@suse.de" date="1678795206">- Replace mkinitrd dependency with dracut (bsc#1202353).
  Also update mkinitrd refrences in documentation and comments.
- commit e356c9b</changelog>
  <changelog author="msuchanek@suse.de" date="1678795207">- Require suse-kernel-rpm-scriptlets at all times.
  The kernel packages call scriptlets for each stage, add the dependency
  to make it clear to libzypp that the scriptlets are required.
  There is no special dependency for posttrans, these scriptlets run when
  transactions are resolved. The plain dependency has to be used to
  support posttrans.
- commit 56c4dbe</changelog>
  <changelog author="tonyj@suse.de" date="1678795208">- perf/x86/uncore: Don't WARN_ON_ONCE() for a broken discovery
  table (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/uncore: Add a quirk for UPI on SPR (bsc#1206824,
  bsc#1206493, bsc#1206492).
- perf/x86/uncore: Ignore broken units in discovery table
  (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/uncore: Fix potential NULL pointer in
  uncore_get_alias_name (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/uncore: Factor out uncore_device_to_die() (bsc#1206824,
  bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Make set_mapping() procedure void
  (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Update sysfs-devices-mapping file
  (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Enable UPI topology discovery for
  Sapphire Rapids (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Enable UPI topology discovery for
  Icelake Server (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Get UPI NodeID and GroupID (bsc#1206824,
  bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Enable UPI topology discovery for
  Skylake Server (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Generalize get_topology() for SKX PMUs
  (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Disable I/O stacks to PMU mapping on
  ICX-D (bsc#1206824, bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Clear attr_update properly (bsc#1206824,
  bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Introduce UPI topology type (bsc#1206824,
  bsc#1206493, bsc#1206492).
- perf/x86/intel/uncore: Generalize IIO topology support
  (bsc#1206824, bsc#1206493, bsc#1206492).
- commit 23fd14b</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1678968000">- rpm/group-source-files.pl: Fix output difference when / is in location
  While previous attempt to fix group-source-files.pl in 6d651362c38
  "rpm/group-source-files.pl: Deal with {pre,post}fixed / in location"
  breaks the infinite loop, it does not properly address the issue. Having
  prefixed and/or postfixed forward slash still result in different
  output.
  This commit changes the script to use the Perl core module File::Spec
  for proper path manipulation to give consistent output.
- commit 4161bf9</changelog>
  <changelog author="vkarasulli@suse.de" date="1678968001">- Update references in
  patches.suse/media-dvb-usb-az6027-fix-null-ptr-deref-in-az6027_i2.patch
  (git-fixes bsc#1209291 CVE-2023-28328).
- commit dc99e31</changelog>
  <changelog author="tiwai@suse.de" date="1679054400">- hwmon: (k10temp): Add support for new family 17h and 19h models
  (bsc#1208848).
- x86/amd_nb: Add AMD PCI IDs for SMN communication (bsc#1208848).
- commit c3dd9ac</changelog>
  <changelog author="tiwai@suse.de" date="1679054401">- Delete patches.suse/drm-i915-Don-t-use-BAR-mappings-for-ring-buffers-wit.patch
  Resulted in an Oops / hang at boot (bsc#1209436)
- commit 0da96b0</changelog>
  <changelog author="tiwai@suse.de" date="1679313600">- serial: qcom-geni: fix console shutdown hang (git-fixes).
- serial: 8250_fsl: fix handle_irq locking (git-fixes).
- serial: 8250_em: Fix UART port type (git-fixes).
- interconnect: exynos: fix node leak in probe PM QoS error path
  (git-fixes).
- interconnect: fix mem leak when freeing nodes (git-fixes).
- interconnect: qcom: osm-l3: fix icc_onecell_data allocation
  (git-fixes).
- firmware: xilinx: don't make a sleepable memory allocation
  from an atomic context (git-fixes).
- fbdev: omapfb: cleanup inconsistent indentation (git-fixes).
- hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip (git-fixes).
- hwmon: (adm1266) Set `can_sleep` flag for GPIO chip (git-fixes).
- hwmon: tmp512: drop of_match_ptr for ID table (git-fixes).
- hwmon: (ucd90320) Add minimum delay between bus accesses
  (git-fixes).
- hwmon: (ina3221) return prober error code (git-fixes).
- hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove
  due to race condition (git-fixes).
- hwmon: (adt7475) Fix masking of hysteresis registers
  (git-fixes).
- hwmon: (adt7475) Display smoothing attributes in correct order
  (git-fixes).
- media: m5mols: fix off-by-one loop termination error
  (git-fixes).
- nfc: st-nci: Fix use after free bug in ndlc_remove due to race
  condition (git-fixes).
- nfc: pn533: initialize struct pn533_out_arg properly
  (git-fixes).
- mmc: sdhci_am654: lower power-on failed message severity
  (git-fixes).
- ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
  (git-fixes).
- drm/bridge: Fix returned array size name for
  atomic_get_input_bus_fmts kdoc (git-fixes).
- drm/sun4i: fix missing component unbind on bind errors
  (git-fixes).
- drm/meson: fix 1px pink line on GXM when scaling video overlay
  (git-fixes).
- drm/panfrost: Don't sync rpm suspension after mmu flushing
  (git-fixes).
- drm/shmem-helper: Remove another errant put in error path
  (git-fixes).
- clk: HI655X: select REGMAP instead of depending on it
  (git-fixes).
- docs: Correct missing "d_" prefix for dentry_operations member
  d_weak_revalidate (git-fixes).
- drm/amdgpu: fix error checking in amdgpu_read_mm_registers
  for soc15 (git-fixes).
- drm/connector: print max_requested_bpc in state debugfs
  (git-fixes).
- drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype (git-fixes).
- nfc: change order inside nfc_se_io error path (git-fixes).
- regulator: core: Use ktime_get_boottime() to determine how
  long a regulator was off (git-fixes).
- media: rc: gpio-ir-recv: add remove function (git-fixes).
- media: ov5640: Fix analogue gain control (git-fixes).
- PCI: Add SolidRun vendor ID (git-fixes).
- drm/nouveau/kms/nv50-: remove unused functions (git-fixes).
- regulator: core: Fix off-on-delay-us for always-on/boot-on
  regulators (git-fixes).
- regulator: Flag uncontrollable regulators as always_on
  (git-fixes).
- commit fc61e5c</changelog>
  <changelog author="nmorey@suse.com" date="1679313601">- IB/hfi1: Assign npages earlier (git-fixes)
- commit b6b4a13</changelog>
  <changelog author="nmorey@suse.com" date="1679313602">- IB/hfi1: Update RMT size calculation (git-fixes)
- commit 46a7a1c</changelog>
  <changelog author="msuchanek@suse.de" date="1679313603">- supported.conf: Remove duplicate entry.
- commit 2c93f73</changelog>
  <changelog author="lhenriques@suse.de" date="1679313604">- ceph: update the time stamps and try to drop the suid/sgid
  (bsc#1209504).
- commit e7df378</changelog>
  <changelog author="neilb@suse.de" date="1679400000">- Refresh patches.suse/NFSv3-handle-out-of-order-write-replies.patch.
  Careless typo - might cause bsc#1209457
- commit 1d76618</changelog>
  <changelog author="tonyj@suse.de" date="1679400001">- x86/perf/zhaoxin: Add stepping check for ZXC (git fixes).
- perf/x86/intel: Add Emerald Rapids (git fixes).
- perf/x86/intel/uncore: Add Emerald Rapids (git fixes).
- perf/x86/msr: Add Emerald Rapids (git fixes).
- perf/x86/rapl: Treat Tigerlake like Icelake (git fixes).
- perf/core: Call LSM hook after copying perf_event_attr
  (git fixes).
- perf/x86/amd: fix potential integer overflow on shift of a int
  (git fixes).
- perf/x86/intel/uncore: Fix reference count leak in
  __uncore_imc_init_box() (git fixes).
- perf/x86/intel/uncore: Fix reference count leak in
  snr_uncore_mmio_map() (git fixes).
- perf/x86/intel/uncore: Fix reference count leak in
  hswep_has_limit_sbox() (git fixes).
- perf/x86/intel/uncore: Fix reference count leak in
  sad_cfg_iio_topology() (git fixes).
- perf: Fix possible memleak in pmu_dev_alloc() (git fixes).
- bpf, perf: Use subprog name when reporting subprog ksymbol
  (git fixes).
- perf/x86/intel/pt: Fix sampling using single range output
  (git fixes).
- perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes
  (git fixes).
- perf/x86/intel: Fix pebs event constraints for SPR (git fixes).
- perf/x86/intel: Fix pebs event constraints for ICL (git fixes).
- perf/x86/rapl: Use standard Energy Unit for SPR Dram RAPL domain
  (git fixes).
- x86/cpu: Add several Intel server CPU model numbers (git fixes).
- perf/x86/rapl: Add support for Intel AlderLake-N (git fixes).
- perf/x86/intel/lbr: Use setup_clear_cpu_cap() instead of
  clear_cpu_cap() (git fixes).
- perf/x86/uncore: Add new Raptor Lake S support (git fixes).
- x86/cpu: Add CPU model numbers for Meteor Lake (git fixes).
- x86/cpu: Add new Raptor Lake CPU model number (git fixes).
- perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC
  PMU (git fixes).
- perf/x86/intel: Fix pebs event constraints for ADL (git fixes).
- perf/x86/intel/ds: Fix precise store latency handling (git
  fixes).
- perf/x86/lbr: Enable the branch type for the Arch LBR by default
  (git fixes).
- perf/x86/intel: Fix PEBS data source encoding for ADL (git
  fixes).
- perf/x86/intel: Fix PEBS memory access info encoding for ADL
  (git fixes).
- perf/core: Fix data race between perf_event_set_output()
  and perf_mmap_close() (git fixes).
- perf/x86/intel: Fix event constraints for ICL (git fixes).
- perf/x86/uncore: Add new Alder Lake and Raptor Lake support
  (git fixes).
- perf/x86/uncore: Clean up uncore_pci_ids (git fixes).
- perf/amd/ibs: Use interrupt regs ip for stack unwinding
  (git fixes).
- x86/cpu: Add new Alderlake and Raptorlake CPU model numbers
  (git fixes).
- perf/x86/intel: Don't extend the pseudo-encoding to GP counters
  (git fixes).
- perf/core: Inherit event_caps (git fixes).
- perf/x86/uncore: Add Raptor Lake uncore support (git fixes).
- perf/x86/intel/pt: Relax address filter validation (git fixes).
- x86/perf: Default set FREEZE_ON_SMI for all (git fixes).
- perf: Always wake the parent event (git fixes).
- x86/perf: Avoid warning for Arch LBR without XSAVE (git fixes).
- perf/x86/rapl: fix AMD event handling (git fixes).
- x86/cpu: Drop spurious underscore from RAPTOR_LAKE #define
  (git fixes).
- x86/cpu: Add Raptor Lake to Intel family (git fixes).
- commit 74e398e</changelog>
</package>
<package pkgid="18a89f612915a26a2f099dc6f7be0f2afd44271cb629e3e775daf8dbdae3a30b" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.15.5.1"/>
  <changelog author="oneukum@suse.com" date="1670932800">- timers: implement usleep_idle_range() (git-fixes).
- commit 8d5d397</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019200">- tracing/osnoise: Fix duration type (git-fixes).
- commit e223ebb</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019201">- tracing: Add tracing_reset_all_online_cpus_unlocked() function
  (git-fixes).
- commit 1bf2379</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019202">- tracing: Free buffers when a used dynamic event is removed
  (git-fixes).
- commit f5bb197</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019203">- blacklist.conf: module loader cleanup, not a bug fix
- commit 143fbeb</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019204">- module: fix [e_shstrndx].sh_size=0 OOB access (git-fixes).
- commit f0db1f3</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019205">- module: change to print useful messages from
  elf_validity_check() (git-fixes).
- commit cc1513a</changelog>
  <changelog author="oneukum@suse.com" date="1671019206">- dt-bindings: clocks: imx8mp: Add ID for usb suspend clock
  (git-fixes).
- commit c4d1409</changelog>
  <changelog author="oneukum@suse.com" date="1671019207">- can: kvaser_usb: make use of units.h in assignment of frequency
  (git-fixes).
- commit 595fe30</changelog>
  <changelog author="oneukum@suse.com" date="1671019208">- units: Add SI metric prefix definitions (git-fixes).
- commit de9d9f3</changelog>
  <changelog author="oneukum@suse.com" date="1671019209">- units: add the HZ macros (git-fixes).
- commit 3f20d38</changelog>
  <changelog author="oneukum@suse.com" date="1671019210">- kABI: reintroduce a non-inline usleep_range (git-fixes).
- commit 21c3a5e</changelog>
  <changelog author="pmladek@suse.com" date="1671019211">- Update patches.suse/clk-imx-Add-check-for-kcalloc.patch
  (CVE-2022-3114 bsc#1206391 git-fixes).
- commit 064b31b</changelog>
  <changelog author="oneukum@suse.com" date="1671019212">- can: do not increase rx statistics when generating a CAN rx
  error message frame (git-fixes).
- Refresh
  patches.suse/can-kvaser_usb_hydra-do-not-report-txerr-and-rxerr-d.patch.
- Refresh
  patches.suse/can-kvaser_usb_leaf-do-not-report-txerr-and-rxerr-du.patch.
- Refresh
  patches.suse/can-pch_can-do-not-report-txerr-and-rxerr-during-bus.patch.
- commit db678c8</changelog>
  <changelog author="oneukum@suse.com" date="1671019213">- can: do not increase rx_bytes statistics for RTR frames
  (git-fixes).
- commit 5858150</changelog>
  <changelog author="oneukum@suse.com" date="1671019214">- can: m_can: fix typo prescalar -&gt; prescaler (git-fixes).
- commit b0ef074</changelog>
  <changelog author="oneukum@suse.com" date="1671019215">- can: m_can: is_lec_err(): clean up LEC error handling
  (git-fixes).
- commit c7997f5</changelog>
  <changelog author="oneukum@suse.com" date="1671019216">- restore m_can_lec_type (git-fixes).
- commit 785d940</changelog>
  <changelog author="oneukum@suse.com" date="1671105600">- HID: usbhid: Add ALWAYS_POLL quirk for some mice (git-fixes).
- commit 43731f8</changelog>
  <changelog author="oneukum@suse.com" date="1671105601">- padata: Fix list iterator in padata_do_serial() (git-fixes).
- commit 7ce0fe3</changelog>
</package>
<package pkgid="5181f87c8fc54f97826ab536a7029abfd6ed01b75cee47e912b0df913ddc9987" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.15.5.1"/>
  <changelog author="oneukum@suse.com" date="1670932800">- timers: implement usleep_idle_range() (git-fixes).
- commit 8d5d397</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019200">- tracing/osnoise: Fix duration type (git-fixes).
- commit e223ebb</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019201">- tracing: Add tracing_reset_all_online_cpus_unlocked() function
  (git-fixes).
- commit 1bf2379</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019202">- tracing: Free buffers when a used dynamic event is removed
  (git-fixes).
- commit f5bb197</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019203">- blacklist.conf: module loader cleanup, not a bug fix
- commit 143fbeb</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019204">- module: fix [e_shstrndx].sh_size=0 OOB access (git-fixes).
- commit f0db1f3</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019205">- module: change to print useful messages from
  elf_validity_check() (git-fixes).
- commit cc1513a</changelog>
  <changelog author="oneukum@suse.com" date="1671019206">- dt-bindings: clocks: imx8mp: Add ID for usb suspend clock
  (git-fixes).
- commit c4d1409</changelog>
  <changelog author="oneukum@suse.com" date="1671019207">- can: kvaser_usb: make use of units.h in assignment of frequency
  (git-fixes).
- commit 595fe30</changelog>
  <changelog author="oneukum@suse.com" date="1671019208">- units: Add SI metric prefix definitions (git-fixes).
- commit de9d9f3</changelog>
  <changelog author="oneukum@suse.com" date="1671019209">- units: add the HZ macros (git-fixes).
- commit 3f20d38</changelog>
  <changelog author="oneukum@suse.com" date="1671019210">- kABI: reintroduce a non-inline usleep_range (git-fixes).
- commit 21c3a5e</changelog>
  <changelog author="pmladek@suse.com" date="1671019211">- Update patches.suse/clk-imx-Add-check-for-kcalloc.patch
  (CVE-2022-3114 bsc#1206391 git-fixes).
- commit 064b31b</changelog>
  <changelog author="oneukum@suse.com" date="1671019212">- can: do not increase rx statistics when generating a CAN rx
  error message frame (git-fixes).
- Refresh
  patches.suse/can-kvaser_usb_hydra-do-not-report-txerr-and-rxerr-d.patch.
- Refresh
  patches.suse/can-kvaser_usb_leaf-do-not-report-txerr-and-rxerr-du.patch.
- Refresh
  patches.suse/can-pch_can-do-not-report-txerr-and-rxerr-during-bus.patch.
- commit db678c8</changelog>
  <changelog author="oneukum@suse.com" date="1671019213">- can: do not increase rx_bytes statistics for RTR frames
  (git-fixes).
- commit 5858150</changelog>
  <changelog author="oneukum@suse.com" date="1671019214">- can: m_can: fix typo prescalar -&gt; prescaler (git-fixes).
- commit b0ef074</changelog>
  <changelog author="oneukum@suse.com" date="1671019215">- can: m_can: is_lec_err(): clean up LEC error handling
  (git-fixes).
- commit c7997f5</changelog>
  <changelog author="oneukum@suse.com" date="1671019216">- restore m_can_lec_type (git-fixes).
- commit 785d940</changelog>
  <changelog author="oneukum@suse.com" date="1671105600">- HID: usbhid: Add ALWAYS_POLL quirk for some mice (git-fixes).
- commit 43731f8</changelog>
  <changelog author="oneukum@suse.com" date="1671105601">- padata: Fix list iterator in padata_do_serial() (git-fixes).
- commit 7ce0fe3</changelog>
</package>
<package pkgid="5864bafdaa7291ec2e3597e3a69b64e44709a87d69e3a62ae1a64bacb5a322f4" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.14.21" rel="150400.15.8.1"/>
  <changelog author="oneukum@suse.com" date="1673438400">- blacklist.conf: misattributed, we do not have this bug
- commit bc3473d</changelog>
  <changelog author="oneukum@suse.com" date="1673438401">- blacklist.conf: too risky
- commit 51ffe7a</changelog>
  <changelog author="oneukum@suse.com" date="1673438402">- blacklist.conf: misattributed
- commit ee5f25a</changelog>
  <changelog author="msuchanek@suse.de" date="1673438403">- powerpc: Take in account addition CPU node when building kexec
  FDT (bsc#1207016 ltc#201108).
- powerpc: export the CPU node count (bsc#1207016 ltc#201108).
- commit 4ca3eba</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1673438404">- Refresh
  patches.suse/octeontx2-Move-devlink-registration-to-be-last-devli.patch.
  Added missing hunk in backport.
- commit 9b34e71</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673438405">- cpufreq: ACPI: Defer setting boost MSRs (bsc#1205485).
- commit 32f938b</changelog>
  <changelog author="msuchanek@suse.de" date="1673438406">- ibmveth: Always stop tx queues during close (bsc#1065729).
- commit 11e0f4a</changelog>
  <changelog author="lduncan@suse.com" date="1673438407">- blacklist.conf: add two drbd git-fixes to ignore
- commit d03d927</changelog>
  <changelog author="oneukum@suse.com" date="1673438408">- Update
  patches.suse/dmaengine-idxd-Fix-crc_val-field-for-completion-reco.patch
  (bsc#1206554).
  Added bugzilla number
- commit 1fe5012</changelog>
  <changelog author="lduncan@suse.com" date="1673438409">- drbd: destroy workqueue when drbd device was freed (git-fixes).
- drbd: remove call to memset before free
  device/resource/connection (git-fixes).
- drbd: use after free in drbd_create_device() (git-fixes).
- drbd: set QUEUE_FLAG_STABLE_WRITES (git-fixes).
- drbd: remove usage of list iterator variable after loop
  (git-fixes).
- commit 26591d7</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524800">- cpufreq: ACPI: Remove unused variables 'acpi_cpufreq_online'
  and 'ret' (bsc#1205485).
- commit bac712b</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524801">- cpufreq: ACPI: Only set boost MSRs on supported CPUs
  (bsc#1205485).
- commit 2fc91f1</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524802">- cpufreq: intel_pstate: Add Sapphire Rapids support in no-HWP
  mode (bsc#1201068).
- commit 15e54a9</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1673524803">- octeontx2-pf: Fix lmtst ID used in aura free (jsc#SLE-24682).
- octeontx2-af: Allow mkex profile without DMAC and add L2M/L2B
  header extraction support (jsc#SLE-24682).
- octeontx2-pf: Fix pfc_alloc_status array overflow
  (jsc#SLE-24682).
- octeontx2-pf: Fix SQE threshold checking (jsc#SLE-24682).
- octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT]
  (jsc#SLE-24682).
- octeontx2-pf: Fix unused variable build error (jsc#SLE-24682).
- octeontx2-af: Initialize PTP_SEC_ROLLOVER register properly
  (jsc#SLE-24682).
- octeontx2-af: Add PTP PPS Errata workaround on CN10K silicon
  (jsc#SLE-24682).
- octeontx2-pf: Add support for ptp 1-step mode on CN10K silicon
  (jsc#SLE-24682).
- octeontx2-af: return correct ptp timestamp for CN10K silicon
  (jsc#SLE-24682).
- octeontx2-pf: Add egress PFC support (jsc#SLE-24682).
- octeontx2-pf: Reduce minimum mtu size to 60 (jsc#SLE-24682).
- octeontx2-af: Set NIX link credits based on max LMAC
  (jsc#SLE-24682).
- octeontx2-af: Limit link bringup time at firmware
  (jsc#SLE-24682).
- octeontx2-af: Skip CGX/RPM probe incase of zero lmac count
  (jsc#SLE-24682).
- octeontx2: Modify mbox request and response structures
  (jsc#SLE-24682).
- octeontx2-af: Don't reset previous pfc config (jsc#SLE-24682).
- octeontx2-af: fix operand size in bitwise operation
  (jsc#SLE-24682).
- commit a2de709</changelog>
  <changelog author="krisman@suse.de" date="1673524804">- arm64: Avoid repeated AA64MMFR1_EL1 register read on pagefault
  path (performance bsc#1203219).
- commit 82bc0ed</changelog>
  <changelog author="oneukum@suse.com" date="1673611200">- media: stv0288: use explicitly signed char (git-fixes).
- commit 72af28b</changelog>
  <changelog author="tiwai@suse.de" date="1673611201">- nfc: pn533: Wait for out_urb's completion in
  pn533_usb_send_frame() (git-fixes).
- ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude
  laptops (git-fixes).
- ALSA: line6: fix stack overflow in line6_midi_transmit
  (git-fixes).
- ALSA: line6: correct midi status byte when receiving data from
  podxt (git-fixes).
- ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071
  tablet (git-fixes).
- drm/amdgpu: handle polaris10/11 overlap asics (v2) (git-fixes).
- drm/amdgpu: make display pinning more flexible (v2) (git-fixes).
- HID: plantronics: Additional PIDs for double volume key presses
  quirk (git-fixes).
- HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
  (git-fixes).
- remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
  (git-fixes).
- soundwire: dmi-quirks: add quirk variant for LAPBC710 NUC15
  (git-fixes).
- PCI: Fix pci_device_is_present() for VFs by checking PF
  (git-fixes).
- wifi: wilc1000: sdio: fix module autoloading (git-fixes).
- ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
  (git-fixes).
- ima: Fix a potential NULL pointer access in
  ima_restore_measurement_list (git-fixes).
- ipmi: fix long wait in unload when IPMI disconnect (git-fixes).
- drm/connector: send hotplug uevent on connector cleanup
  (git-fixes).
- ALSA: patch_realtek: Fix Dell Inspiron Plus 16 (git-fixes).
- selftests: Use optional USERCFLAGS and USERLDFLAGS (git-fixes).
- ACPI: resource: Skip IRQ override on Asus Vivobook
  K3402ZA/K3502ZA (git-fixes).
- selftests: set the BUILD variable to absolute path (git-fixes).
- drm/i915/migrate: fix length calculation (git-fixes).
- drm/i915/migrate: fix offset calculation (git-fixes).
- drm/i915/migrate: don't check the scratch page (git-fixes).
- commit 1d4442d</changelog>
  <changelog author="msuchanek@suse.de" date="1673611202">- powerpc/rtas: avoid scheduling in rtas_os_term() (bsc#1065729).
- powerpc/rtas: avoid device tree lookups in rtas_os_term()
  (bsc#1065729).
- commit 49b518d</changelog>
  <changelog author="tiwai@suse.de" date="1673697600">- efi: fix userspace infinite retry read efivars after EFI
  runtime services page fault (git-fixes).
- ASoC: qcom: lpass-cpu: Fix fallback SD line index handling
  (git-fixes).
- ASoC: wm8904: fix wrong outputs volume after power reactivation
  (git-fixes).
- ALSA: control-led: use strscpy in set_led_id() (git-fixes).
- ALSA: hda: cs35l41: Check runtime suspend capability at
  runtime_idle (git-fixes).
- ALSA: hda: cs35l41: Don't return -EINVAL from system
  suspend/resume (git-fixes).
- ALSA: usb-audio: Relax hw constraints for implicit fb sync
  (git-fixes).
- ALSA: usb-audio: Make sure to stop endpoints before closing EPs
  (git-fixes).
- platform/x86: dell-privacy: Only register SW_CAMERA_LENS_COVER
  if present (git-fixes).
- platform/x86: dell-privacy: Fix SW_CAMERA_LENS_COVER reporting
  (git-fixes).
- platform/surface: aggregator: Add missing call to
  ssam_request_sync_free() (git-fixes).
- platform/surface: aggregator: Ignore command messages not
  intended for us (git-fixes).
- platform/x86: sony-laptop: Don't turn off 0x153 keyboard
  backlight during probe (git-fixes).
- drm/msm/adreno: Make adreno quirks not overwrite each other
  (git-fixes).
- drm/msm: another fix for the headless Adreno GPU (git-fixes).
- dt-bindings: msm: dsi-controller-main: Fix description of core
  clock (git-fixes).
- dt-bindings: msm: dsi-controller-main: Fix operating-points-v2
  constraint (git-fixes).
- dt-bindings: msm: dsi-phy-28nm: Add missing qcom,
  dsi-phy-regulator-ldo-mode (git-fixes).
- drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is
  not for aux transfer (git-fixes).
- dt-bindings: msm/dsi: Don't require vdds-supply on 10nm PHY
  (git-fixes).
- dt-bindings: msm/dsi: Don't require vcca-supply on 14nm PHY
  (git-fixes).
- drm/virtio: Fix GEM handle creation UAF (git-fixes).
- commit 127798d</changelog>
  <changelog author="tiwai@suse.de" date="1673697601">- ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent
  UAF (git-fixes).
- ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360
  13-aw0xxx (git-fixes).
- ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list
  (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs don't work for a HP
  platform (git-fixes).
- ALSA: hda - Enable headset mic on another Dell laptop with
  ALC3254 (git-fixes).
- ALSA: hda/realtek - Turn on power early (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
  (git-fixes).
- commit ffbf830</changelog>
</package>
<package pkgid="3631b78aca100c30429db9db8267b937cfed06a1546556175c70781a6fc69303" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150400.15.8.1"/>
  <changelog author="oneukum@suse.com" date="1673438400">- blacklist.conf: misattributed, we do not have this bug
- commit bc3473d</changelog>
  <changelog author="oneukum@suse.com" date="1673438401">- blacklist.conf: too risky
- commit 51ffe7a</changelog>
  <changelog author="oneukum@suse.com" date="1673438402">- blacklist.conf: misattributed
- commit ee5f25a</changelog>
  <changelog author="msuchanek@suse.de" date="1673438403">- powerpc: Take in account addition CPU node when building kexec
  FDT (bsc#1207016 ltc#201108).
- powerpc: export the CPU node count (bsc#1207016 ltc#201108).
- commit 4ca3eba</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1673438404">- Refresh
  patches.suse/octeontx2-Move-devlink-registration-to-be-last-devli.patch.
  Added missing hunk in backport.
- commit 9b34e71</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673438405">- cpufreq: ACPI: Defer setting boost MSRs (bsc#1205485).
- commit 32f938b</changelog>
  <changelog author="msuchanek@suse.de" date="1673438406">- ibmveth: Always stop tx queues during close (bsc#1065729).
- commit 11e0f4a</changelog>
  <changelog author="lduncan@suse.com" date="1673438407">- blacklist.conf: add two drbd git-fixes to ignore
- commit d03d927</changelog>
  <changelog author="oneukum@suse.com" date="1673438408">- Update
  patches.suse/dmaengine-idxd-Fix-crc_val-field-for-completion-reco.patch
  (bsc#1206554).
  Added bugzilla number
- commit 1fe5012</changelog>
  <changelog author="lduncan@suse.com" date="1673438409">- drbd: destroy workqueue when drbd device was freed (git-fixes).
- drbd: remove call to memset before free
  device/resource/connection (git-fixes).
- drbd: use after free in drbd_create_device() (git-fixes).
- drbd: set QUEUE_FLAG_STABLE_WRITES (git-fixes).
- drbd: remove usage of list iterator variable after loop
  (git-fixes).
- commit 26591d7</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524800">- cpufreq: ACPI: Remove unused variables 'acpi_cpufreq_online'
  and 'ret' (bsc#1205485).
- commit bac712b</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524801">- cpufreq: ACPI: Only set boost MSRs on supported CPUs
  (bsc#1205485).
- commit 2fc91f1</changelog>
  <changelog author="ggherdovich@suse.cz" date="1673524802">- cpufreq: intel_pstate: Add Sapphire Rapids support in no-HWP
  mode (bsc#1201068).
- commit 15e54a9</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1673524803">- octeontx2-pf: Fix lmtst ID used in aura free (jsc#SLE-24682).
- octeontx2-af: Allow mkex profile without DMAC and add L2M/L2B
  header extraction support (jsc#SLE-24682).
- octeontx2-pf: Fix pfc_alloc_status array overflow
  (jsc#SLE-24682).
- octeontx2-pf: Fix SQE threshold checking (jsc#SLE-24682).
- octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT]
  (jsc#SLE-24682).
- octeontx2-pf: Fix unused variable build error (jsc#SLE-24682).
- octeontx2-af: Initialize PTP_SEC_ROLLOVER register properly
  (jsc#SLE-24682).
- octeontx2-af: Add PTP PPS Errata workaround on CN10K silicon
  (jsc#SLE-24682).
- octeontx2-pf: Add support for ptp 1-step mode on CN10K silicon
  (jsc#SLE-24682).
- octeontx2-af: return correct ptp timestamp for CN10K silicon
  (jsc#SLE-24682).
- octeontx2-pf: Add egress PFC support (jsc#SLE-24682).
- octeontx2-pf: Reduce minimum mtu size to 60 (jsc#SLE-24682).
- octeontx2-af: Set NIX link credits based on max LMAC
  (jsc#SLE-24682).
- octeontx2-af: Limit link bringup time at firmware
  (jsc#SLE-24682).
- octeontx2-af: Skip CGX/RPM probe incase of zero lmac count
  (jsc#SLE-24682).
- octeontx2: Modify mbox request and response structures
  (jsc#SLE-24682).
- octeontx2-af: Don't reset previous pfc config (jsc#SLE-24682).
- octeontx2-af: fix operand size in bitwise operation
  (jsc#SLE-24682).
- commit a2de709</changelog>
  <changelog author="krisman@suse.de" date="1673524804">- arm64: Avoid repeated AA64MMFR1_EL1 register read on pagefault
  path (performance bsc#1203219).
- commit 82bc0ed</changelog>
  <changelog author="oneukum@suse.com" date="1673611200">- media: stv0288: use explicitly signed char (git-fixes).
- commit 72af28b</changelog>
  <changelog author="tiwai@suse.de" date="1673611201">- nfc: pn533: Wait for out_urb's completion in
  pn533_usb_send_frame() (git-fixes).
- ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude
  laptops (git-fixes).
- ALSA: line6: fix stack overflow in line6_midi_transmit
  (git-fixes).
- ALSA: line6: correct midi status byte when receiving data from
  podxt (git-fixes).
- ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071
  tablet (git-fixes).
- drm/amdgpu: handle polaris10/11 overlap asics (v2) (git-fixes).
- drm/amdgpu: make display pinning more flexible (v2) (git-fixes).
- HID: plantronics: Additional PIDs for double volume key presses
  quirk (git-fixes).
- HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
  (git-fixes).
- remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
  (git-fixes).
- soundwire: dmi-quirks: add quirk variant for LAPBC710 NUC15
  (git-fixes).
- PCI: Fix pci_device_is_present() for VFs by checking PF
  (git-fixes).
- wifi: wilc1000: sdio: fix module autoloading (git-fixes).
- ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
  (git-fixes).
- ima: Fix a potential NULL pointer access in
  ima_restore_measurement_list (git-fixes).
- ipmi: fix long wait in unload when IPMI disconnect (git-fixes).
- drm/connector: send hotplug uevent on connector cleanup
  (git-fixes).
- ALSA: patch_realtek: Fix Dell Inspiron Plus 16 (git-fixes).
- selftests: Use optional USERCFLAGS and USERLDFLAGS (git-fixes).
- ACPI: resource: Skip IRQ override on Asus Vivobook
  K3402ZA/K3502ZA (git-fixes).
- selftests: set the BUILD variable to absolute path (git-fixes).
- drm/i915/migrate: fix length calculation (git-fixes).
- drm/i915/migrate: fix offset calculation (git-fixes).
- drm/i915/migrate: don't check the scratch page (git-fixes).
- commit 1d4442d</changelog>
  <changelog author="msuchanek@suse.de" date="1673611202">- powerpc/rtas: avoid scheduling in rtas_os_term() (bsc#1065729).
- powerpc/rtas: avoid device tree lookups in rtas_os_term()
  (bsc#1065729).
- commit 49b518d</changelog>
  <changelog author="tiwai@suse.de" date="1673697600">- efi: fix userspace infinite retry read efivars after EFI
  runtime services page fault (git-fixes).
- ASoC: qcom: lpass-cpu: Fix fallback SD line index handling
  (git-fixes).
- ASoC: wm8904: fix wrong outputs volume after power reactivation
  (git-fixes).
- ALSA: control-led: use strscpy in set_led_id() (git-fixes).
- ALSA: hda: cs35l41: Check runtime suspend capability at
  runtime_idle (git-fixes).
- ALSA: hda: cs35l41: Don't return -EINVAL from system
  suspend/resume (git-fixes).
- ALSA: usb-audio: Relax hw constraints for implicit fb sync
  (git-fixes).
- ALSA: usb-audio: Make sure to stop endpoints before closing EPs
  (git-fixes).
- platform/x86: dell-privacy: Only register SW_CAMERA_LENS_COVER
  if present (git-fixes).
- platform/x86: dell-privacy: Fix SW_CAMERA_LENS_COVER reporting
  (git-fixes).
- platform/surface: aggregator: Add missing call to
  ssam_request_sync_free() (git-fixes).
- platform/surface: aggregator: Ignore command messages not
  intended for us (git-fixes).
- platform/x86: sony-laptop: Don't turn off 0x153 keyboard
  backlight during probe (git-fixes).
- drm/msm/adreno: Make adreno quirks not overwrite each other
  (git-fixes).
- drm/msm: another fix for the headless Adreno GPU (git-fixes).
- dt-bindings: msm: dsi-controller-main: Fix description of core
  clock (git-fixes).
- dt-bindings: msm: dsi-controller-main: Fix operating-points-v2
  constraint (git-fixes).
- dt-bindings: msm: dsi-phy-28nm: Add missing qcom,
  dsi-phy-regulator-ldo-mode (git-fixes).
- drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is
  not for aux transfer (git-fixes).
- dt-bindings: msm/dsi: Don't require vdds-supply on 10nm PHY
  (git-fixes).
- dt-bindings: msm/dsi: Don't require vcca-supply on 14nm PHY
  (git-fixes).
- drm/virtio: Fix GEM handle creation UAF (git-fixes).
- commit 127798d</changelog>
  <changelog author="tiwai@suse.de" date="1673697601">- ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent
  UAF (git-fixes).
- ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360
  13-aw0xxx (git-fixes).
- ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list
  (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs don't work for a HP
  platform (git-fixes).
- ALSA: hda - Enable headset mic on another Dell laptop with
  ALC3254 (git-fixes).
- ALSA: hda/realtek - Turn on power early (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook
  (git-fixes).
- commit ffbf830</changelog>
</package>
<package pkgid="c441845380bec5b1c8c444035f4bec93321c06ada98fcf44f9883cfaf42d2b46" name="kexec-tools" arch="aarch64">
  <version epoch="0" ver="2.0.20" rel="150400.16.3.1"/>
  <changelog author="ptesarik@suse.com" date="1519387200">- kexec-tools-ppc64-parse-ibm-dynamic-memory.patch: kexec/ppc64:
  add support to parse ibm, dynamic-memory-v2 property
  (bsc#1081789, LTC#164625).
- kexec-tools-add-a-helper-function-to-add-ranges.patch: kexec: add
  a helper function to add ranges (bsc#1081789, LTC#164625).</changelog>
  <changelog author="msuchanek@suse.com" date="1522756800">- kexec: add -a option to fall back to KEXEC_LOAD when KEXEC_FILE_LOAD is not
  supported (bsc#1080916, boo#1076839).
  * kexec-tools-Return-ENOSYS-when-kexec-does-not-know.patch
  * kexec-tools-Fix-option-checks-to-take-KEXEC_FILE_LOAD.patch
  * kexec-tools-Do-not-special-case-the-s-option.patch
  * kexec-tools-Add-option-to-revert-s.patch
  * kexec-tools-Add-option-to-fall-back-to-KEXEC_LOAD.patch
  * kexec-tools-Document-s-c-and-a-options-in-the-man-page.patch
- kexec-tools-ppc64-leverage-kexec_file_load-support.patch: kexec/ppc64:
  leverage kexec_file_load support (bsc#1080916).</changelog>
  <changelog author="ptesarik@suse.com" date="1522929600">- kexec-tools-fix-kexec-p-segfault.patch: Fix a segmentation fault
  when trying to run "kexec -p" (bsc#1080916).</changelog>
  <changelog author="ptesarik@suse.com" date="1522929601">- kexec-tools-vmcoreinfo-in-xen.patch: Revert "kexec-tools: Read
  always one vmcoreinfo file" (bsc#1085626, bsc#951740).</changelog>
  <changelog author="ptesarik@suse.com" date="1524139200">- Bump to version 2.0.17
  Changelog: http://git.kernel.org/cgit/utils/kernel/kexec/kexec-tools.git/log/?id=refs/tags/v2.0.16..v2.0.17
- Drop kexec-tools-xen-static.patch: upstream uses run-time dynamic
  linking to address the same issue.
- Drop all patches from upstream git:
  * kexec-tools-add-a-helper-function-to-add-ranges.patch
  * kexec-tools-ppc64-parse-ibm-dynamic-memory.patch
  * kexec-tools-ppc64-leverage-kexec_file_load-support.patch
  * kexec-tools-Return-ENOSYS-when-kexec-does-not-know.patch
  * kexec-tools-Fix-option-checks-to-take-KEXEC_FILE_LOAD.patch
  * kexec-tools-Do-not-special-case-the-s-option.patch
  * kexec-tools-Add-option-to-revert-s.patch
  * kexec-tools-Add-option-to-fall-back-to-KEXEC_LOAD.patch
  * kexec-tools-Document-s-c-and-a-options-in-the-man-page.patch
  * kexec-tools-fix-kexec-p-segfault.patch</changelog>
  <changelog author="aplanas@suse.com" date="1536580800">- kexec-tools-fix-for-Unhandled-rela-relocation-R_X86_64_PLT32.patch
  Upstream backport.
  In response to a change in binutils, commit b21ebf2fb4c
  (x86: Treat R_X86_64_PLT32 as R_X86_64_PC32) was applied to
  the linux kernel during the 4.16 development cycle and has
  since been backported to earlier stable kernel series. The
  change results in the failure message in $SUBJECT when
  rebooting via kexec.
  Fix this by replicating the change in kexec.</changelog>
  <changelog author="ptesarik@suse.com" date="1541073600">- Bump to version 2.0.18
  Changelog: http://git.kernel.org/cgit/utils/kernel/kexec/kexec-tools.git/log/?id=refs/tags/v2.0.17..v2.0.18
- Drop patches from upstream git:
  * kexec-tools-fix-for-Unhandled-rela-relocation-R_X86_64_PLT32.patch
- Remove the confusing kdump binary (no longer in upstream).</changelog>
  <changelog author="ptesarik@suse.com" date="1541073601">- Remove bogus Url RPM tag: The project does not have a home page.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="ptesarik@suse.com" date="1560513600">- Bump to version 2.0.19
  Changelog: http://git.kernel.org/cgit/utils/kernel/kexec/kexec-tools.git/log/?id=refs/tags/v2.0.18..v2.0.19</changelog>
  <changelog author="clin@suse.com" date="1576497600">- Bump to version 2.0.20
  Changelog: https://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git/log/?id=refs/tags/v2.0.19..v2.0.20
- Backport a upstream patch series: [jsc#SLE-9032]
  Subject: [PATCH v2 0/3] arm64: handle "reserved" entries in /proc/iomem
  * kexec-tools-add-variant-helper-functions.patch
  * kexec-tools-arm64-kexec-allocate-memory-space-avoiding-reserved-regions.patch
  * kexec-tools-arm64-kdump-deal-with-resource-entries-in-proc-iomem.patch</changelog>
  <changelog author="clin@suse.com" date="1578657600">- Fix compiling errors of multiboot2_x86_* functions for i586
  * kexec-tools-build-multiboot2-for-i386.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1580299200">- Fix build errors on old distributions
  * kexec-tools-video-capability.patch
  * kexec-tools-SYS_getrandom.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1584100800">- kexec-tools-fix-kexec_file_load-error-handling.patch: Fix the
  error handling if kexec_file_load() fails (bsc#1166105).</changelog>
  <changelog author="ptesarik@suse.com" date="1584100801">- kexec-tools-reset-getopt-before-falling-back-to-legacy.patch:
  Reset getopt before falling back to legacy syscall (bsc#1166105).</changelog>
  <changelog author="ptesarik@suse.com" date="1585915200">- kexec-tools-s390-Reset-kernel-command-line-on-syscal.patch: s390:
  Reset kernel command line on syscall fallback (bsc#1167868).</changelog>
  <changelog author="ohering@suse.com" date="1605009600">- Remove kexec-tools-xen-balloon-up.patch (bsc#1176606,
  bsc#1174508)
  This patch was introduced to address bsc#694863; it enabled kexec
  for HVM at that time. Meanwhile Xen 4.7 introduced "soft-reset"
  for HVM domUs. This host feature removes the requirement to
  un-ballon the domU prior kexec.
  With Xen 4.13 cpuid faulting became the default, which affects
  the approach used in this patch to detect the domU type. As a
  result, invoking kexec in dom0 failed.</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1618920000">- Hardening: Link as PIE (bsc#1185020).</changelog>
  <changelog author="ptesarik@suse.com" date="1649851200">- kexec-tools-print-error-if-kexec_file_load-fails.patch: print
  error if kexec_file_load fails (bsc#1197176).</changelog>
  <changelog author="mbrugger@suse.com" date="1677153600">- kexec-tools-ppc64-remove-rma_top-limit.patch: remove ram_top
  restriction (bsc#1203410)</changelog>
</package>
<package pkgid="6b4081c1a410b956a89ff1f79b8a436e1464f18280d384d3430ea88c544d3661" name="kexec-tools" arch="src">
  <version epoch="0" ver="2.0.20" rel="150400.16.3.1"/>
  <changelog author="ptesarik@suse.com" date="1519387200">- kexec-tools-ppc64-parse-ibm-dynamic-memory.patch: kexec/ppc64:
  add support to parse ibm, dynamic-memory-v2 property
  (bsc#1081789, LTC#164625).
- kexec-tools-add-a-helper-function-to-add-ranges.patch: kexec: add
  a helper function to add ranges (bsc#1081789, LTC#164625).</changelog>
  <changelog author="msuchanek@suse.com" date="1522756800">- kexec: add -a option to fall back to KEXEC_LOAD when KEXEC_FILE_LOAD is not
  supported (bsc#1080916, boo#1076839).
  * kexec-tools-Return-ENOSYS-when-kexec-does-not-know.patch
  * kexec-tools-Fix-option-checks-to-take-KEXEC_FILE_LOAD.patch
  * kexec-tools-Do-not-special-case-the-s-option.patch
  * kexec-tools-Add-option-to-revert-s.patch
  * kexec-tools-Add-option-to-fall-back-to-KEXEC_LOAD.patch
  * kexec-tools-Document-s-c-and-a-options-in-the-man-page.patch
- kexec-tools-ppc64-leverage-kexec_file_load-support.patch: kexec/ppc64:
  leverage kexec_file_load support (bsc#1080916).</changelog>
  <changelog author="ptesarik@suse.com" date="1522929600">- kexec-tools-fix-kexec-p-segfault.patch: Fix a segmentation fault
  when trying to run "kexec -p" (bsc#1080916).</changelog>
  <changelog author="ptesarik@suse.com" date="1522929601">- kexec-tools-vmcoreinfo-in-xen.patch: Revert "kexec-tools: Read
  always one vmcoreinfo file" (bsc#1085626, bsc#951740).</changelog>
  <changelog author="ptesarik@suse.com" date="1524139200">- Bump to version 2.0.17
  Changelog: http://git.kernel.org/cgit/utils/kernel/kexec/kexec-tools.git/log/?id=refs/tags/v2.0.16..v2.0.17
- Drop kexec-tools-xen-static.patch: upstream uses run-time dynamic
  linking to address the same issue.
- Drop all patches from upstream git:
  * kexec-tools-add-a-helper-function-to-add-ranges.patch
  * kexec-tools-ppc64-parse-ibm-dynamic-memory.patch
  * kexec-tools-ppc64-leverage-kexec_file_load-support.patch
  * kexec-tools-Return-ENOSYS-when-kexec-does-not-know.patch
  * kexec-tools-Fix-option-checks-to-take-KEXEC_FILE_LOAD.patch
  * kexec-tools-Do-not-special-case-the-s-option.patch
  * kexec-tools-Add-option-to-revert-s.patch
  * kexec-tools-Add-option-to-fall-back-to-KEXEC_LOAD.patch
  * kexec-tools-Document-s-c-and-a-options-in-the-man-page.patch
  * kexec-tools-fix-kexec-p-segfault.patch</changelog>
  <changelog author="aplanas@suse.com" date="1536580800">- kexec-tools-fix-for-Unhandled-rela-relocation-R_X86_64_PLT32.patch
  Upstream backport.
  In response to a change in binutils, commit b21ebf2fb4c
  (x86: Treat R_X86_64_PLT32 as R_X86_64_PC32) was applied to
  the linux kernel during the 4.16 development cycle and has
  since been backported to earlier stable kernel series. The
  change results in the failure message in $SUBJECT when
  rebooting via kexec.
  Fix this by replicating the change in kexec.</changelog>
  <changelog author="ptesarik@suse.com" date="1541073600">- Bump to version 2.0.18
  Changelog: http://git.kernel.org/cgit/utils/kernel/kexec/kexec-tools.git/log/?id=refs/tags/v2.0.17..v2.0.18
- Drop patches from upstream git:
  * kexec-tools-fix-for-Unhandled-rela-relocation-R_X86_64_PLT32.patch
- Remove the confusing kdump binary (no longer in upstream).</changelog>
  <changelog author="ptesarik@suse.com" date="1541073601">- Remove bogus Url RPM tag: The project does not have a home page.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="ptesarik@suse.com" date="1560513600">- Bump to version 2.0.19
  Changelog: http://git.kernel.org/cgit/utils/kernel/kexec/kexec-tools.git/log/?id=refs/tags/v2.0.18..v2.0.19</changelog>
  <changelog author="clin@suse.com" date="1576497600">- Bump to version 2.0.20
  Changelog: https://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git/log/?id=refs/tags/v2.0.19..v2.0.20
- Backport a upstream patch series: [jsc#SLE-9032]
  Subject: [PATCH v2 0/3] arm64: handle "reserved" entries in /proc/iomem
  * kexec-tools-add-variant-helper-functions.patch
  * kexec-tools-arm64-kexec-allocate-memory-space-avoiding-reserved-regions.patch
  * kexec-tools-arm64-kdump-deal-with-resource-entries-in-proc-iomem.patch</changelog>
  <changelog author="clin@suse.com" date="1578657600">- Fix compiling errors of multiboot2_x86_* functions for i586
  * kexec-tools-build-multiboot2-for-i386.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1580299200">- Fix build errors on old distributions
  * kexec-tools-video-capability.patch
  * kexec-tools-SYS_getrandom.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1584100800">- kexec-tools-fix-kexec_file_load-error-handling.patch: Fix the
  error handling if kexec_file_load() fails (bsc#1166105).</changelog>
  <changelog author="ptesarik@suse.com" date="1584100801">- kexec-tools-reset-getopt-before-falling-back-to-legacy.patch:
  Reset getopt before falling back to legacy syscall (bsc#1166105).</changelog>
  <changelog author="ptesarik@suse.com" date="1585915200">- kexec-tools-s390-Reset-kernel-command-line-on-syscal.patch: s390:
  Reset kernel command line on syscall fallback (bsc#1167868).</changelog>
  <changelog author="ohering@suse.com" date="1605009600">- Remove kexec-tools-xen-balloon-up.patch (bsc#1176606,
  bsc#1174508)
  This patch was introduced to address bsc#694863; it enabled kexec
  for HVM at that time. Meanwhile Xen 4.7 introduced "soft-reset"
  for HVM domUs. This host feature removes the requirement to
  un-ballon the domU prior kexec.
  With Xen 4.13 cpuid faulting became the default, which affects
  the approach used in this patch to detect the domU type. As a
  result, invoking kexec in dom0 failed.</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1618920000">- Hardening: Link as PIE (bsc#1185020).</changelog>
  <changelog author="ptesarik@suse.com" date="1649851200">- kexec-tools-print-error-if-kexec_file_load-fails.patch: print
  error if kexec_file_load fails (bsc#1197176).</changelog>
  <changelog author="mbrugger@suse.com" date="1677153600">- kexec-tools-ppc64-remove-rma_top-limit.patch: remove ram_top
  restriction (bsc#1203410)</changelog>
</package>
<package pkgid="8aefe23617450bee64c8e224f3c52ff1c19de6f032fce66be87598b7656e5509" name="kexec-tools" arch="x86_64">
  <version epoch="0" ver="2.0.20" rel="150400.16.3.1"/>
  <changelog author="ptesarik@suse.com" date="1519387200">- kexec-tools-ppc64-parse-ibm-dynamic-memory.patch: kexec/ppc64:
  add support to parse ibm, dynamic-memory-v2 property
  (bsc#1081789, LTC#164625).
- kexec-tools-add-a-helper-function-to-add-ranges.patch: kexec: add
  a helper function to add ranges (bsc#1081789, LTC#164625).</changelog>
  <changelog author="msuchanek@suse.com" date="1522756800">- kexec: add -a option to fall back to KEXEC_LOAD when KEXEC_FILE_LOAD is not
  supported (bsc#1080916, boo#1076839).
  * kexec-tools-Return-ENOSYS-when-kexec-does-not-know.patch
  * kexec-tools-Fix-option-checks-to-take-KEXEC_FILE_LOAD.patch
  * kexec-tools-Do-not-special-case-the-s-option.patch
  * kexec-tools-Add-option-to-revert-s.patch
  * kexec-tools-Add-option-to-fall-back-to-KEXEC_LOAD.patch
  * kexec-tools-Document-s-c-and-a-options-in-the-man-page.patch
- kexec-tools-ppc64-leverage-kexec_file_load-support.patch: kexec/ppc64:
  leverage kexec_file_load support (bsc#1080916).</changelog>
  <changelog author="ptesarik@suse.com" date="1522929600">- kexec-tools-fix-kexec-p-segfault.patch: Fix a segmentation fault
  when trying to run "kexec -p" (bsc#1080916).</changelog>
  <changelog author="ptesarik@suse.com" date="1522929601">- kexec-tools-vmcoreinfo-in-xen.patch: Revert "kexec-tools: Read
  always one vmcoreinfo file" (bsc#1085626, bsc#951740).</changelog>
  <changelog author="ptesarik@suse.com" date="1524139200">- Bump to version 2.0.17
  Changelog: http://git.kernel.org/cgit/utils/kernel/kexec/kexec-tools.git/log/?id=refs/tags/v2.0.16..v2.0.17
- Drop kexec-tools-xen-static.patch: upstream uses run-time dynamic
  linking to address the same issue.
- Drop all patches from upstream git:
  * kexec-tools-add-a-helper-function-to-add-ranges.patch
  * kexec-tools-ppc64-parse-ibm-dynamic-memory.patch
  * kexec-tools-ppc64-leverage-kexec_file_load-support.patch
  * kexec-tools-Return-ENOSYS-when-kexec-does-not-know.patch
  * kexec-tools-Fix-option-checks-to-take-KEXEC_FILE_LOAD.patch
  * kexec-tools-Do-not-special-case-the-s-option.patch
  * kexec-tools-Add-option-to-revert-s.patch
  * kexec-tools-Add-option-to-fall-back-to-KEXEC_LOAD.patch
  * kexec-tools-Document-s-c-and-a-options-in-the-man-page.patch
  * kexec-tools-fix-kexec-p-segfault.patch</changelog>
  <changelog author="aplanas@suse.com" date="1536580800">- kexec-tools-fix-for-Unhandled-rela-relocation-R_X86_64_PLT32.patch
  Upstream backport.
  In response to a change in binutils, commit b21ebf2fb4c
  (x86: Treat R_X86_64_PLT32 as R_X86_64_PC32) was applied to
  the linux kernel during the 4.16 development cycle and has
  since been backported to earlier stable kernel series. The
  change results in the failure message in $SUBJECT when
  rebooting via kexec.
  Fix this by replicating the change in kexec.</changelog>
  <changelog author="ptesarik@suse.com" date="1541073600">- Bump to version 2.0.18
  Changelog: http://git.kernel.org/cgit/utils/kernel/kexec/kexec-tools.git/log/?id=refs/tags/v2.0.17..v2.0.18
- Drop patches from upstream git:
  * kexec-tools-fix-for-Unhandled-rela-relocation-R_X86_64_PLT32.patch
- Remove the confusing kdump binary (no longer in upstream).</changelog>
  <changelog author="ptesarik@suse.com" date="1541073601">- Remove bogus Url RPM tag: The project does not have a home page.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="ptesarik@suse.com" date="1560513600">- Bump to version 2.0.19
  Changelog: http://git.kernel.org/cgit/utils/kernel/kexec/kexec-tools.git/log/?id=refs/tags/v2.0.18..v2.0.19</changelog>
  <changelog author="clin@suse.com" date="1576497600">- Bump to version 2.0.20
  Changelog: https://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git/log/?id=refs/tags/v2.0.19..v2.0.20
- Backport a upstream patch series: [jsc#SLE-9032]
  Subject: [PATCH v2 0/3] arm64: handle "reserved" entries in /proc/iomem
  * kexec-tools-add-variant-helper-functions.patch
  * kexec-tools-arm64-kexec-allocate-memory-space-avoiding-reserved-regions.patch
  * kexec-tools-arm64-kdump-deal-with-resource-entries-in-proc-iomem.patch</changelog>
  <changelog author="clin@suse.com" date="1578657600">- Fix compiling errors of multiboot2_x86_* functions for i586
  * kexec-tools-build-multiboot2-for-i386.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1580299200">- Fix build errors on old distributions
  * kexec-tools-video-capability.patch
  * kexec-tools-SYS_getrandom.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1584100800">- kexec-tools-fix-kexec_file_load-error-handling.patch: Fix the
  error handling if kexec_file_load() fails (bsc#1166105).</changelog>
  <changelog author="ptesarik@suse.com" date="1584100801">- kexec-tools-reset-getopt-before-falling-back-to-legacy.patch:
  Reset getopt before falling back to legacy syscall (bsc#1166105).</changelog>
  <changelog author="ptesarik@suse.com" date="1585915200">- kexec-tools-s390-Reset-kernel-command-line-on-syscal.patch: s390:
  Reset kernel command line on syscall fallback (bsc#1167868).</changelog>
  <changelog author="ohering@suse.com" date="1605009600">- Remove kexec-tools-xen-balloon-up.patch (bsc#1176606,
  bsc#1174508)
  This patch was introduced to address bsc#694863; it enabled kexec
  for HVM at that time. Meanwhile Xen 4.7 introduced "soft-reset"
  for HVM domUs. This host feature removes the requirement to
  un-ballon the domU prior kexec.
  With Xen 4.13 cpuid faulting became the default, which affects
  the approach used in this patch to detect the domU type. As a
  result, invoking kexec in dom0 failed.</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1618920000">- Hardening: Link as PIE (bsc#1185020).</changelog>
  <changelog author="ptesarik@suse.com" date="1649851200">- kexec-tools-print-error-if-kexec_file_load-fails.patch: print
  error if kexec_file_load fails (bsc#1197176).</changelog>
  <changelog author="mbrugger@suse.com" date="1677153600">- kexec-tools-ppc64-remove-rma_top-limit.patch: remove ram_top
  restriction (bsc#1203410)</changelog>
</package>
<package pkgid="0c7bbe53a07feada56efdf21d6bcad0e448f33bd602af4f57323933c770c9cc8" name="kpartx" arch="aarch64">
  <version epoch="0" ver="0.9.0+62+suse.3e048d4" rel="150400.4.10.1"/>
  <changelog author="mwilck@suse.com" date="1632225600">- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1638446400">- Update to version 0.8.7+138+suse.7c9afe31:
  New upstream version (pre-0.8.8)
  * deprecate "config_dir" and "multipath_dir" config options
    (will be removed in future version)
  * remove dependency on systemd-udevd-settle.service (boo#1193336)
  * fix crash in remove_map (boo#1193334)
  * CLI: add path wildcard "%I" for init state
  * CLI: add "reconfigure all" command
  * allow multiple pending "reconfigure" commands (bsc#1189551)
  * speed up "reconfigure" by avoiding unnecessary map reloads
    (bsc#1189551)
  * rework of CLI command handler (unix socket handler) to avoid
    hanging CLI commands (bsc#1189551)
  * fix multipathd startup after stop during reconfigure (boo#1193338)
  * improve error detection and warning messages in config file parser
  * fix exit status of multipath -T (bsc#1191900)
  * fix defects reported by coverity (boo#1193342)
  - avoid sleeping with locks held
  - exit if bindings file is broken
  - set umask before mkstemp
  - add bounds and consistency checks in SCSI VPD parsing code
  * add hardware table entry for DellEMC/ME4 (PowerVault ME4)</changelog>
  <changelog author="mwilck@suse.com" date="1638532800">- Drop versioned dependency on libmpath0 again (bsc#1190622)
  * Since 0.8.6, libmultipath and libmpathpersist have got proper ABI
    versioning, and rpmbuild auto-generates dependencies on
    libmultipath.so.0(LIBMULTIPATH_13.0.0) etc.</changelog>
  <changelog author="mwilck@suse.com" date="1638792000">- Update to 0.8.8+38+suse.2bdd3a14.obscpio
  * upstream version bump. Code-wise identical to 0.8.7+138+suse.7c9afe31</changelog>
  <changelog author="mwilck@suse.com" date="1641556800">- Version 0.8.8+13+suse.79c3556f
  * code-wise identical to 0.8.8+38+suse.2bdd3a14
    (previous version number was too high by mistake)</changelog>
  <changelog author="mwilck@suse.com" date="1643803200">- Version 0.8.8+45+suse.628d603e
  * fix handling of historical-service-time path selector (bsc#1195425)
  * fix marking multipath devices as failed prematurely on startup
    (bsc#1195426)
  * multipathd.service: remove LimitCORE=infinity directive
    This should only be enabled for debugging.
  * multipathd.service: don't load scsi_dh modules (bsc#1195397)
    This is done via modules-load.d functionality on (open)SUSE
- Upstream fixes:
  * Fix claiming of paths with "find_multipaths strict"
  * Avoid unnecessary read-only reloads</changelog>
  <changelog author="mwilck@suse.com" date="1644408000">- Version 0.8.8+57+suse.dfb672fe
  * kpartx.rules: skip MD devices (bsc#1195644)
  * libmultipath: hwtable: use ALUA for all LIO targets (bsc#1195649)
  * multipathd.service: drop ExecStartPre for loading dm-multipath
    (bsc#1195397)</changelog>
  <changelog author="mwilck@suse.com" date="1644926400">- Update to version 0.8.8+60+suse.4c5922cb:
  * multipathd: add suppport for FC Fabric Performance Impact
    Notifications (FPIN) (bsc#1195506)</changelog>
  <changelog author="mwilck@suse.com" date="1645012800">- Update to version 0.8.8+64+suse.f265f7e0:
  * libmultipath: fix printing native nvme multipath topology
    (bsc#1196011)
  * libmultipath: add %L path wildcard for 64-bit hex LUN
  * libmultipath: support host adapter name lookup for s390x ccw bus</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- If multipath-tools is newly installed, load dm-multipath
  (bsc#1196898)</changelog>
  <changelog author="mwilck@suse.com" date="1649937600">- Update to version 0.8.9+42+suse.45974f11:
  * Logging improvements
  * Fix busy loop with delayed_reconfigure (bsc#1199342)
  * multipathd: use remove_map_callback for delayed reconfigure
  * multipathd: Don't keep starting TUR threads, if they always hang.
    (bsc#1199345)
  * Fix handling of path addition in read-only arrays on NVMe
  * Updates of built-in hardware database
- Update to upstream 0.8.9
  * libmultipath: only warn once about unsupported dev_loss_tmo
  * Otherwise code-identical to 0.8.8+64</changelog>
  <changelog author="mwilck@suse.com" date="1652097600">- Update to version 0.8.9+85+suse.a9da21c:
  * This is a pre-release of multipath-tools 0.9.0
  * multipath.conf: add "protocol" subsection in "overrides" section
    This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and
    "eh_deadline" on a per-protocol basis rather than per storage
  * multipath.conf: drop support for deprecated options:
    getuid_callout, pg_timeout, config_dir, multipath_dir
  * multipathd: don't switch to DAEMON_IDLE during startup
  (bsc#1199346, bsc#1197570)
  * multipathd: avoid delays during uevent processing (bsc#1199347)
  * Fixes for minor issues reported by coverity
  * Fix for memory leak with uid_attrs
  * Fix possibility to redefine -D_FORTIFY_SOURCE macro.
  * Updates for built in hardware db</changelog>
  <changelog author="mwilck@suse.com" date="1652184000">- Update to version 0.8.9+87+suse.a1eb122:
  * add ability to autodetect support for -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1652270400">- Update to version 0.8.9+90+suse.71a70fb:
  * support overriding -D_FORTIFY_SOURCE in OPTFLAGS
  * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors
    on old distros</changelog>
  <changelog author="mwilck@suse.com" date="1657713600">- Update to version 0.9.0+33+suse.fdc6686
  * multipath.conf: add support for "protocol" subsection in
    "overrides" section to set certain config options by protocol.
  * Removed the previously deprecated options getuid_callout,
    config_dir, multipath_dir, pg_timeout
  * hwable fixes and additions
  * multipath.conf(5): add disclaimer about vendor support
  * libmultipath, kpartx: fix callers of dm_get_next_target()
  * Change built-in defaults for NVMe: group by prio, and immediate
    failback
  * Allow compilation with -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1657713601">- Update to version 0.9.0+39+suse.51a2ab1:
  Upstream bug fixes:
  * libmultipath: fix find_multipaths_timeout for unknown hardware
  (boo#1201483)
  * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices
  (boo#1201483)</changelog>
  <changelog author="mwilck@suse.com" date="1661342400">- Update to version 0.9.0+55+suse.33d8854:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.9.0+62+suse.3e048d4:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="76df7073ce00646a7457b211d8f83293719213b0af417af06a125f0af61c58c4" name="kpartx" arch="x86_64">
  <version epoch="0" ver="0.9.0+62+suse.3e048d4" rel="150400.4.10.1"/>
  <changelog author="mwilck@suse.com" date="1632225600">- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1638446400">- Update to version 0.8.7+138+suse.7c9afe31:
  New upstream version (pre-0.8.8)
  * deprecate "config_dir" and "multipath_dir" config options
    (will be removed in future version)
  * remove dependency on systemd-udevd-settle.service (boo#1193336)
  * fix crash in remove_map (boo#1193334)
  * CLI: add path wildcard "%I" for init state
  * CLI: add "reconfigure all" command
  * allow multiple pending "reconfigure" commands (bsc#1189551)
  * speed up "reconfigure" by avoiding unnecessary map reloads
    (bsc#1189551)
  * rework of CLI command handler (unix socket handler) to avoid
    hanging CLI commands (bsc#1189551)
  * fix multipathd startup after stop during reconfigure (boo#1193338)
  * improve error detection and warning messages in config file parser
  * fix exit status of multipath -T (bsc#1191900)
  * fix defects reported by coverity (boo#1193342)
  - avoid sleeping with locks held
  - exit if bindings file is broken
  - set umask before mkstemp
  - add bounds and consistency checks in SCSI VPD parsing code
  * add hardware table entry for DellEMC/ME4 (PowerVault ME4)</changelog>
  <changelog author="mwilck@suse.com" date="1638532800">- Drop versioned dependency on libmpath0 again (bsc#1190622)
  * Since 0.8.6, libmultipath and libmpathpersist have got proper ABI
    versioning, and rpmbuild auto-generates dependencies on
    libmultipath.so.0(LIBMULTIPATH_13.0.0) etc.</changelog>
  <changelog author="mwilck@suse.com" date="1638792000">- Update to 0.8.8+38+suse.2bdd3a14.obscpio
  * upstream version bump. Code-wise identical to 0.8.7+138+suse.7c9afe31</changelog>
  <changelog author="mwilck@suse.com" date="1641556800">- Version 0.8.8+13+suse.79c3556f
  * code-wise identical to 0.8.8+38+suse.2bdd3a14
    (previous version number was too high by mistake)</changelog>
  <changelog author="mwilck@suse.com" date="1643803200">- Version 0.8.8+45+suse.628d603e
  * fix handling of historical-service-time path selector (bsc#1195425)
  * fix marking multipath devices as failed prematurely on startup
    (bsc#1195426)
  * multipathd.service: remove LimitCORE=infinity directive
    This should only be enabled for debugging.
  * multipathd.service: don't load scsi_dh modules (bsc#1195397)
    This is done via modules-load.d functionality on (open)SUSE
- Upstream fixes:
  * Fix claiming of paths with "find_multipaths strict"
  * Avoid unnecessary read-only reloads</changelog>
  <changelog author="mwilck@suse.com" date="1644408000">- Version 0.8.8+57+suse.dfb672fe
  * kpartx.rules: skip MD devices (bsc#1195644)
  * libmultipath: hwtable: use ALUA for all LIO targets (bsc#1195649)
  * multipathd.service: drop ExecStartPre for loading dm-multipath
    (bsc#1195397)</changelog>
  <changelog author="mwilck@suse.com" date="1644926400">- Update to version 0.8.8+60+suse.4c5922cb:
  * multipathd: add suppport for FC Fabric Performance Impact
    Notifications (FPIN) (bsc#1195506)</changelog>
  <changelog author="mwilck@suse.com" date="1645012800">- Update to version 0.8.8+64+suse.f265f7e0:
  * libmultipath: fix printing native nvme multipath topology
    (bsc#1196011)
  * libmultipath: add %L path wildcard for 64-bit hex LUN
  * libmultipath: support host adapter name lookup for s390x ccw bus</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- If multipath-tools is newly installed, load dm-multipath
  (bsc#1196898)</changelog>
  <changelog author="mwilck@suse.com" date="1649937600">- Update to version 0.8.9+42+suse.45974f11:
  * Logging improvements
  * Fix busy loop with delayed_reconfigure (bsc#1199342)
  * multipathd: use remove_map_callback for delayed reconfigure
  * multipathd: Don't keep starting TUR threads, if they always hang.
    (bsc#1199345)
  * Fix handling of path addition in read-only arrays on NVMe
  * Updates of built-in hardware database
- Update to upstream 0.8.9
  * libmultipath: only warn once about unsupported dev_loss_tmo
  * Otherwise code-identical to 0.8.8+64</changelog>
  <changelog author="mwilck@suse.com" date="1652097600">- Update to version 0.8.9+85+suse.a9da21c:
  * This is a pre-release of multipath-tools 0.9.0
  * multipath.conf: add "protocol" subsection in "overrides" section
    This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and
    "eh_deadline" on a per-protocol basis rather than per storage
  * multipath.conf: drop support for deprecated options:
    getuid_callout, pg_timeout, config_dir, multipath_dir
  * multipathd: don't switch to DAEMON_IDLE during startup
  (bsc#1199346, bsc#1197570)
  * multipathd: avoid delays during uevent processing (bsc#1199347)
  * Fixes for minor issues reported by coverity
  * Fix for memory leak with uid_attrs
  * Fix possibility to redefine -D_FORTIFY_SOURCE macro.
  * Updates for built in hardware db</changelog>
  <changelog author="mwilck@suse.com" date="1652184000">- Update to version 0.8.9+87+suse.a1eb122:
  * add ability to autodetect support for -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1652270400">- Update to version 0.8.9+90+suse.71a70fb:
  * support overriding -D_FORTIFY_SOURCE in OPTFLAGS
  * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors
    on old distros</changelog>
  <changelog author="mwilck@suse.com" date="1657713600">- Update to version 0.9.0+33+suse.fdc6686
  * multipath.conf: add support for "protocol" subsection in
    "overrides" section to set certain config options by protocol.
  * Removed the previously deprecated options getuid_callout,
    config_dir, multipath_dir, pg_timeout
  * hwable fixes and additions
  * multipath.conf(5): add disclaimer about vendor support
  * libmultipath, kpartx: fix callers of dm_get_next_target()
  * Change built-in defaults for NVMe: group by prio, and immediate
    failback
  * Allow compilation with -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1657713601">- Update to version 0.9.0+39+suse.51a2ab1:
  Upstream bug fixes:
  * libmultipath: fix find_multipaths_timeout for unknown hardware
  (boo#1201483)
  * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices
  (boo#1201483)</changelog>
  <changelog author="mwilck@suse.com" date="1661342400">- Update to version 0.9.0+55+suse.33d8854:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.9.0+62+suse.3e048d4:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="bf9ef4335d2dedfcfab6d1e3d3e6994c7a721681536fa2e3707060a6e84be8b7" name="krb5" arch="aarch64">
  <version epoch="0" ver="1.19.2" rel="150400.3.3.1"/>
  <changelog author="hguo@suse.com" date="1503057600">- Set "rdns" and "dns_canonicalize_hostname" to false in krb5.conf
  in order to improve client security in handling service principle
  names. (bsc#1054028)</changelog>
  <changelog author="michael@stroeder.com" date="1506340800">- Upgrade to 1.15.2
  * Fix a KDC denial of service vulnerability caused by unset status
    strings [CVE-2017-11368]
  * Preserve GSS contexts on init/accept failure [CVE-2017-11462]
  * Fix kadm5 setkey operation with LDAP KDB module
  * Use a ten-second timeout after successful connection for HTTPS KDC
    requests, as we do for TCP requests
  * Fix client null dereference when KDC offers encrypted challenge
    without FAST
  * Ignore dotfiles when processing profile includedir directive
  * Improve documentation</changelog>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package descriptions.</changelog>
  <changelog author="hguo@suse.com" date="1509969600">- Remove build dependency doxygen, python-Cheetah, python-Sphinx,
  python-libxml2, python-lxml, most of which are python 2 programs.
  Consequently remove -doc subpackage. Users are encouraged to use
  online documentation. (bsc#1066461)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="luizluca@gmail.com" date="1524657600">- Added support for /etc/krb5.conf.d/ for configuration snippets</changelog>
  <changelog author="michael@stroeder.com" date="1525435200">- Upgrade to 1.15.3
  * Fix flaws in LDAP DN checking, including a null dereference KDC
    crash which could be triggered by kadmin clients with administrative
    privileges [CVE-2018-5729, CVE-2018-5730].
  * Fix a KDC PKINIT memory leak.
  * Fix a small KDC memory leak on transited or authdata errors when
    processing TGS requests.
  * Fix a null dereference when the KDC sends a large TGS reply.
  * Fix "kdestroy -A" with the KCM credential cache type.
  * Fix the handling of capaths "." values.
  * Fix handling of repeated subsection specifications in profile files
    (such as when multiple included files specify relations in the same
    subsection).</changelog>
  <changelog author="mcepl@suse.com" date="1529323200">- BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package
  so it is avaiable for krb5-client as well.</changelog>
  <changelog author="jmcdonough@suse.com" date="1539086400">- Upgrade to 1.16.1
  * kdc client cert matching on client principal entry
  * Allow ktutil addent command to ignore key version and use
    non-default salt string.
  * add kpropd pidfile support
  * enable "encrypted_challenge_indicator" realm option on tickets
    obtained using FAST encrypted challenge pre-authentication.
  * dates through 2106 accepted
  * KDC support for trivially renewable tickets
  * stop caching referral and alternate cross-realm TGTs to prevent
    duplicate credential cache entries</changelog>
  <changelog author="scabrero@suse.de" date="1548849600">- Upgrade to 1.16.3
  * Fix a regression in the MEMORY credential cache type which could cause
    client programs to crash.
  * MEMORY credential caches will not be listed in the global collection,
    with the exception of the default credential cache if it is of type MEMORY.
  * Remove an incorrect assertion in the KDC which could be used to cause
    a crash [CVE-2018-20217].
  * Fix bugs with concurrent use of MEMORY ccache handles.
  * Fix a KDC crash when falling back between multiple OTP tokens configured
    for a principal entry.
  * Fix memory bugs when gss_add_cred() is used to create a new credential,
    and fix a bug where it ignores the desired_name.
  * Fix the behavior of gss_inquire_cred_by_mech() when the credential does
    not contain an element of the requested mechanism.
  * Make cross-realm S4U2Self requests work on the client when no
    default_realm is configured.
  * Add a kerberos(7) man page containing documentation of the environment
    variables that affect Kerberos programs.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
  by transactional updates; (bsc#1100126);
- Rename patches:
  * krb5-1.12-pam.patch =&gt; 0001-krb5-1.12-pam.patch
  * krb5-1.9-manpaths.dif =&gt; 0002-krb5-1.9-manpaths.patch
  * krb5-1.12-buildconf.patch =&gt; 0003-krb5-1.12-buildconf.patch
  * krb5-1.6.3-gssapi_improve_errormessages.dif to
    0004-krb5-1.6.3-gssapi_improve_errormessages.patch
  * krb5-1.6.3-ktutil-manpage.dif =&gt; 0005-krb5-1.6.3-ktutil-manpage.patch
  * krb5-1.12-api.patch =&gt; 0006-krb5-1.12-api.patch
  * krb5-1.12-ksu-path.patch =&gt; 0007-krb5-1.12-ksu-path.patch
  * krb5-1.12-selinux-label.patch =&gt;  0008-krb5-1.12-selinux-label.patch
  * krb5-1.9-debuginfo.patch =&gt; 0009-krb5-1.9-debuginfo.patch</changelog>
  <changelog author="scabrero@suse.de" date="1557230400">- Move LDAP schema files from /usr/share/doc/packages/krb5 to
  /usr/share/kerberos/ldap; (bsc#1134217);</changelog>
  <changelog author="scabrero@suse.de" date="1565006400">- Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947);
  (bsc#1144047);</changelog>
  <changelog author="scabrero@suse.de" date="1591617600">- Update logrotate script, call systemd to reload the services
  instead of init-scripts. (boo#1169357)</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Fix prefix reported by krb5-config, libraries and headers are not
  installed under /usr/lib/mit prefix. (bsc#1174079)</changelog>
  <changelog author="scabrero@suse.de" date="1604923200">- Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196);
  (bsc#1178512);
- Added patches:
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619092800">- Use /run instead of /var/run for daemon PID files; (bsc#1185163);</changelog>
  <changelog author="scabrero@suse.de" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="scabrero@suse.de" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages.
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust.
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="nopower@suse.com" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
</package>
<package pkgid="d6d3c75a19141a9b81634aa976be324d2b35a2f78eab1b97f3aa0dbad47a73de" name="krb5" arch="src">
  <version epoch="0" ver="1.19.2" rel="150400.3.3.1"/>
  <changelog author="hguo@suse.com" date="1503057600">- Set "rdns" and "dns_canonicalize_hostname" to false in krb5.conf
  in order to improve client security in handling service principle
  names. (bsc#1054028)</changelog>
  <changelog author="michael@stroeder.com" date="1506340800">- Upgrade to 1.15.2
  * Fix a KDC denial of service vulnerability caused by unset status
    strings [CVE-2017-11368]
  * Preserve GSS contexts on init/accept failure [CVE-2017-11462]
  * Fix kadm5 setkey operation with LDAP KDB module
  * Use a ten-second timeout after successful connection for HTTPS KDC
    requests, as we do for TCP requests
  * Fix client null dereference when KDC offers encrypted challenge
    without FAST
  * Ignore dotfiles when processing profile includedir directive
  * Improve documentation</changelog>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package descriptions.</changelog>
  <changelog author="hguo@suse.com" date="1509969600">- Remove build dependency doxygen, python-Cheetah, python-Sphinx,
  python-libxml2, python-lxml, most of which are python 2 programs.
  Consequently remove -doc subpackage. Users are encouraged to use
  online documentation. (bsc#1066461)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="luizluca@gmail.com" date="1524657600">- Added support for /etc/krb5.conf.d/ for configuration snippets</changelog>
  <changelog author="michael@stroeder.com" date="1525435200">- Upgrade to 1.15.3
  * Fix flaws in LDAP DN checking, including a null dereference KDC
    crash which could be triggered by kadmin clients with administrative
    privileges [CVE-2018-5729, CVE-2018-5730].
  * Fix a KDC PKINIT memory leak.
  * Fix a small KDC memory leak on transited or authdata errors when
    processing TGS requests.
  * Fix a null dereference when the KDC sends a large TGS reply.
  * Fix "kdestroy -A" with the KCM credential cache type.
  * Fix the handling of capaths "." values.
  * Fix handling of repeated subsection specifications in profile files
    (such as when multiple included files specify relations in the same
    subsection).</changelog>
  <changelog author="mcepl@suse.com" date="1529323200">- BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package
  so it is avaiable for krb5-client as well.</changelog>
  <changelog author="jmcdonough@suse.com" date="1539086400">- Upgrade to 1.16.1
  * kdc client cert matching on client principal entry
  * Allow ktutil addent command to ignore key version and use
    non-default salt string.
  * add kpropd pidfile support
  * enable "encrypted_challenge_indicator" realm option on tickets
    obtained using FAST encrypted challenge pre-authentication.
  * dates through 2106 accepted
  * KDC support for trivially renewable tickets
  * stop caching referral and alternate cross-realm TGTs to prevent
    duplicate credential cache entries</changelog>
  <changelog author="scabrero@suse.de" date="1548849600">- Upgrade to 1.16.3
  * Fix a regression in the MEMORY credential cache type which could cause
    client programs to crash.
  * MEMORY credential caches will not be listed in the global collection,
    with the exception of the default credential cache if it is of type MEMORY.
  * Remove an incorrect assertion in the KDC which could be used to cause
    a crash [CVE-2018-20217].
  * Fix bugs with concurrent use of MEMORY ccache handles.
  * Fix a KDC crash when falling back between multiple OTP tokens configured
    for a principal entry.
  * Fix memory bugs when gss_add_cred() is used to create a new credential,
    and fix a bug where it ignores the desired_name.
  * Fix the behavior of gss_inquire_cred_by_mech() when the credential does
    not contain an element of the requested mechanism.
  * Make cross-realm S4U2Self requests work on the client when no
    default_realm is configured.
  * Add a kerberos(7) man page containing documentation of the environment
    variables that affect Kerberos programs.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
  by transactional updates; (bsc#1100126);
- Rename patches:
  * krb5-1.12-pam.patch =&gt; 0001-krb5-1.12-pam.patch
  * krb5-1.9-manpaths.dif =&gt; 0002-krb5-1.9-manpaths.patch
  * krb5-1.12-buildconf.patch =&gt; 0003-krb5-1.12-buildconf.patch
  * krb5-1.6.3-gssapi_improve_errormessages.dif to
    0004-krb5-1.6.3-gssapi_improve_errormessages.patch
  * krb5-1.6.3-ktutil-manpage.dif =&gt; 0005-krb5-1.6.3-ktutil-manpage.patch
  * krb5-1.12-api.patch =&gt; 0006-krb5-1.12-api.patch
  * krb5-1.12-ksu-path.patch =&gt; 0007-krb5-1.12-ksu-path.patch
  * krb5-1.12-selinux-label.patch =&gt;  0008-krb5-1.12-selinux-label.patch
  * krb5-1.9-debuginfo.patch =&gt; 0009-krb5-1.9-debuginfo.patch</changelog>
  <changelog author="scabrero@suse.de" date="1557230400">- Move LDAP schema files from /usr/share/doc/packages/krb5 to
  /usr/share/kerberos/ldap; (bsc#1134217);</changelog>
  <changelog author="scabrero@suse.de" date="1565006400">- Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947);
  (bsc#1144047);</changelog>
  <changelog author="scabrero@suse.de" date="1591617600">- Update logrotate script, call systemd to reload the services
  instead of init-scripts. (boo#1169357)</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Fix prefix reported by krb5-config, libraries and headers are not
  installed under /usr/lib/mit prefix. (bsc#1174079)</changelog>
  <changelog author="scabrero@suse.de" date="1604923200">- Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196);
  (bsc#1178512);
- Added patches:
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619092800">- Use /run instead of /var/run for daemon PID files; (bsc#1185163);</changelog>
  <changelog author="scabrero@suse.de" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="scabrero@suse.de" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages.
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust.
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="nopower@suse.com" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
</package>
<package pkgid="9e27ade554445de3059f4c674fb49607d5560e210275902dc5896cc4fd3d0b0b" name="krb5" arch="x86_64">
  <version epoch="0" ver="1.19.2" rel="150400.3.3.1"/>
  <changelog author="hguo@suse.com" date="1503057600">- Set "rdns" and "dns_canonicalize_hostname" to false in krb5.conf
  in order to improve client security in handling service principle
  names. (bsc#1054028)</changelog>
  <changelog author="michael@stroeder.com" date="1506340800">- Upgrade to 1.15.2
  * Fix a KDC denial of service vulnerability caused by unset status
    strings [CVE-2017-11368]
  * Preserve GSS contexts on init/accept failure [CVE-2017-11462]
  * Fix kadm5 setkey operation with LDAP KDB module
  * Use a ten-second timeout after successful connection for HTTPS KDC
    requests, as we do for TCP requests
  * Fix client null dereference when KDC offers encrypted challenge
    without FAST
  * Ignore dotfiles when processing profile includedir directive
  * Improve documentation</changelog>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package descriptions.</changelog>
  <changelog author="hguo@suse.com" date="1509969600">- Remove build dependency doxygen, python-Cheetah, python-Sphinx,
  python-libxml2, python-lxml, most of which are python 2 programs.
  Consequently remove -doc subpackage. Users are encouraged to use
  online documentation. (bsc#1066461)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="luizluca@gmail.com" date="1524657600">- Added support for /etc/krb5.conf.d/ for configuration snippets</changelog>
  <changelog author="michael@stroeder.com" date="1525435200">- Upgrade to 1.15.3
  * Fix flaws in LDAP DN checking, including a null dereference KDC
    crash which could be triggered by kadmin clients with administrative
    privileges [CVE-2018-5729, CVE-2018-5730].
  * Fix a KDC PKINIT memory leak.
  * Fix a small KDC memory leak on transited or authdata errors when
    processing TGS requests.
  * Fix a null dereference when the KDC sends a large TGS reply.
  * Fix "kdestroy -A" with the KCM credential cache type.
  * Fix the handling of capaths "." values.
  * Fix handling of repeated subsection specifications in profile files
    (such as when multiple included files specify relations in the same
    subsection).</changelog>
  <changelog author="mcepl@suse.com" date="1529323200">- BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package
  so it is avaiable for krb5-client as well.</changelog>
  <changelog author="jmcdonough@suse.com" date="1539086400">- Upgrade to 1.16.1
  * kdc client cert matching on client principal entry
  * Allow ktutil addent command to ignore key version and use
    non-default salt string.
  * add kpropd pidfile support
  * enable "encrypted_challenge_indicator" realm option on tickets
    obtained using FAST encrypted challenge pre-authentication.
  * dates through 2106 accepted
  * KDC support for trivially renewable tickets
  * stop caching referral and alternate cross-realm TGTs to prevent
    duplicate credential cache entries</changelog>
  <changelog author="scabrero@suse.de" date="1548849600">- Upgrade to 1.16.3
  * Fix a regression in the MEMORY credential cache type which could cause
    client programs to crash.
  * MEMORY credential caches will not be listed in the global collection,
    with the exception of the default credential cache if it is of type MEMORY.
  * Remove an incorrect assertion in the KDC which could be used to cause
    a crash [CVE-2018-20217].
  * Fix bugs with concurrent use of MEMORY ccache handles.
  * Fix a KDC crash when falling back between multiple OTP tokens configured
    for a principal entry.
  * Fix memory bugs when gss_add_cred() is used to create a new credential,
    and fix a bug where it ignores the desired_name.
  * Fix the behavior of gss_inquire_cred_by_mech() when the credential does
    not contain an element of the requested mechanism.
  * Make cross-realm S4U2Self requests work on the client when no
    default_realm is configured.
  * Add a kerberos(7) man page containing documentation of the environment
    variables that affect Kerberos programs.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
  by transactional updates; (bsc#1100126);
- Rename patches:
  * krb5-1.12-pam.patch =&gt; 0001-krb5-1.12-pam.patch
  * krb5-1.9-manpaths.dif =&gt; 0002-krb5-1.9-manpaths.patch
  * krb5-1.12-buildconf.patch =&gt; 0003-krb5-1.12-buildconf.patch
  * krb5-1.6.3-gssapi_improve_errormessages.dif to
    0004-krb5-1.6.3-gssapi_improve_errormessages.patch
  * krb5-1.6.3-ktutil-manpage.dif =&gt; 0005-krb5-1.6.3-ktutil-manpage.patch
  * krb5-1.12-api.patch =&gt; 0006-krb5-1.12-api.patch
  * krb5-1.12-ksu-path.patch =&gt; 0007-krb5-1.12-ksu-path.patch
  * krb5-1.12-selinux-label.patch =&gt;  0008-krb5-1.12-selinux-label.patch
  * krb5-1.9-debuginfo.patch =&gt; 0009-krb5-1.9-debuginfo.patch</changelog>
  <changelog author="scabrero@suse.de" date="1557230400">- Move LDAP schema files from /usr/share/doc/packages/krb5 to
  /usr/share/kerberos/ldap; (bsc#1134217);</changelog>
  <changelog author="scabrero@suse.de" date="1565006400">- Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947);
  (bsc#1144047);</changelog>
  <changelog author="scabrero@suse.de" date="1591617600">- Update logrotate script, call systemd to reload the services
  instead of init-scripts. (boo#1169357)</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Fix prefix reported by krb5-config, libraries and headers are not
  installed under /usr/lib/mit prefix. (bsc#1174079)</changelog>
  <changelog author="scabrero@suse.de" date="1604923200">- Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196);
  (bsc#1178512);
- Added patches:
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619092800">- Use /run instead of /var/run for daemon PID files; (bsc#1185163);</changelog>
  <changelog author="scabrero@suse.de" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="scabrero@suse.de" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages.
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust.
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="nopower@suse.com" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
</package>
<package pkgid="0397f8854d8e106fd62e422734db87a2564ae96f3e02a5010273b03517f92675" name="kubevirt" arch="src">
  <version epoch="0" ver="0.54.0" rel="150400.3.10.4"/>
  <changelog author="vasily.ulyanov@suse.com" date="1624968000">- Add REGISTRY variable
- Use registry.suse.com as the default fallback for sle
- Rename macro registry_path to kubevirt_registry_path</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1625227200">- Generate meta info for containers during rpm build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1630929600">- Update to version 0.44.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.44.1
- Drop patches:
  dont-build-virtctl-darwin.patch
  dont-use-bazel-in-build-manifests.patch
  fix-double-free-of-VirDomain.patch
  fix-virsh-domcapabilities-error.patch (bsc#1185119)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1631188800">- Update to version 0.45.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.45.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1634731200">- Pack only kubevirt-{operator,cr}.yaml into manifests
- Include manifests/testing/* into tests package
- Use disks-images-provider.yaml from upstream
- Allow overwrite the default DNS service in tests
  0001-Allow-overwrite-the-default-DNS-service-in-tests.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1638360000">- Detect SLE15 SP4 build environment
- Update to version 0.47.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.47.1
- Drop 0001-Allow-overwrite-the-default-DNS-service-in-tests.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639656000">- Update to version 0.48.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.48.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641988800">- Update to version 0.49.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.49.0
  Includes the fix for CVE-2021-43565 (bsc#1193930)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645444800">- Allow to configure utility containers for update test
  0001-improve-kubevirt-update-test.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645531200">- Drop kubevirt-psp-caasp.yaml</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Use semantic equality comparison
  0002-use-semantic-equality-comparison.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393601">- Avoid to return nil failure message
  0003-Avoid-to-return-nil-failure-message.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393602">- Increase storage requirements in _constraints
- Pack nft rules and nsswitch.conf for virt-handler
- Only create 1MiB-aligned disk images (bsc#1199603)
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1655899200">- Update to version 0.54.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0
- Drop upstreamed patches
  0001-improve-kubevirt-update-test.patch
  0002-use-semantic-equality-comparison.patch
  0003-Avoid-to-return-nil-failure-message.patch
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Add CVE fixes
  0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528)
  0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460)
  0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659528000">- Update libvirt-go to fix memory leak
  0004-Update-libvirt-go-to-fix-memory-leak.patch
- Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516)
  0005-Improve-non-root-path-handling</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659960000">- Support topology spread constraints
  0006-topology-spread-constraints.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1661947200">- Fix containerdisk unmount logic
  0007-Fix-containerdisk-unmount-logic.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1675252800">- Cleanup node labels properly
  0008-Fix-node-labeller-bug-Remove-proper-labels-search-fo.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1675944000">- Fix SEV device exposure
  0009-Respect-the-feature-gate-when-exposing-SEV-device.patch</changelog>
</package>
<package pkgid="7e55e4ff1af6f42efd049b0332a743a4e427a632b38c75865dd5af6e23f0e955" name="kubevirt" arch="src">
  <version epoch="0" ver="0.54.0" rel="150400.3.7.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1620302400">- Install virt-launcher SELinux policy (bsc#1185714)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621252800">- Do not package OLM manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1624968000">- Add REGISTRY variable
- Use registry.suse.com as the default fallback for sle
- Rename macro registry_path to kubevirt_registry_path</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1625227200">- Generate meta info for containers during rpm build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1630929600">- Update to version 0.44.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.44.1
- Drop patches:
  dont-build-virtctl-darwin.patch
  dont-use-bazel-in-build-manifests.patch
  fix-double-free-of-VirDomain.patch
  fix-virsh-domcapabilities-error.patch (bsc#1185119)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1631188800">- Update to version 0.45.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.45.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1634731200">- Pack only kubevirt-{operator,cr}.yaml into manifests
- Include manifests/testing/* into tests package
- Use disks-images-provider.yaml from upstream
- Allow overwrite the default DNS service in tests
  0001-Allow-overwrite-the-default-DNS-service-in-tests.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1638360000">- Detect SLE15 SP4 build environment
- Update to version 0.47.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.47.1
- Drop 0001-Allow-overwrite-the-default-DNS-service-in-tests.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639656000">- Update to version 0.48.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.48.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641988800">- Update to version 0.49.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.49.0
  Includes the fix for CVE-2021-43565 (bsc#1193930)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645444800">- Allow to configure utility containers for update test
  0001-improve-kubevirt-update-test.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645531200">- Drop kubevirt-psp-caasp.yaml</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Use semantic equality comparison
  0002-use-semantic-equality-comparison.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393601">- Avoid to return nil failure message
  0003-Avoid-to-return-nil-failure-message.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393602">- Increase storage requirements in _constraints
- Pack nft rules and nsswitch.conf for virt-handler
- Only create 1MiB-aligned disk images (bsc#1199603)
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1655899200">- Update to version 0.54.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0
- Drop upstreamed patches
  0001-improve-kubevirt-update-test.patch
  0002-use-semantic-equality-comparison.patch
  0003-Avoid-to-return-nil-failure-message.patch
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Add CVE fixes
  0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528)
  0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460)
  0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659528000">- Update libvirt-go to fix memory leak
  0004-Update-libvirt-go-to-fix-memory-leak.patch
- Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516)
  0005-Improve-non-root-path-handling</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659960000">- Support topology spread constraints
  0006-topology-spread-constraints.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1661947200">- Fix containerdisk unmount logic
  0007-Fix-containerdisk-unmount-logic.patch</changelog>
</package>
<package pkgid="69ffee2247d6c3b436ed60473b9520ae9d5e6e043ee9ab0e551c85b7fd111b06" name="kubevirt-manifests" arch="x86_64">
  <version epoch="0" ver="0.54.0" rel="150400.3.10.4"/>
  <changelog author="vasily.ulyanov@suse.com" date="1624968000">- Add REGISTRY variable
- Use registry.suse.com as the default fallback for sle
- Rename macro registry_path to kubevirt_registry_path</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1625227200">- Generate meta info for containers during rpm build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1630929600">- Update to version 0.44.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.44.1
- Drop patches:
  dont-build-virtctl-darwin.patch
  dont-use-bazel-in-build-manifests.patch
  fix-double-free-of-VirDomain.patch
  fix-virsh-domcapabilities-error.patch (bsc#1185119)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1631188800">- Update to version 0.45.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.45.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1634731200">- Pack only kubevirt-{operator,cr}.yaml into manifests
- Include manifests/testing/* into tests package
- Use disks-images-provider.yaml from upstream
- Allow overwrite the default DNS service in tests
  0001-Allow-overwrite-the-default-DNS-service-in-tests.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1638360000">- Detect SLE15 SP4 build environment
- Update to version 0.47.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.47.1
- Drop 0001-Allow-overwrite-the-default-DNS-service-in-tests.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639656000">- Update to version 0.48.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.48.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641988800">- Update to version 0.49.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.49.0
  Includes the fix for CVE-2021-43565 (bsc#1193930)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645444800">- Allow to configure utility containers for update test
  0001-improve-kubevirt-update-test.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645531200">- Drop kubevirt-psp-caasp.yaml</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Use semantic equality comparison
  0002-use-semantic-equality-comparison.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393601">- Avoid to return nil failure message
  0003-Avoid-to-return-nil-failure-message.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393602">- Increase storage requirements in _constraints
- Pack nft rules and nsswitch.conf for virt-handler
- Only create 1MiB-aligned disk images (bsc#1199603)
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1655899200">- Update to version 0.54.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0
- Drop upstreamed patches
  0001-improve-kubevirt-update-test.patch
  0002-use-semantic-equality-comparison.patch
  0003-Avoid-to-return-nil-failure-message.patch
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Add CVE fixes
  0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528)
  0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460)
  0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659528000">- Update libvirt-go to fix memory leak
  0004-Update-libvirt-go-to-fix-memory-leak.patch
- Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516)
  0005-Improve-non-root-path-handling</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659960000">- Support topology spread constraints
  0006-topology-spread-constraints.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1661947200">- Fix containerdisk unmount logic
  0007-Fix-containerdisk-unmount-logic.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1675252800">- Cleanup node labels properly
  0008-Fix-node-labeller-bug-Remove-proper-labels-search-fo.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1675944000">- Fix SEV device exposure
  0009-Respect-the-feature-gate-when-exposing-SEV-device.patch</changelog>
</package>
<package pkgid="5f5c2bc4ebd810de1a8d88dec02a94da06b8784e06e97c6c405609dfd80eacd5" name="kubevirt-manifests" arch="x86_64">
  <version epoch="0" ver="0.54.0" rel="150400.3.7.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1620302400">- Install virt-launcher SELinux policy (bsc#1185714)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621252800">- Do not package OLM manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1624968000">- Add REGISTRY variable
- Use registry.suse.com as the default fallback for sle
- Rename macro registry_path to kubevirt_registry_path</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1625227200">- Generate meta info for containers during rpm build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1630929600">- Update to version 0.44.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.44.1
- Drop patches:
  dont-build-virtctl-darwin.patch
  dont-use-bazel-in-build-manifests.patch
  fix-double-free-of-VirDomain.patch
  fix-virsh-domcapabilities-error.patch (bsc#1185119)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1631188800">- Update to version 0.45.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.45.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1634731200">- Pack only kubevirt-{operator,cr}.yaml into manifests
- Include manifests/testing/* into tests package
- Use disks-images-provider.yaml from upstream
- Allow overwrite the default DNS service in tests
  0001-Allow-overwrite-the-default-DNS-service-in-tests.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1638360000">- Detect SLE15 SP4 build environment
- Update to version 0.47.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.47.1
- Drop 0001-Allow-overwrite-the-default-DNS-service-in-tests.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639656000">- Update to version 0.48.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.48.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641988800">- Update to version 0.49.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.49.0
  Includes the fix for CVE-2021-43565 (bsc#1193930)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645444800">- Allow to configure utility containers for update test
  0001-improve-kubevirt-update-test.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645531200">- Drop kubevirt-psp-caasp.yaml</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Use semantic equality comparison
  0002-use-semantic-equality-comparison.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393601">- Avoid to return nil failure message
  0003-Avoid-to-return-nil-failure-message.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393602">- Increase storage requirements in _constraints
- Pack nft rules and nsswitch.conf for virt-handler
- Only create 1MiB-aligned disk images (bsc#1199603)
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1655899200">- Update to version 0.54.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0
- Drop upstreamed patches
  0001-improve-kubevirt-update-test.patch
  0002-use-semantic-equality-comparison.patch
  0003-Avoid-to-return-nil-failure-message.patch
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Add CVE fixes
  0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528)
  0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460)
  0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659528000">- Update libvirt-go to fix memory leak
  0004-Update-libvirt-go-to-fix-memory-leak.patch
- Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516)
  0005-Improve-non-root-path-handling</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659960000">- Support topology spread constraints
  0006-topology-spread-constraints.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1661947200">- Fix containerdisk unmount logic
  0007-Fix-containerdisk-unmount-logic.patch</changelog>
</package>
<package pkgid="cb4da0c19440f9b17a8213557d8ea7558390796648229e488d8169251c3e92bb" name="kubevirt-virtctl" arch="x86_64">
  <version epoch="0" ver="0.54.0" rel="150400.3.10.4"/>
  <changelog author="vasily.ulyanov@suse.com" date="1624968000">- Add REGISTRY variable
- Use registry.suse.com as the default fallback for sle
- Rename macro registry_path to kubevirt_registry_path</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1625227200">- Generate meta info for containers during rpm build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1630929600">- Update to version 0.44.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.44.1
- Drop patches:
  dont-build-virtctl-darwin.patch
  dont-use-bazel-in-build-manifests.patch
  fix-double-free-of-VirDomain.patch
  fix-virsh-domcapabilities-error.patch (bsc#1185119)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1631188800">- Update to version 0.45.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.45.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1634731200">- Pack only kubevirt-{operator,cr}.yaml into manifests
- Include manifests/testing/* into tests package
- Use disks-images-provider.yaml from upstream
- Allow overwrite the default DNS service in tests
  0001-Allow-overwrite-the-default-DNS-service-in-tests.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1638360000">- Detect SLE15 SP4 build environment
- Update to version 0.47.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.47.1
- Drop 0001-Allow-overwrite-the-default-DNS-service-in-tests.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639656000">- Update to version 0.48.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.48.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641988800">- Update to version 0.49.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.49.0
  Includes the fix for CVE-2021-43565 (bsc#1193930)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645444800">- Allow to configure utility containers for update test
  0001-improve-kubevirt-update-test.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645531200">- Drop kubevirt-psp-caasp.yaml</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Use semantic equality comparison
  0002-use-semantic-equality-comparison.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393601">- Avoid to return nil failure message
  0003-Avoid-to-return-nil-failure-message.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393602">- Increase storage requirements in _constraints
- Pack nft rules and nsswitch.conf for virt-handler
- Only create 1MiB-aligned disk images (bsc#1199603)
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1655899200">- Update to version 0.54.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0
- Drop upstreamed patches
  0001-improve-kubevirt-update-test.patch
  0002-use-semantic-equality-comparison.patch
  0003-Avoid-to-return-nil-failure-message.patch
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Add CVE fixes
  0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528)
  0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460)
  0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659528000">- Update libvirt-go to fix memory leak
  0004-Update-libvirt-go-to-fix-memory-leak.patch
- Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516)
  0005-Improve-non-root-path-handling</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659960000">- Support topology spread constraints
  0006-topology-spread-constraints.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1661947200">- Fix containerdisk unmount logic
  0007-Fix-containerdisk-unmount-logic.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1675252800">- Cleanup node labels properly
  0008-Fix-node-labeller-bug-Remove-proper-labels-search-fo.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1675944000">- Fix SEV device exposure
  0009-Respect-the-feature-gate-when-exposing-SEV-device.patch</changelog>
</package>
<package pkgid="9fcbba1de4098f76a03fca0180474212073b60f4f679be142cf28165cfac6e5b" name="kubevirt-virtctl" arch="x86_64">
  <version epoch="0" ver="0.54.0" rel="150400.3.7.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1620302400">- Install virt-launcher SELinux policy (bsc#1185714)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621252800">- Do not package OLM manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1624968000">- Add REGISTRY variable
- Use registry.suse.com as the default fallback for sle
- Rename macro registry_path to kubevirt_registry_path</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1625227200">- Generate meta info for containers during rpm build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1630929600">- Update to version 0.44.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.44.1
- Drop patches:
  dont-build-virtctl-darwin.patch
  dont-use-bazel-in-build-manifests.patch
  fix-double-free-of-VirDomain.patch
  fix-virsh-domcapabilities-error.patch (bsc#1185119)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1631188800">- Update to version 0.45.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.45.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1634731200">- Pack only kubevirt-{operator,cr}.yaml into manifests
- Include manifests/testing/* into tests package
- Use disks-images-provider.yaml from upstream
- Allow overwrite the default DNS service in tests
  0001-Allow-overwrite-the-default-DNS-service-in-tests.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1638360000">- Detect SLE15 SP4 build environment
- Update to version 0.47.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.47.1
- Drop 0001-Allow-overwrite-the-default-DNS-service-in-tests.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639656000">- Update to version 0.48.1
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.48.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641988800">- Update to version 0.49.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.49.0
  Includes the fix for CVE-2021-43565 (bsc#1193930)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645444800">- Allow to configure utility containers for update test
  0001-improve-kubevirt-update-test.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645531200">- Drop kubevirt-psp-caasp.yaml</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Use semantic equality comparison
  0002-use-semantic-equality-comparison.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393601">- Avoid to return nil failure message
  0003-Avoid-to-return-nil-failure-message.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393602">- Increase storage requirements in _constraints
- Pack nft rules and nsswitch.conf for virt-handler
- Only create 1MiB-aligned disk images (bsc#1199603)
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1655899200">- Update to version 0.54.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0
- Drop upstreamed patches
  0001-improve-kubevirt-update-test.patch
  0002-use-semantic-equality-comparison.patch
  0003-Avoid-to-return-nil-failure-message.patch
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Add CVE fixes
  0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528)
  0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460)
  0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659528000">- Update libvirt-go to fix memory leak
  0004-Update-libvirt-go-to-fix-memory-leak.patch
- Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516)
  0005-Improve-non-root-path-handling</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659960000">- Support topology spread constraints
  0006-topology-spread-constraints.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1661947200">- Fix containerdisk unmount logic
  0007-Fix-containerdisk-unmount-logic.patch</changelog>
</package>
<package pkgid="7b1c9322e6aa2b365ebea33453eeba31e05849307d423c20e036da7a0c452042" name="less" arch="aarch64">
  <version epoch="0" ver="590" rel="150400.3.3.1"/>
  <changelog author="vcizek@suse.com" date="1435233600">- fix a crash in hilite_line (boo#915387)
  * added less-fix_crash_in_hilite_line.patch</changelog>
  <changelog author="astieger@suse.com" date="1446379200">- less 481:
  * Don't overwrite history file; just append to it. This behaves
    better when multiple sessions are running less simultaneously
    and using the same history file.
  * New command ESC-G goes to end of currently buffered data in a
    pipe.
  * Disable history feature when compiled with LESSHISTFILE set to
    "-".
  * In more-compatible mode, make the -p option apply to every file
    opened, not just the first one.
  * In more-compatible mode, change the -e option to work like -E,
    not -EF.
  * Treat multiple CRs before LF are like one CR (all the CRs are
    hidden).
  * Allow "extra" string in lesskey file to append to a multi-char
    command (like a search pattern), without executing the command.
  * Ignore -u/-U setting while viewing help file, so that underline
    and bold chars are displayed correctly.
  * Improve detection of "binary" files in UTF-8 mode.
  * Fix bug with ++ commands.
  * Fix bug where prompt was sometimes not displayed with +G.
  * Fix possible memory corruption
  * Fix bugs and improve performance in ampersand filtering.
  * Allow %% escape sequence in LESSOPEN variable.
  * Automate construction of Unicode tables from Unicode database.
- add keyring and verify source signature
- drop upstream patches:
  * less-458-out_of_bounds_read.patch
  * less-fix_crash_in_hilite_line.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1491307200">- update to version 487
  * New commands ESC-{ and ESC-} to shift to start/end of displayed
    lines.
  * Make search highlights work correctly when changing caselessness
    with -i.
  * New option -Da in Windows version to enable SGR mode.
  * Fix "nothing to search" error when top or bottom line on screen
    is empty.
  * Fix bug when terminal has no "cm" termcap entry.
  * Fix incorrect display when entering double-width chars in search
    string.
  * Fix bug in Unicode handling that missed some double width
    characters.
  * Update Unicode database to 9.0.0.
- remove less-429-widechars.patch that is no longer needed
  (fixed upstream)
- refresh less-429-shell.patch
- get rid of %{name} macro from the patch names</changelog>
  <changelog author="werner@suse.de" date="1493380800">- Extend lesskey with mappings for 8-bit controls key escape sequences</changelog>
  <changelog author="werner@suse.de" date="1509105600">- Let lessopen.sh also handle UTF-8 for (g)roff input, only apparmor
  as breaker of /usr/bin/file re,mains as "file" is not allowed to
  read files within the tool lessopen.sh</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1525003200">- update to version 530 [bsc#1091308]
  * Don't output terminal init sequence if using -F and file fits
    on one screen.
  * When using -S, mark truncated lines with a special character.
    The character can be changed or disabled via the new --rscroll
    option.
  * New command M marks the last line displayed on the screen.
  * New command ESC-m removes a line mark.
  * Status column (enabled via -J) now shows mark letters.
  * Status column shows search matches even if highlighting is
    disabled via -G.
  * A second ESC-u command will clear search match markers in the
    status column.
  * Do same ANSI escape code filtering for tag matching that we do
    for searching, to help when viewing syntax-highlighted code.
  * Catch SIGTERM and clean up before exiting.
  * Fix bug initializing default charset on Windows.
  * Handle keypad ENTER key correctly if it sends something other
    than newline.
  * Fix buffering bug when using stdin with a LESSOPEN pipe.
  * Update Unicode tables to 2017-03-08.
  * Pass-thru Unicode formating chars (Cf type) instead of treating
    them as binary chars. But treat them as binary if -U is set.
  * Fix erroneous binary file warning when UTF-8 file contains ANSI
    SGR sequences.
  * Fix bugs when using LESSOPEN and switching between stdin and
    other files.
  * Fix some bugs handling filenames containing shell metacharacters
  * Fix some memory leaks.
  * Allow some debugging environment variables to be set in lesskey
    file.
  * Code improvements:
  * Use ANSI prototypes in funcs.h declarations.
  * Fix some const mismatches.
  * Remove archaic "register" in variable declarations.
- remove the following patches (applied upstream)
  * less-429-strict_aliasing.patch
  * less-429-terminate.patch
- renumber patches
- remove 'make mkhelp' from the specfile as mkhelp.pl is now
  distributed in the tarball</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1569067200">- less 551:
  * Add --mouse option
  * Add --wheel-lines option
  * Add --no-histdups option
  * Add --save-marks option
  * Support PCRE2 regular expression library
  * Redraw screen on SIGWINCH even if screen size doesn't change
  * Shell-escape filenames in history so they can be used again
  * Ring bell if user enters invalid long option name
  * Use PCRE_UTF8 flag for pcre regular expressions when in UTF-8 mode
  * Don't count lines in initial screen if using -X with -F
  * Fix bug in v command on empty file
  * Fix bug in v command when filename contains shell metacharacters
- refresh less-429-shell.patch</changelog>
  <changelog author="kukuk@suse.com" date="1576065600">- Move lesskey* from /etc to /usr/etc</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1586001600">- less 557:
  * Update Unicode tables
  * Treat Hangul Jamo medial vowels and final consonants as zero width
  * Display error message immediately when -o is toggled and
    input is not a pipe
  * Fix memory corruption when built with libtermcap
  * Support libtinfow</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1589976000">- less 562:
  * Update unicode tables
  * formatting changes in man pages</changelog>
  <changelog author="dmueller@suse.com" date="1597492800">- update to 563:
  * Update Unicode tables.
  * Treat Hangul Jamo medial vowels and final consonants as zero width.
  * Display error message immediately when -o is toggled and
    input is not a pipe.
  * Fix regression: make screen repaint when "squished" and
    a no-movement command is given.
  * Fix erroneous EOF calculation when F command is interrupted.
  * Make WIN32C version include this fix from 551:
    Don't count lines in initial screen if using -X with -F.
  * Fix display bug in WIN32C version.
  * Fix memory corruption when built with libtermcap.
  * Support libtinfow.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1619179200">- less 581:
  * Change ESC-u command to toggle, not disable, highlighting per
    man page
  * Add ESC-U command
  * Add ctrl-W search modifier for wrapping search
  * F command can be interrupted by ^X
  * Support OSC 8 hyperlinks when -R is in effect
  * g command with no number will ignore -j and put first line at
    top of screen
  * Multiple + or -p command line options are handled better
  * Add the --incsearch option
  * Add the --line-num-width option
  * Add the --status-col-width option
  * Add the --use-color and --color options
  * Display -w highlight even if highlighted line is empty
  * If search result is in a long line, scroll to ensure it is
    visible
  * Editing the same file under different names now creates only
    one entry in the file list.
  * Make visual bell more visible on some terminals
  * Ring end-of-file bell no more than once per second
  * Build can use either Python or Perl for Makefile.aut operations
  * Fix crash when using the @ search modifier.
  * Fix crash in the 's' command due to duplicate free
- drop less-429-save_line_position.patch which was never accepted
  upstream due to solving one problem and creating others</changelog>
  <changelog author="dmueller@suse.com" date="1619697600">- update to 581.2:
  * This fixes a bug found in less-581 where the terminal was sometimes left in
    mouse-reporting mode after exiting less.</changelog>
  <changelog author="dmueller@suse.com" date="1621166400">- update to 586:
  * Make less able to read lesskey source files (deprecating lesskey).
  * If XDG_CONFIG_HOME is set, find lesskey source file
    in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey.
  * If XDG_DATA_HOME is set, find and store history file
    in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst.
  * Add the --lesskey-src option.
  * Add the --file-size option.
  * Fix bug which could leave terminal in mouse-reporting mode
    after exiting less.
  * Fix bug which caused failure to respond to window resize.
  * Fix backslash bug searching in tag file.</changelog>
  <changelog author="jengelh@inai.de" date="1623672000">- Remove --with-pic (no static libs are ever produced).</changelog>
  <changelog author="dmueller@suse.com" date="1623931200">- update to 590:
  * Make less able to read lesskey source files (deprecating lesskey).
  * If XDG_CONFIG_HOME is set, find lesskey source file
    in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey.
  * If XDG_DATA_HOME is set, find and store history file
    in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst.
  * Add the --lesskey-src option.
  * Add the --file-size option.
  * With -F, if screen is resized to make file fit on one screen, don't exit.</changelog>
  <changelog author="predivan@mts.rs" date="1625572800">- Fix build on Leap:
    Account for distinction in confdir after UsrMerge.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631793600">- Add missing runtime dependency on which, which it is used by lessopen.sh.
  Fix bsc#1190552.</changelog>
  <changelog author="psimons@suse.com" date="1675771200">- Apply "cve-2022-46663.patch" to fix a vulnerability in less that
  could be exploited for denial-of-service attacks or even remote
  code execution by printing specially crafted escape sequences to
  the terminal. [CVE-2022-46663, bsc#1207815]</changelog>
</package>
<package pkgid="e19b82f90140938aa0f89d30183c206eb3fff48f2946b27f5e90a8587cc91596" name="less" arch="src">
  <version epoch="0" ver="590" rel="150400.3.3.1"/>
  <changelog author="vcizek@suse.com" date="1435233600">- fix a crash in hilite_line (boo#915387)
  * added less-fix_crash_in_hilite_line.patch</changelog>
  <changelog author="astieger@suse.com" date="1446379200">- less 481:
  * Don't overwrite history file; just append to it. This behaves
    better when multiple sessions are running less simultaneously
    and using the same history file.
  * New command ESC-G goes to end of currently buffered data in a
    pipe.
  * Disable history feature when compiled with LESSHISTFILE set to
    "-".
  * In more-compatible mode, make the -p option apply to every file
    opened, not just the first one.
  * In more-compatible mode, change the -e option to work like -E,
    not -EF.
  * Treat multiple CRs before LF are like one CR (all the CRs are
    hidden).
  * Allow "extra" string in lesskey file to append to a multi-char
    command (like a search pattern), without executing the command.
  * Ignore -u/-U setting while viewing help file, so that underline
    and bold chars are displayed correctly.
  * Improve detection of "binary" files in UTF-8 mode.
  * Fix bug with ++ commands.
  * Fix bug where prompt was sometimes not displayed with +G.
  * Fix possible memory corruption
  * Fix bugs and improve performance in ampersand filtering.
  * Allow %% escape sequence in LESSOPEN variable.
  * Automate construction of Unicode tables from Unicode database.
- add keyring and verify source signature
- drop upstream patches:
  * less-458-out_of_bounds_read.patch
  * less-fix_crash_in_hilite_line.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1491307200">- update to version 487
  * New commands ESC-{ and ESC-} to shift to start/end of displayed
    lines.
  * Make search highlights work correctly when changing caselessness
    with -i.
  * New option -Da in Windows version to enable SGR mode.
  * Fix "nothing to search" error when top or bottom line on screen
    is empty.
  * Fix bug when terminal has no "cm" termcap entry.
  * Fix incorrect display when entering double-width chars in search
    string.
  * Fix bug in Unicode handling that missed some double width
    characters.
  * Update Unicode database to 9.0.0.
- remove less-429-widechars.patch that is no longer needed
  (fixed upstream)
- refresh less-429-shell.patch
- get rid of %{name} macro from the patch names</changelog>
  <changelog author="werner@suse.de" date="1493380800">- Extend lesskey with mappings for 8-bit controls key escape sequences</changelog>
  <changelog author="werner@suse.de" date="1509105600">- Let lessopen.sh also handle UTF-8 for (g)roff input, only apparmor
  as breaker of /usr/bin/file re,mains as "file" is not allowed to
  read files within the tool lessopen.sh</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1525003200">- update to version 530 [bsc#1091308]
  * Don't output terminal init sequence if using -F and file fits
    on one screen.
  * When using -S, mark truncated lines with a special character.
    The character can be changed or disabled via the new --rscroll
    option.
  * New command M marks the last line displayed on the screen.
  * New command ESC-m removes a line mark.
  * Status column (enabled via -J) now shows mark letters.
  * Status column shows search matches even if highlighting is
    disabled via -G.
  * A second ESC-u command will clear search match markers in the
    status column.
  * Do same ANSI escape code filtering for tag matching that we do
    for searching, to help when viewing syntax-highlighted code.
  * Catch SIGTERM and clean up before exiting.
  * Fix bug initializing default charset on Windows.
  * Handle keypad ENTER key correctly if it sends something other
    than newline.
  * Fix buffering bug when using stdin with a LESSOPEN pipe.
  * Update Unicode tables to 2017-03-08.
  * Pass-thru Unicode formating chars (Cf type) instead of treating
    them as binary chars. But treat them as binary if -U is set.
  * Fix erroneous binary file warning when UTF-8 file contains ANSI
    SGR sequences.
  * Fix bugs when using LESSOPEN and switching between stdin and
    other files.
  * Fix some bugs handling filenames containing shell metacharacters
  * Fix some memory leaks.
  * Allow some debugging environment variables to be set in lesskey
    file.
  * Code improvements:
  * Use ANSI prototypes in funcs.h declarations.
  * Fix some const mismatches.
  * Remove archaic "register" in variable declarations.
- remove the following patches (applied upstream)
  * less-429-strict_aliasing.patch
  * less-429-terminate.patch
- renumber patches
- remove 'make mkhelp' from the specfile as mkhelp.pl is now
  distributed in the tarball</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1569067200">- less 551:
  * Add --mouse option
  * Add --wheel-lines option
  * Add --no-histdups option
  * Add --save-marks option
  * Support PCRE2 regular expression library
  * Redraw screen on SIGWINCH even if screen size doesn't change
  * Shell-escape filenames in history so they can be used again
  * Ring bell if user enters invalid long option name
  * Use PCRE_UTF8 flag for pcre regular expressions when in UTF-8 mode
  * Don't count lines in initial screen if using -X with -F
  * Fix bug in v command on empty file
  * Fix bug in v command when filename contains shell metacharacters
- refresh less-429-shell.patch</changelog>
  <changelog author="kukuk@suse.com" date="1576065600">- Move lesskey* from /etc to /usr/etc</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1586001600">- less 557:
  * Update Unicode tables
  * Treat Hangul Jamo medial vowels and final consonants as zero width
  * Display error message immediately when -o is toggled and
    input is not a pipe
  * Fix memory corruption when built with libtermcap
  * Support libtinfow</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1589976000">- less 562:
  * Update unicode tables
  * formatting changes in man pages</changelog>
  <changelog author="dmueller@suse.com" date="1597492800">- update to 563:
  * Update Unicode tables.
  * Treat Hangul Jamo medial vowels and final consonants as zero width.
  * Display error message immediately when -o is toggled and
    input is not a pipe.
  * Fix regression: make screen repaint when "squished" and
    a no-movement command is given.
  * Fix erroneous EOF calculation when F command is interrupted.
  * Make WIN32C version include this fix from 551:
    Don't count lines in initial screen if using -X with -F.
  * Fix display bug in WIN32C version.
  * Fix memory corruption when built with libtermcap.
  * Support libtinfow.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1619179200">- less 581:
  * Change ESC-u command to toggle, not disable, highlighting per
    man page
  * Add ESC-U command
  * Add ctrl-W search modifier for wrapping search
  * F command can be interrupted by ^X
  * Support OSC 8 hyperlinks when -R is in effect
  * g command with no number will ignore -j and put first line at
    top of screen
  * Multiple + or -p command line options are handled better
  * Add the --incsearch option
  * Add the --line-num-width option
  * Add the --status-col-width option
  * Add the --use-color and --color options
  * Display -w highlight even if highlighted line is empty
  * If search result is in a long line, scroll to ensure it is
    visible
  * Editing the same file under different names now creates only
    one entry in the file list.
  * Make visual bell more visible on some terminals
  * Ring end-of-file bell no more than once per second
  * Build can use either Python or Perl for Makefile.aut operations
  * Fix crash when using the @ search modifier.
  * Fix crash in the 's' command due to duplicate free
- drop less-429-save_line_position.patch which was never accepted
  upstream due to solving one problem and creating others</changelog>
  <changelog author="dmueller@suse.com" date="1619697600">- update to 581.2:
  * This fixes a bug found in less-581 where the terminal was sometimes left in
    mouse-reporting mode after exiting less.</changelog>
  <changelog author="dmueller@suse.com" date="1621166400">- update to 586:
  * Make less able to read lesskey source files (deprecating lesskey).
  * If XDG_CONFIG_HOME is set, find lesskey source file
    in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey.
  * If XDG_DATA_HOME is set, find and store history file
    in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst.
  * Add the --lesskey-src option.
  * Add the --file-size option.
  * Fix bug which could leave terminal in mouse-reporting mode
    after exiting less.
  * Fix bug which caused failure to respond to window resize.
  * Fix backslash bug searching in tag file.</changelog>
  <changelog author="jengelh@inai.de" date="1623672000">- Remove --with-pic (no static libs are ever produced).</changelog>
  <changelog author="dmueller@suse.com" date="1623931200">- update to 590:
  * Make less able to read lesskey source files (deprecating lesskey).
  * If XDG_CONFIG_HOME is set, find lesskey source file
    in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey.
  * If XDG_DATA_HOME is set, find and store history file
    in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst.
  * Add the --lesskey-src option.
  * Add the --file-size option.
  * With -F, if screen is resized to make file fit on one screen, don't exit.</changelog>
  <changelog author="predivan@mts.rs" date="1625572800">- Fix build on Leap:
    Account for distinction in confdir after UsrMerge.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631793600">- Add missing runtime dependency on which, which it is used by lessopen.sh.
  Fix bsc#1190552.</changelog>
  <changelog author="psimons@suse.com" date="1675771200">- Apply "cve-2022-46663.patch" to fix a vulnerability in less that
  could be exploited for denial-of-service attacks or even remote
  code execution by printing specially crafted escape sequences to
  the terminal. [CVE-2022-46663, bsc#1207815]</changelog>
</package>
<package pkgid="e148b64c918b6f03f3786613c2bed5dd782e0be0d9a2635d060508311ce9e77e" name="less" arch="x86_64">
  <version epoch="0" ver="590" rel="150400.3.3.1"/>
  <changelog author="vcizek@suse.com" date="1435233600">- fix a crash in hilite_line (boo#915387)
  * added less-fix_crash_in_hilite_line.patch</changelog>
  <changelog author="astieger@suse.com" date="1446379200">- less 481:
  * Don't overwrite history file; just append to it. This behaves
    better when multiple sessions are running less simultaneously
    and using the same history file.
  * New command ESC-G goes to end of currently buffered data in a
    pipe.
  * Disable history feature when compiled with LESSHISTFILE set to
    "-".
  * In more-compatible mode, make the -p option apply to every file
    opened, not just the first one.
  * In more-compatible mode, change the -e option to work like -E,
    not -EF.
  * Treat multiple CRs before LF are like one CR (all the CRs are
    hidden).
  * Allow "extra" string in lesskey file to append to a multi-char
    command (like a search pattern), without executing the command.
  * Ignore -u/-U setting while viewing help file, so that underline
    and bold chars are displayed correctly.
  * Improve detection of "binary" files in UTF-8 mode.
  * Fix bug with ++ commands.
  * Fix bug where prompt was sometimes not displayed with +G.
  * Fix possible memory corruption
  * Fix bugs and improve performance in ampersand filtering.
  * Allow %% escape sequence in LESSOPEN variable.
  * Automate construction of Unicode tables from Unicode database.
- add keyring and verify source signature
- drop upstream patches:
  * less-458-out_of_bounds_read.patch
  * less-fix_crash_in_hilite_line.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1491307200">- update to version 487
  * New commands ESC-{ and ESC-} to shift to start/end of displayed
    lines.
  * Make search highlights work correctly when changing caselessness
    with -i.
  * New option -Da in Windows version to enable SGR mode.
  * Fix "nothing to search" error when top or bottom line on screen
    is empty.
  * Fix bug when terminal has no "cm" termcap entry.
  * Fix incorrect display when entering double-width chars in search
    string.
  * Fix bug in Unicode handling that missed some double width
    characters.
  * Update Unicode database to 9.0.0.
- remove less-429-widechars.patch that is no longer needed
  (fixed upstream)
- refresh less-429-shell.patch
- get rid of %{name} macro from the patch names</changelog>
  <changelog author="werner@suse.de" date="1493380800">- Extend lesskey with mappings for 8-bit controls key escape sequences</changelog>
  <changelog author="werner@suse.de" date="1509105600">- Let lessopen.sh also handle UTF-8 for (g)roff input, only apparmor
  as breaker of /usr/bin/file re,mains as "file" is not allowed to
  read files within the tool lessopen.sh</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1525003200">- update to version 530 [bsc#1091308]
  * Don't output terminal init sequence if using -F and file fits
    on one screen.
  * When using -S, mark truncated lines with a special character.
    The character can be changed or disabled via the new --rscroll
    option.
  * New command M marks the last line displayed on the screen.
  * New command ESC-m removes a line mark.
  * Status column (enabled via -J) now shows mark letters.
  * Status column shows search matches even if highlighting is
    disabled via -G.
  * A second ESC-u command will clear search match markers in the
    status column.
  * Do same ANSI escape code filtering for tag matching that we do
    for searching, to help when viewing syntax-highlighted code.
  * Catch SIGTERM and clean up before exiting.
  * Fix bug initializing default charset on Windows.
  * Handle keypad ENTER key correctly if it sends something other
    than newline.
  * Fix buffering bug when using stdin with a LESSOPEN pipe.
  * Update Unicode tables to 2017-03-08.
  * Pass-thru Unicode formating chars (Cf type) instead of treating
    them as binary chars. But treat them as binary if -U is set.
  * Fix erroneous binary file warning when UTF-8 file contains ANSI
    SGR sequences.
  * Fix bugs when using LESSOPEN and switching between stdin and
    other files.
  * Fix some bugs handling filenames containing shell metacharacters
  * Fix some memory leaks.
  * Allow some debugging environment variables to be set in lesskey
    file.
  * Code improvements:
  * Use ANSI prototypes in funcs.h declarations.
  * Fix some const mismatches.
  * Remove archaic "register" in variable declarations.
- remove the following patches (applied upstream)
  * less-429-strict_aliasing.patch
  * less-429-terminate.patch
- renumber patches
- remove 'make mkhelp' from the specfile as mkhelp.pl is now
  distributed in the tarball</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1569067200">- less 551:
  * Add --mouse option
  * Add --wheel-lines option
  * Add --no-histdups option
  * Add --save-marks option
  * Support PCRE2 regular expression library
  * Redraw screen on SIGWINCH even if screen size doesn't change
  * Shell-escape filenames in history so they can be used again
  * Ring bell if user enters invalid long option name
  * Use PCRE_UTF8 flag for pcre regular expressions when in UTF-8 mode
  * Don't count lines in initial screen if using -X with -F
  * Fix bug in v command on empty file
  * Fix bug in v command when filename contains shell metacharacters
- refresh less-429-shell.patch</changelog>
  <changelog author="kukuk@suse.com" date="1576065600">- Move lesskey* from /etc to /usr/etc</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1586001600">- less 557:
  * Update Unicode tables
  * Treat Hangul Jamo medial vowels and final consonants as zero width
  * Display error message immediately when -o is toggled and
    input is not a pipe
  * Fix memory corruption when built with libtermcap
  * Support libtinfow</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1589976000">- less 562:
  * Update unicode tables
  * formatting changes in man pages</changelog>
  <changelog author="dmueller@suse.com" date="1597492800">- update to 563:
  * Update Unicode tables.
  * Treat Hangul Jamo medial vowels and final consonants as zero width.
  * Display error message immediately when -o is toggled and
    input is not a pipe.
  * Fix regression: make screen repaint when "squished" and
    a no-movement command is given.
  * Fix erroneous EOF calculation when F command is interrupted.
  * Make WIN32C version include this fix from 551:
    Don't count lines in initial screen if using -X with -F.
  * Fix display bug in WIN32C version.
  * Fix memory corruption when built with libtermcap.
  * Support libtinfow.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1619179200">- less 581:
  * Change ESC-u command to toggle, not disable, highlighting per
    man page
  * Add ESC-U command
  * Add ctrl-W search modifier for wrapping search
  * F command can be interrupted by ^X
  * Support OSC 8 hyperlinks when -R is in effect
  * g command with no number will ignore -j and put first line at
    top of screen
  * Multiple + or -p command line options are handled better
  * Add the --incsearch option
  * Add the --line-num-width option
  * Add the --status-col-width option
  * Add the --use-color and --color options
  * Display -w highlight even if highlighted line is empty
  * If search result is in a long line, scroll to ensure it is
    visible
  * Editing the same file under different names now creates only
    one entry in the file list.
  * Make visual bell more visible on some terminals
  * Ring end-of-file bell no more than once per second
  * Build can use either Python or Perl for Makefile.aut operations
  * Fix crash when using the @ search modifier.
  * Fix crash in the 's' command due to duplicate free
- drop less-429-save_line_position.patch which was never accepted
  upstream due to solving one problem and creating others</changelog>
  <changelog author="dmueller@suse.com" date="1619697600">- update to 581.2:
  * This fixes a bug found in less-581 where the terminal was sometimes left in
    mouse-reporting mode after exiting less.</changelog>
  <changelog author="dmueller@suse.com" date="1621166400">- update to 586:
  * Make less able to read lesskey source files (deprecating lesskey).
  * If XDG_CONFIG_HOME is set, find lesskey source file
    in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey.
  * If XDG_DATA_HOME is set, find and store history file
    in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst.
  * Add the --lesskey-src option.
  * Add the --file-size option.
  * Fix bug which could leave terminal in mouse-reporting mode
    after exiting less.
  * Fix bug which caused failure to respond to window resize.
  * Fix backslash bug searching in tag file.</changelog>
  <changelog author="jengelh@inai.de" date="1623672000">- Remove --with-pic (no static libs are ever produced).</changelog>
  <changelog author="dmueller@suse.com" date="1623931200">- update to 590:
  * Make less able to read lesskey source files (deprecating lesskey).
  * If XDG_CONFIG_HOME is set, find lesskey source file
    in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey.
  * If XDG_DATA_HOME is set, find and store history file
    in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst.
  * Add the --lesskey-src option.
  * Add the --file-size option.
  * With -F, if screen is resized to make file fit on one screen, don't exit.</changelog>
  <changelog author="predivan@mts.rs" date="1625572800">- Fix build on Leap:
    Account for distinction in confdir after UsrMerge.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631793600">- Add missing runtime dependency on which, which it is used by lessopen.sh.
  Fix bsc#1190552.</changelog>
  <changelog author="psimons@suse.com" date="1675771200">- Apply "cve-2022-46663.patch" to fix a vulnerability in less that
  could be exploited for denial-of-service attacks or even remote
  code execution by printing specially crafted escape sequences to
  the terminal. [CVE-2022-46663, bsc#1207815]</changelog>
</package>
<package pkgid="5150653047ee3ce5b4393a430f742f3d0f64bd4d249d41d744676d37f68a6eb9" name="libX11" arch="src">
  <version epoch="0" ver="1.6.5" rel="150000.3.27.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1370347200">- Update to final version 1.6.0:
  Changes since libX11 1.5 (found in the release candidates) include fixes
  for the recently announced security issues CVE-2013-1981, CVE-2013-1997,
  and CVE-2013-2004; the addition of the _XEatDataWords API for use by
  Xlib-based extension libraries, to help them avoid integer overflows when
  it is necessary to discard data; removal of ancient, unused, incomplete
  support for the Cray Unicos OS, and the DECnet and TLI transport types;
  numerous improvements to compose files and locale data; man page macro
  cleanups to improve compatibility with doclifter; and various other
  code cleanups and compiler warning fixes.</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1375185600">- Update to version 1.6.1:
  This release includes fixes to the code, docs &amp; build system.
  It makes both clang &amp; doclifter happier.  It includes patches
  upstreamed from Ubuntu, NetBSD, and Solaris.</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1378728000">- Update to version 1.6.2:
  This release of libX11 includes a number of fixes to handle realloc() failure
  better, resolves a number of compiler &amp; static analyzer warnings, fixes several
  bugs in the X Input Method framework, and cleans up the XKB code to be a little
  more maintainable.
- Drop upstreamed patches:
  + Patch10: bug-239698_libx11.diff
  + Patch13: bug-221326-xim-sync.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1395662400">- U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch
  * fix typo in en_US Compose file (s/dead_actute/dead_acute/)
    (bnc#869333)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
</package>
<package pkgid="38243651224a223bff8eaec397c57762f180d47cae3e705b767477875fe63be3" name="libX11-6" arch="aarch64">
  <version epoch="0" ver="1.6.5" rel="150000.3.27.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
</package>
<package pkgid="c8e94dadc019282f7165995857f3cb75b1eb85b25371d72079d7710da368841a" name="libX11-6" arch="x86_64">
  <version epoch="0" ver="1.6.5" rel="150000.3.27.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
</package>
<package pkgid="a39d007b5aae1de803cb9b76827a7477152bb121ab7414adb6401f26bcf53db6" name="libX11-data" arch="noarch">
  <version epoch="0" ver="1.6.5" rel="150000.3.27.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
</package>
<package pkgid="a11f38d8ac40e8d35d0e03c750ccf4cdd0ecccf526c1c3439b75d23da3adf59e" name="libX11-xcb1" arch="aarch64">
  <version epoch="0" ver="1.6.5" rel="150000.3.27.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
</package>
<package pkgid="07dff8f1db319ed94d1c53287d7036483bef6823038b35850454380f20d1b4ba" name="libX11-xcb1" arch="x86_64">
  <version epoch="0" ver="1.6.5" rel="150000.3.27.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
</package>
<package pkgid="516237645b6823f271041870280f94866a4860f2a38525becaa4545e107613fe" name="libappindicator3-1" arch="aarch64">
  <version epoch="0" ver="12.10.1+bzr20170215" rel="150200.3.3.1"/>
  <changelog author="schwab@suse.de" date="1425556800">- Allow building without mono support</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1430827200">- Update to 12.10.1+bzr20141110:
  * scroll-event: change parameter to the right type.
- Rebase 0001_Fix_mono_dir.patch.
- Remove no-deprecated.patch: merged upstream.
- Remove dont-build-examples.patch: fixed upstream.
- Minor spec cleanup.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1465819200">- Little spec cleanup.</changelog>
  <changelog author="t.gruner@katodev.de" date="1467892800">- Allow building with mono support in case without mono is set</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1492603200">- Update to version 12.10.1+bzr20170215 (changes since
  12.10.1+bzr20141110):
  * Handle watcher service appearing and disappearing.
  * Make test-simple-app really working.
  * Fix icon and theme paths when running in $SNAP environment
    (lp#1600136).
  * Do not emit label changes when guide is still empty.
  * Do not append the snap prefix if the icon is saved in a well
    known readable path.
- Add libappindicator-activate-support.patch: Open menu on the
  left-click action (lp#1403449).
- Rename python-appindicator to python2-appindicator.</changelog>
  <changelog author="jengelh@inai.de" date="1493380800">- Rename %soname to %sover to better reflect its purpose.
- Update summaries.
- Remove redundant pkgconfig() reqiures; these are already
  autodiscovered.</changelog>
  <changelog author="dimstar@opensuse.org" date="1504526400">- Disable building of -doc subpackage (source not compatible with
  gtk-doc 1.26 - and the doc is available online anyway):
  + Remove gtk-doc BuildRequires.
  + Replace --enable-gtk-doc configure parameter with
  - -disable-gtk-doc,
  + Drop the -doc subpackage.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520683200">- Add libappindicator-no-Werror.patch: the libappindicator code is
  aging and is not keeping up well with the moving world around it.</changelog>
  <changelog author="ximi.obs@gmail.com" date="1547294400">- Changed the activate-support patch to signal an "activate-event"
  so users can create callbacks themselves.
  Original patch from Yichao Yu &lt;yyc1992@gmail.com&gt;.</changelog>
  <changelog author="maurizio.galli@gmail.com" date="1557921600">- Drop libappindicator-activate-support.patch as it's no longer needed and
  breaks context menu / actions in fall-back mode (boo#1132659)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1568808000">- Split gtk2 and gtk3 builds using _multibuild. Python2 and Mono
  bindings are only available for GTK2, so the GTK3 version has
  significantly less build dependencies,
  add only_require_python_for_gtk2.patch
- Drop dependency on deprecated gnome-common, see
  https://wiki.gnome.org/Projects/GnomeCommon/Migration
- Allow configure run to succeed even when gtk-doc is not installed,
  add make_gtk_doc_optional.patch</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1569931200">- Make sure the OBS spec file parser does not apply the gtk3 psuffix
  for the default ("") multibuild flavor.</changelog>
  <changelog author="mailaender@opensuse.org" date="1580644800">- Use the vanilla nunit for compatibility with newer Mono</changelog>
  <changelog author="maurizio.galli@gmail.com" date="1581508800">- Added xappstatusicon.patch. It adds support for XAppStatus Icon by
  Linux Mint.</changelog>
  <changelog author="tchvatal@suse.com" date="1584964800">- Fix build on py2 less system</changelog>
  <changelog author="dleuenberger@suse.com" date="1586433600">- Do not apply xappstatusicon.patch: pulls half of Mate into Ring1.</changelog>
  <changelog author="mliska@suse.cz" date="1586865600">- Add -fcommon in order to fix boo#1164492.</changelog>
  <changelog author="yfjiang@suse.com" date="1673611200">- Provide RH/Fedora used libappindicator-gtk3 symbol required by
  Slack (bsc#1207112).</changelog>
</package>
<package pkgid="8bc0021181e33276b839ba5548ab6f13af444f937808702206017ec6abd02c91" name="libappindicator3-1" arch="x86_64">
  <version epoch="0" ver="12.10.1+bzr20170215" rel="150200.3.3.1"/>
  <changelog author="schwab@suse.de" date="1425556800">- Allow building without mono support</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1430827200">- Update to 12.10.1+bzr20141110:
  * scroll-event: change parameter to the right type.
- Rebase 0001_Fix_mono_dir.patch.
- Remove no-deprecated.patch: merged upstream.
- Remove dont-build-examples.patch: fixed upstream.
- Minor spec cleanup.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1465819200">- Little spec cleanup.</changelog>
  <changelog author="t.gruner@katodev.de" date="1467892800">- Allow building with mono support in case without mono is set</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1492603200">- Update to version 12.10.1+bzr20170215 (changes since
  12.10.1+bzr20141110):
  * Handle watcher service appearing and disappearing.
  * Make test-simple-app really working.
  * Fix icon and theme paths when running in $SNAP environment
    (lp#1600136).
  * Do not emit label changes when guide is still empty.
  * Do not append the snap prefix if the icon is saved in a well
    known readable path.
- Add libappindicator-activate-support.patch: Open menu on the
  left-click action (lp#1403449).
- Rename python-appindicator to python2-appindicator.</changelog>
  <changelog author="jengelh@inai.de" date="1493380800">- Rename %soname to %sover to better reflect its purpose.
- Update summaries.
- Remove redundant pkgconfig() reqiures; these are already
  autodiscovered.</changelog>
  <changelog author="dimstar@opensuse.org" date="1504526400">- Disable building of -doc subpackage (source not compatible with
  gtk-doc 1.26 - and the doc is available online anyway):
  + Remove gtk-doc BuildRequires.
  + Replace --enable-gtk-doc configure parameter with
  - -disable-gtk-doc,
  + Drop the -doc subpackage.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520683200">- Add libappindicator-no-Werror.patch: the libappindicator code is
  aging and is not keeping up well with the moving world around it.</changelog>
  <changelog author="ximi.obs@gmail.com" date="1547294400">- Changed the activate-support patch to signal an "activate-event"
  so users can create callbacks themselves.
  Original patch from Yichao Yu &lt;yyc1992@gmail.com&gt;.</changelog>
  <changelog author="maurizio.galli@gmail.com" date="1557921600">- Drop libappindicator-activate-support.patch as it's no longer needed and
  breaks context menu / actions in fall-back mode (boo#1132659)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1568808000">- Split gtk2 and gtk3 builds using _multibuild. Python2 and Mono
  bindings are only available for GTK2, so the GTK3 version has
  significantly less build dependencies,
  add only_require_python_for_gtk2.patch
- Drop dependency on deprecated gnome-common, see
  https://wiki.gnome.org/Projects/GnomeCommon/Migration
- Allow configure run to succeed even when gtk-doc is not installed,
  add make_gtk_doc_optional.patch</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1569931200">- Make sure the OBS spec file parser does not apply the gtk3 psuffix
  for the default ("") multibuild flavor.</changelog>
  <changelog author="mailaender@opensuse.org" date="1580644800">- Use the vanilla nunit for compatibility with newer Mono</changelog>
  <changelog author="maurizio.galli@gmail.com" date="1581508800">- Added xappstatusicon.patch. It adds support for XAppStatus Icon by
  Linux Mint.</changelog>
  <changelog author="tchvatal@suse.com" date="1584964800">- Fix build on py2 less system</changelog>
  <changelog author="dleuenberger@suse.com" date="1586433600">- Do not apply xappstatusicon.patch: pulls half of Mate into Ring1.</changelog>
  <changelog author="mliska@suse.cz" date="1586865600">- Add -fcommon in order to fix boo#1164492.</changelog>
  <changelog author="yfjiang@suse.com" date="1673611200">- Provide RH/Fedora used libappindicator-gtk3 symbol required by
  Slack (bsc#1207112).</changelog>
</package>
<package pkgid="cd1c5fbddfb76f082996a1c483f3f0bdae59ce982be62422cda5523d8b9fe97a" name="libappindicator3" arch="src">
  <version epoch="0" ver="12.10.1+bzr20170215" rel="150200.3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1394452800">- Fix license; src/generate-id.c is released and distributed under
  GPL-3.0 license</changelog>
  <changelog author="p.drouand@gmail.com" date="1394539200">- Fix appindicator-sharp require in appindicator-sharp-devel</changelog>
  <changelog author="schwab@suse.de" date="1425556800">- Allow building without mono support</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1430827200">- Update to 12.10.1+bzr20141110:
  * scroll-event: change parameter to the right type.
- Rebase 0001_Fix_mono_dir.patch.
- Remove no-deprecated.patch: merged upstream.
- Remove dont-build-examples.patch: fixed upstream.
- Minor spec cleanup.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1465819200">- Little spec cleanup.</changelog>
  <changelog author="t.gruner@katodev.de" date="1467892800">- Allow building with mono support in case without mono is set</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1492603200">- Update to version 12.10.1+bzr20170215 (changes since
  12.10.1+bzr20141110):
  * Handle watcher service appearing and disappearing.
  * Make test-simple-app really working.
  * Fix icon and theme paths when running in $SNAP environment
    (lp#1600136).
  * Do not emit label changes when guide is still empty.
  * Do not append the snap prefix if the icon is saved in a well
    known readable path.
- Add libappindicator-activate-support.patch: Open menu on the
  left-click action (lp#1403449).
- Rename python-appindicator to python2-appindicator.</changelog>
  <changelog author="jengelh@inai.de" date="1493380800">- Rename %soname to %sover to better reflect its purpose.
- Update summaries.
- Remove redundant pkgconfig() reqiures; these are already
  autodiscovered.</changelog>
  <changelog author="dimstar@opensuse.org" date="1504526400">- Disable building of -doc subpackage (source not compatible with
  gtk-doc 1.26 - and the doc is available online anyway):
  + Remove gtk-doc BuildRequires.
  + Replace --enable-gtk-doc configure parameter with
  - -disable-gtk-doc,
  + Drop the -doc subpackage.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520683200">- Add libappindicator-no-Werror.patch: the libappindicator code is
  aging and is not keeping up well with the moving world around it.</changelog>
  <changelog author="ximi.obs@gmail.com" date="1547294400">- Changed the activate-support patch to signal an "activate-event"
  so users can create callbacks themselves.
  Original patch from Yichao Yu &lt;yyc1992@gmail.com&gt;.</changelog>
  <changelog author="maurizio.galli@gmail.com" date="1557921600">- Drop libappindicator-activate-support.patch as it's no longer needed and
  breaks context menu / actions in fall-back mode (boo#1132659)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1568808000">- Split gtk2 and gtk3 builds using _multibuild. Python2 and Mono
  bindings are only available for GTK2, so the GTK3 version has
  significantly less build dependencies,
  add only_require_python_for_gtk2.patch
- Drop dependency on deprecated gnome-common, see
  https://wiki.gnome.org/Projects/GnomeCommon/Migration
- Allow configure run to succeed even when gtk-doc is not installed,
  add make_gtk_doc_optional.patch</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1569931200">- Make sure the OBS spec file parser does not apply the gtk3 psuffix
  for the default ("") multibuild flavor.</changelog>
  <changelog author="mailaender@opensuse.org" date="1580644800">- Use the vanilla nunit for compatibility with newer Mono</changelog>
  <changelog author="maurizio.galli@gmail.com" date="1581508800">- Added xappstatusicon.patch. It adds support for XAppStatus Icon by
  Linux Mint.</changelog>
  <changelog author="tchvatal@suse.com" date="1584964800">- Fix build on py2 less system</changelog>
  <changelog author="dleuenberger@suse.com" date="1586433600">- Do not apply xappstatusicon.patch: pulls half of Mate into Ring1.</changelog>
  <changelog author="mliska@suse.cz" date="1586865600">- Add -fcommon in order to fix boo#1164492.</changelog>
  <changelog author="yfjiang@suse.com" date="1673611200">- Provide RH/Fedora used libappindicator-gtk3 symbol required by
  Slack (bsc#1207112).</changelog>
</package>
<package pkgid="21a9cd390e7d63d6bda78a2cbaed181a084c6d074add2da51e1aa77fe2279d0d" name="libarchive" arch="src">
  <version epoch="0" ver="3.5.1" rel="150400.3.12.1"/>
  <changelog author="jengelh@inai.de" date="1537272000">- Fix RPM groups. Remove idempotent %if..%endif guards.
  Diversify summaries. Set CFLAGS instead of re-defining
  optflags with itself.</changelog>
  <changelog author="kbabioch@suse.de" date="1546516800">- Added patches:
  * CVE-2018-1000877.patch, which fixes a double free vulnerability in RAR
    decoder (CVE-2018-1000877 bsc#1120653)
  * CVE-2018-1000878.patch, which fixes a Use-After-Free vulnerability in RAR
    decoder (CVE-2018-1000878 bsc#1120654)
  * CVE-2018-1000879.patch, which fixes a NULL Pointer Dereference
    vulnerability in ACL parser (CVE-2018-1000879 bsc#1120656)
  * CVE-2018-1000880.patch, which fixes an improper input validation
    vulnerability in WARC parser (CVE-2018-1000880 bsc#1120659)
- Make use of %license macro
- Applied spec-cleaner</changelog>
  <changelog author="adrian@suse.de" date="1549368000">- Added patches:
  * CVE-2019-1000019.patch Fixes 7zip crash (boo#1124341)
  * CVE-2019-1000020.patch ISO9660 infinite loop fixed (boo#1124342)</changelog>
  <changelog author="idonmez@suse.com" date="1560427200">- Update to version 3.4.0
  * Support for file and directory symlinks on Windows
  * Read support for RAR 5.0 archives
  * Read support for ZIPX archives with xz, lzma, ppmd8 and
    bzip2 compression
  * Support for non-recursive list and extract
  * New tar option: --exclude-vcs
  * Improved file attribute support on Linux and file flags support
    on FreeBSD
  * Fix reading Android APK archives (#1055 )
  * Fix problems related to unreadable directories (#1167)
  * A two-digit number of OSS-Fuzz issues was resolved in this release
    including CVE-2019-18408
- Add libarchive.keyring and validate the tarball signature
- Drop all security patches, fixed upstream:
  * CVE-2018-1000877.patch
  * CVE-2018-1000878.patch
  * CVE-2018-1000879.patch
  * CVE-2018-1000880.patch
  * CVE-2019-1000019.patch
  * CVE-2019-1000020.patch</changelog>
  <changelog author="idonmez@suse.com" date="1561032000">- Add lz4 and zstd support
- Add BuildRequires on liblz4-devel and libzstd-devel</changelog>
  <changelog author="idonmez@suse.com" date="1566129600">- Switch to cmake build
- Add lib-suffix.patch to honor LIB_SUFFIX
- Add fix-zstd-test.patch to fix zstd test
- Add fix-soversion.patch to fix the soversion to 13 as autotools</changelog>
  <changelog author="adrian@suse.de" date="1574424000">- fix bsc#1157569
  CVE-2019-19221.patch out-of-bounds read in libarchive</changelog>
  <changelog author="idonmez@suse.com" date="1577707200">- Update to version 3.4.1
  New features:
  * Unicode filename support for reading lha/lzh archives
  * New pax write option "xattrhdr"
  Important bugfixes:
  * security fixes in wide string processing (#1276 #1298)
  * security fixes in RAR5 reader (#1212 #1217 #1296) CVE-2019-19221
  * security fixes and optimizations to write filter logic (#351)
  * security fix related to use of readlink(2) (1dae5a5)
  * sparse file handling fixes (#1218 #1260)
- Drop CVE-2019-19221.patch and fix-zstd-test.patch, fixed upstream</changelog>
  <changelog author="idonmez@suse.com" date="1577707201">- Revert back to autoconf, cmake introduces a cycle. Leave cmake
  patches in since they are basically correct and might be useful
  in the future.</changelog>
  <changelog author="idonmez@suse.com" date="1581508800">- Update to version 3.4.2
  New features:
  * support for atomic file extraction (bsdtar -x --safe-writes) (#1289)
  * support for mbed TLS (PolarSSL) (#1301)
  Important bugfixes:
  * security fixes in RAR5 reader (#1280 #1326)
  * compression buffer fix in XAR writer (#1317)
  * fix uname and gname longer than 32 characters in PAX writer (#1319)
  * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325)
  * fix support for extracting 7z archive entries with Delta filter (#987)</changelog>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647259200">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="danilo.spinella@suse.com" date="1652184000">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1662984000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
</package>
<package pkgid="a9b9124fcf521f00826b6421f4cc6c7628777985ac88531629c0de2df3e51aa1" name="libarchive13" arch="aarch64">
  <version epoch="0" ver="3.5.1" rel="150400.3.12.1"/>
  <changelog author="jengelh@inai.de" date="1537272000">- Fix RPM groups. Remove idempotent %if..%endif guards.
  Diversify summaries. Set CFLAGS instead of re-defining
  optflags with itself.</changelog>
  <changelog author="kbabioch@suse.de" date="1546516800">- Added patches:
  * CVE-2018-1000877.patch, which fixes a double free vulnerability in RAR
    decoder (CVE-2018-1000877 bsc#1120653)
  * CVE-2018-1000878.patch, which fixes a Use-After-Free vulnerability in RAR
    decoder (CVE-2018-1000878 bsc#1120654)
  * CVE-2018-1000879.patch, which fixes a NULL Pointer Dereference
    vulnerability in ACL parser (CVE-2018-1000879 bsc#1120656)
  * CVE-2018-1000880.patch, which fixes an improper input validation
    vulnerability in WARC parser (CVE-2018-1000880 bsc#1120659)
- Make use of %license macro
- Applied spec-cleaner</changelog>
  <changelog author="adrian@suse.de" date="1549368000">- Added patches:
  * CVE-2019-1000019.patch Fixes 7zip crash (boo#1124341)
  * CVE-2019-1000020.patch ISO9660 infinite loop fixed (boo#1124342)</changelog>
  <changelog author="idonmez@suse.com" date="1560427200">- Update to version 3.4.0
  * Support for file and directory symlinks on Windows
  * Read support for RAR 5.0 archives
  * Read support for ZIPX archives with xz, lzma, ppmd8 and
    bzip2 compression
  * Support for non-recursive list and extract
  * New tar option: --exclude-vcs
  * Improved file attribute support on Linux and file flags support
    on FreeBSD
  * Fix reading Android APK archives (#1055 )
  * Fix problems related to unreadable directories (#1167)
  * A two-digit number of OSS-Fuzz issues was resolved in this release
    including CVE-2019-18408
- Add libarchive.keyring and validate the tarball signature
- Drop all security patches, fixed upstream:
  * CVE-2018-1000877.patch
  * CVE-2018-1000878.patch
  * CVE-2018-1000879.patch
  * CVE-2018-1000880.patch
  * CVE-2019-1000019.patch
  * CVE-2019-1000020.patch</changelog>
  <changelog author="idonmez@suse.com" date="1561032000">- Add lz4 and zstd support
- Add BuildRequires on liblz4-devel and libzstd-devel</changelog>
  <changelog author="idonmez@suse.com" date="1566129600">- Switch to cmake build
- Add lib-suffix.patch to honor LIB_SUFFIX
- Add fix-zstd-test.patch to fix zstd test
- Add fix-soversion.patch to fix the soversion to 13 as autotools</changelog>
  <changelog author="adrian@suse.de" date="1574424000">- fix bsc#1157569
  CVE-2019-19221.patch out-of-bounds read in libarchive</changelog>
  <changelog author="idonmez@suse.com" date="1577707200">- Update to version 3.4.1
  New features:
  * Unicode filename support for reading lha/lzh archives
  * New pax write option "xattrhdr"
  Important bugfixes:
  * security fixes in wide string processing (#1276 #1298)
  * security fixes in RAR5 reader (#1212 #1217 #1296) CVE-2019-19221
  * security fixes and optimizations to write filter logic (#351)
  * security fix related to use of readlink(2) (1dae5a5)
  * sparse file handling fixes (#1218 #1260)
- Drop CVE-2019-19221.patch and fix-zstd-test.patch, fixed upstream</changelog>
  <changelog author="idonmez@suse.com" date="1577707201">- Revert back to autoconf, cmake introduces a cycle. Leave cmake
  patches in since they are basically correct and might be useful
  in the future.</changelog>
  <changelog author="idonmez@suse.com" date="1581508800">- Update to version 3.4.2
  New features:
  * support for atomic file extraction (bsdtar -x --safe-writes) (#1289)
  * support for mbed TLS (PolarSSL) (#1301)
  Important bugfixes:
  * security fixes in RAR5 reader (#1280 #1326)
  * compression buffer fix in XAR writer (#1317)
  * fix uname and gname longer than 32 characters in PAX writer (#1319)
  * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325)
  * fix support for extracting 7z archive entries with Delta filter (#987)</changelog>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647259200">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="danilo.spinella@suse.com" date="1652184000">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1662984000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
</package>
<package pkgid="117fce5a88c81616e7ca8a8280e3f26a41a48ef2234c6bbb4a0aa3ca240148c0" name="libarchive13" arch="x86_64">
  <version epoch="0" ver="3.5.1" rel="150400.3.12.1"/>
  <changelog author="jengelh@inai.de" date="1537272000">- Fix RPM groups. Remove idempotent %if..%endif guards.
  Diversify summaries. Set CFLAGS instead of re-defining
  optflags with itself.</changelog>
  <changelog author="kbabioch@suse.de" date="1546516800">- Added patches:
  * CVE-2018-1000877.patch, which fixes a double free vulnerability in RAR
    decoder (CVE-2018-1000877 bsc#1120653)
  * CVE-2018-1000878.patch, which fixes a Use-After-Free vulnerability in RAR
    decoder (CVE-2018-1000878 bsc#1120654)
  * CVE-2018-1000879.patch, which fixes a NULL Pointer Dereference
    vulnerability in ACL parser (CVE-2018-1000879 bsc#1120656)
  * CVE-2018-1000880.patch, which fixes an improper input validation
    vulnerability in WARC parser (CVE-2018-1000880 bsc#1120659)
- Make use of %license macro
- Applied spec-cleaner</changelog>
  <changelog author="adrian@suse.de" date="1549368000">- Added patches:
  * CVE-2019-1000019.patch Fixes 7zip crash (boo#1124341)
  * CVE-2019-1000020.patch ISO9660 infinite loop fixed (boo#1124342)</changelog>
  <changelog author="idonmez@suse.com" date="1560427200">- Update to version 3.4.0
  * Support for file and directory symlinks on Windows
  * Read support for RAR 5.0 archives
  * Read support for ZIPX archives with xz, lzma, ppmd8 and
    bzip2 compression
  * Support for non-recursive list and extract
  * New tar option: --exclude-vcs
  * Improved file attribute support on Linux and file flags support
    on FreeBSD
  * Fix reading Android APK archives (#1055 )
  * Fix problems related to unreadable directories (#1167)
  * A two-digit number of OSS-Fuzz issues was resolved in this release
    including CVE-2019-18408
- Add libarchive.keyring and validate the tarball signature
- Drop all security patches, fixed upstream:
  * CVE-2018-1000877.patch
  * CVE-2018-1000878.patch
  * CVE-2018-1000879.patch
  * CVE-2018-1000880.patch
  * CVE-2019-1000019.patch
  * CVE-2019-1000020.patch</changelog>
  <changelog author="idonmez@suse.com" date="1561032000">- Add lz4 and zstd support
- Add BuildRequires on liblz4-devel and libzstd-devel</changelog>
  <changelog author="idonmez@suse.com" date="1566129600">- Switch to cmake build
- Add lib-suffix.patch to honor LIB_SUFFIX
- Add fix-zstd-test.patch to fix zstd test
- Add fix-soversion.patch to fix the soversion to 13 as autotools</changelog>
  <changelog author="adrian@suse.de" date="1574424000">- fix bsc#1157569
  CVE-2019-19221.patch out-of-bounds read in libarchive</changelog>
  <changelog author="idonmez@suse.com" date="1577707200">- Update to version 3.4.1
  New features:
  * Unicode filename support for reading lha/lzh archives
  * New pax write option "xattrhdr"
  Important bugfixes:
  * security fixes in wide string processing (#1276 #1298)
  * security fixes in RAR5 reader (#1212 #1217 #1296) CVE-2019-19221
  * security fixes and optimizations to write filter logic (#351)
  * security fix related to use of readlink(2) (1dae5a5)
  * sparse file handling fixes (#1218 #1260)
- Drop CVE-2019-19221.patch and fix-zstd-test.patch, fixed upstream</changelog>
  <changelog author="idonmez@suse.com" date="1577707201">- Revert back to autoconf, cmake introduces a cycle. Leave cmake
  patches in since they are basically correct and might be useful
  in the future.</changelog>
  <changelog author="idonmez@suse.com" date="1581508800">- Update to version 3.4.2
  New features:
  * support for atomic file extraction (bsdtar -x --safe-writes) (#1289)
  * support for mbed TLS (PolarSSL) (#1301)
  Important bugfixes:
  * security fixes in RAR5 reader (#1280 #1326)
  * compression buffer fix in XAR writer (#1317)
  * fix uname and gname longer than 32 characters in PAX writer (#1319)
  * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325)
  * fix support for extracting 7z archive entries with Delta filter (#987)</changelog>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647259200">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="danilo.spinella@suse.com" date="1652184000">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1662984000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
</package>
<package pkgid="6931ea981f76a96e1db3316a7fd24d260d641788aad7931c5d7f11283d9ebceb" name="libblkid1" arch="aarch64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="6953b1b764a4e642426b793e8bebe018d83e5ccf571e8870861d2e58688b8213" name="libblkid1" arch="x86_64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="176f38e3c753aa4ba50b7552310a1f047609675fe20d7412aa418b58dbcb65fd" name="libcares2" arch="aarch64">
  <version epoch="0" ver="1.19.0" rel="150000.3.20.1"/>
  <changelog author="jengelh@inai.de" date="1519128000">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
</package>
<package pkgid="34a1ff50a491aade1b5d3c6b777b803195d69028ef046f92c61cd6b02e868ca4" name="libcares2" arch="x86_64">
  <version epoch="0" ver="1.19.0" rel="150000.3.20.1"/>
  <changelog author="jengelh@inai.de" date="1519128000">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
</package>
<package pkgid="907a67d89abb9591e4cee65570e8dcc89c48b5b14cd31b5e1a8566abbcb1b264" name="libcurl4" arch="aarch64">
  <version epoch="0" ver="7.79.1" rel="150400.5.12.1"/>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622030400">- Update to 7.77.0: [bsc#1186114, CVE-2021-22898]
  [bsc#1186115, bsc#1185579, CVE-2021-22901]
  * Security fixes:
  - CVE-2021-22297: schannel cipher selection surprise
  - CVE-2021-22298: TELNET stack contents disclosure
  - CVE-2021-22901: TLS session caching disaster
  * Changes:
  - configure: make the TLS library choice(s) explicit
  - curl: ignore options asking for SSLv2 or SSLv3
  - hsts: enable by default
  - SSL: support in-memory CA certs for some backends
  - vtls: refuse setting any SSL version
  * Bugfixes:
  - configure: provide --with-openssl, deprecate --with-ssl
  - cookie: CURLOPT_COOKIEFILE set to NULL switches off cookies
  - curl: include libmetalink version in --version output
  - data_pending: check only SECONDARY socket for FTP(S) transfers
  - gnutls: don't allow TLS 1.3 for versions that don't support it
  - gnutls: make setting only the MAX TLS allowed version work
  - http2: fix resource leaks in set_transfer_url() and push_promise()
  - http: limit the initial send amount to used upload buffer size
  - rustls: only return CURLE_AGAIN when TLS session is fully drained
  - rustls: use ALPN
  - schannel: Disable auto credentials; add an option to enable it
  - schannel: Support strong crypto option
  - sectransp: allow cipher name to be specified
  - sockfilt: avoid getting stuck waiting for writable socket</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
</package>
<package pkgid="74148c1e239e632ce723e15e1615d4491dd57a927ecf9cfa11996f011dd8504f" name="libcurl4" arch="x86_64">
  <version epoch="0" ver="7.79.1" rel="150400.5.12.1"/>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622030400">- Update to 7.77.0: [bsc#1186114, CVE-2021-22898]
  [bsc#1186115, bsc#1185579, CVE-2021-22901]
  * Security fixes:
  - CVE-2021-22297: schannel cipher selection surprise
  - CVE-2021-22298: TELNET stack contents disclosure
  - CVE-2021-22901: TLS session caching disaster
  * Changes:
  - configure: make the TLS library choice(s) explicit
  - curl: ignore options asking for SSLv2 or SSLv3
  - hsts: enable by default
  - SSL: support in-memory CA certs for some backends
  - vtls: refuse setting any SSL version
  * Bugfixes:
  - configure: provide --with-openssl, deprecate --with-ssl
  - cookie: CURLOPT_COOKIEFILE set to NULL switches off cookies
  - curl: include libmetalink version in --version output
  - data_pending: check only SECONDARY socket for FTP(S) transfers
  - gnutls: don't allow TLS 1.3 for versions that don't support it
  - gnutls: make setting only the MAX TLS allowed version work
  - http2: fix resource leaks in set_transfer_url() and push_promise()
  - http: limit the initial send amount to used upload buffer size
  - rustls: only return CURLE_AGAIN when TLS session is fully drained
  - rustls: use ALPN
  - schannel: Disable auto credentials; add an option to enable it
  - schannel: Support strong crypto option
  - sectransp: allow cipher name to be specified
  - sockfilt: avoid getting stuck waiting for writable socket</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
</package>
<package pkgid="6990a8400bafdfaa64c79727dd0d1389cf3578deaa7a5338efd92eb20619f5db" name="libcurl4" arch="aarch64">
  <version epoch="0" ver="7.79.1" rel="150400.5.15.1"/>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
</package>
<package pkgid="9d3b621641833c3bd4455090ce5c5d1ff8ea62921c79010a5587b890c24d05a0" name="libcurl4" arch="x86_64">
  <version epoch="0" ver="7.79.1" rel="150400.5.15.1"/>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
</package>
<package pkgid="d56ddf4034f33b0af89a7b0ff9f78c7f0af1f6d4d0337c8abafa6f16d1176201" name="libcurl4" arch="aarch64">
  <version epoch="0" ver="7.79.1" rel="150400.5.18.1"/>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678708800">- Security fixes:
  * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection
    Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch
  * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy
    Add curl-CVE-2023-27534.patch
  * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse
    Add curl-CVE-2023-27535.patch
  * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use
    Add curl-CVE-2023-27536.patch
  * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still
    Add curl-CVE-2023-27538.patch</changelog>
</package>
<package pkgid="3bdd5b0594e47e616b7d8b434b6154f5ac35b6141144099e492972a7440a8400" name="libcurl4" arch="x86_64">
  <version epoch="0" ver="7.79.1" rel="150400.5.18.1"/>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626868800">- Update to 7.78.0:
  [bsc#1188217, CVE-2021-22922][bsc#1188218, CVE-2021-22923]
  [bsc#1188219, CVE-2021-22924][bsc#1188220, CVE-2021-22925]
  * Changes:
  - curl_url_set: reject spaces in URLs w/o CURLU_ALLOW_SPACE
  - CURLE_SETOPT_OPTION_SYNTAX: new error name for wrong setopt syntax
  - hostip: make 'localhost' return fixed values
  - mbedtls: add support for cert and key blob options
  - metalink: remove all support for it
  - mqtt: add support for username and password
  * Bugfixes:
  - ares: always store IPv6 addresses first
  - c-hyper: abort CONNECT response reading early on non 2xx responses
  - c-hyper: add support for transfer-encoding in the request
  - c-hyper: bail on too long response headers
  - c-hyper: clear NTLM auth buffer when request is issued
  - c-hyper: fix NTLM on closed connection tested with test159
  - conncache: lowercase the hash key for better match
  - curl_multibyte: Remove local encoding fallbacks
  - Curl_ntlm_core_mk_nt_hash: fix OOM in error path
  - Curl_ssl_getsessionid: fail if no session cache exists
  - easy: during upkeep, attach Curl_easy to connections in the cache
  - gnutls: set the preferred TLS versions in correct order
  - hsts: ignore numberical IP address hosts
  - HSTS: not experimental anymore
  - http2: init recvbuf struct for pushed streams
  - http: fix crash in rate-limited upload
  - http: make the haproxy support work with unix domain sockets
  - http_proxy: deal with non-200 CONNECT response with Hyper
  - lib: don't compare fd to FD_SETSIZE when using poll
  - lib: fix compiler warnings with CURL_DISABLE_NETRC
  - lib: fix type of len passed to *printf's %*s
  - lib: more %u for port and int for %*s fixes
  - lib: use %u instead of %ld for port number printf
  - libssh2: limit time a disconnect can take to 1 second
  - mqtt: detect illegal and too large file size
  - msnprintf: return number of printed characters excluding null byte
  - multi: add scan-build-6 work-around in curl_multi_fdset
  - multi: alter transfer timeout ordering
  - multi: do not switch off connect_only flag when closing
  - multi: fix crash in curl_multi_wait / curl_multi_poll
  - ngtcp2: disable TLSv1.3 compatible mode when using GnuTLS
  - openssl: avoid static variable for seed flag
  - openssl: don't remove session id entry in disassociate
  - socketpair: fix potential hangs
  - socks4: scan for the IPv4 address in resolve results
  - ssl: read pending close notify alert before closing the connection
  - telnet: fix option parser to not send uninitialized contents
  - TLS: prevent shutdown loops to get stuck
  - vtls: exit addsessionid if no cache is inited
  - vtls: fix connection reuse checks for issuer cert and case sensitivity</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707200">- Update to 7.79.0: [bsc#1190213, CVE-2021-22945]
  [bsc#1190373, CVE-2021-22946] [bsc#1190374, CVE-2021-22947]
  * Changes:
  - bearssl: support CURLOPT_CAINFO_BLOB
  - http: consider cookies over localhost to be secure
  - secure transport: support CURLINFO_CERTINFO
  * Bugfixes:
  - CVE-2021-22945: clear the leftovers pointer when sending succeeds
  - CVE-2021-22946: do not ignore --ssl-reqd
  - CVE-2021-22947: reject STARTTLS server response pipelining
  - auth: do not append zero-terminator to authorisation id in kerberos
  - auth: properly handle byte order in kerberos security message
  - auth: use sasl authzid option in kerberos
  - auth: we do not support a security layer after kerberos authentication
  - c-hyper: deal with Expect: 100-continue combined with POSTFIELDS
  - c-hyper: handle HTTP/1.1 =&gt; HTTP/1.0 downgrade on reused connection
  - c-hyper: initial step for 100-continue support
  - c-hyper: initial support for "dumping" 1xx HTTP responses
  - curl-openssl.m4: show correct output for OpenSSL v3
  - docs/MQTT: update state of username/password support
  - docs: the security list is reached at security at curl.se now
  - getparameter: fix the --local-port number parser
  - hostip: Make Curl_ipv6works function independent of getaddrinfo
  - http_proxy: fix the User-Agent inclusion in CONNECT
  - http_proxy: fix user-agent and custom headers for CONNECT with hyper
  - http_proxy: only wait for writable socket while sending request
  - mailing lists: move from cool.haxx.se to lists.haxx.se
  - mbedtls: avoid using a large buffer on the stack
  - mbedTLS: initial 3.0.0 support
  - ngtcp2: remove the acked_crypto_offset struct field init
  - ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read
  - ngtcp2: reset the oustanding send buffer again when drained
  - ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream
  - ngtcp2: stop buffering crypto data
  - ngtcp2: utilize crypto API functions to simplify
  - openssl: when creating a new context, there cannot be an old one
  - scripts: invoke interpreters through /usr/bin/env
  - tests/runtests.pl: cleanup copy&amp;paste mistakes and unused code
  - tests: be explicit about using 'python3' instead of 'python'
  - tool/tests: fix potential year 2038 issues
  - tool_operate: Fix --fail-early with parallel transfers
  - x509asn1: fix heap over-read when parsing x509 certificates
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631707201">- Temporarily disable flaky test 1184
  * See https://github.com/curl/curl/issues/7725</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- Update to 7.79.1:
  * Bugfixes:
  - Curl_http2_setup: don't change connection data on repeat invokes
  - curl_multi_fdset: make FD_SET() not operate on sockets out of range
  - dist: provide lib/.checksrc in the tarball
  - FAQ: add GOPHERS + curl works on data, not files
  - hsts: CURLSTS_FAIL from hsts read callback should fail transfer
  - hsts: handle unlimited expiry
  - http: fix the broken &gt;3 digit response code detection
  - strerror: use sys_errlist instead of strerror on Windows
  - test1184: disable: https://github.com/curl/curl/issues/7725
  - tests/sshserver.pl: make it work with openssh-8.7p1</changelog>
  <changelog author="pmonreal@suse.com" date="1632398400">- Update to 7.79.1 in SLE-15-SP4 [jsc#SLE-21047]
  * Deleted patches fixed in the update:
    curl-CVE-2020-8284.patch curl-CVE-2020-8285.patch
    curl-CVE-2020-8286.patch curl-CVE-2020-8231.patch
    curl-CVE-2020-8177.patch curl-CVE-2020-8169.patch
    curl-CVE-2021-22947.patch curl-CVE-2021-22946.patch
    curl-CVE-2021-22898.patch curl-CVE-2021-22924.patch
    curl-CVE-2021-22925.patch curl-CVE-2021-22876.patch
    curl-CVE-2021-22890.patch curl-X509_V_FLAG_PARTIAL_CHAIN.patch
  * Rebased patches:
    curl-disabled-redirect-protocol-message.patch
    curl-secure-getenv.patch libcurl-ocloexec.patch</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add curl-CVE-2022-27775.patch
- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774.patch
  * Disable test 1568, which is broken by upstream patch.
  - Add curl-CVE-2022-27774-disabletest-1568.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651233600">- Security fix: [bsc#1198608, CVE-2022-27774]
  * Credential leak on redirect
  * Add curl-CVE-2022-27774-2.patch
    + openssl: don't leak the SRP credentials in redirects either
    + this is a follow up patch after the initial patch.</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200734, CVE-2022-32205]
  * Set-Cookie denial of service
  * Add curl-CVE-2022-32205.patch
- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200736, CVE-2022-32207]
  * Unpreserved file permissions
  * Add curl-CVE-2022-32207.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678708800">- Security fixes:
  * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection
    Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch
  * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy
    Add curl-CVE-2023-27534.patch
  * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse
    Add curl-CVE-2023-27535.patch
  * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use
    Add curl-CVE-2023-27536.patch
  * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still
    Add curl-CVE-2023-27538.patch</changelog>
</package>
<package pkgid="81e68887bc334333eaa6af397987ea95316a5e0dfaea3be90e2eff82c4103526" name="libdb-4_8" arch="aarch64">
  <version epoch="0" ver="4.8.30" rel="150000.7.6.1"/>
  <changelog author="coolo@suse.com" date="1374580800">- readd the provides of db-*, we're not going to switch to db 6.0
  too eagerly: http://lwn.net/Articles/557487/</changelog>
  <changelog author="jengelh@inai.de" date="1381233600">- Add update-alternatives rules to db48-utils (bnc#840738)</changelog>
  <changelog author="coolo@suse.com" date="1382356800">- fix update-alternatives usage</changelog>
  <changelog author="schwab@suse.de" date="1399896000">- remove generation of unused tarball
- remove setting of unused variable</changelog>
  <changelog author="tchvatal@suse.com" date="1459425600">- Use upstream tarball
- Cleanup a bit with spec-cleaner
- remove unused script check-build.sh</changelog>
  <changelog author="rguenther@suse.com" date="1520942400">- Add libdb-fix-atomic.patch to fix __atomic_compare_exchange clash
  with GCCs builtin.  Fixes build with GCC8 which now rejects this.</changelog>
  <changelog author="tchvatal@suse.com" date="1545307200">- Fix the license to match up really what is in there</changelog>
  <changelog author="tchvatal@suse.com" date="1566216000">- Remove the getpatches as it does not work at all, oracle
  removed the pages
- Use spec-cleaner
- Fix stripped debuginfo to make sure we can debug with libdb</changelog>
  <changelog author="william.brown@suse.com" date="1566907200">- Add opd deadlock patch as found and documented by Red Hat.
  (bsc#1148244)
  * 0001-OPD-deadlock-RH-BZ-1349779.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668513600">- Security fix: [bsc#1174414, CVE-2019-2708]
  * libdb: Data store execution leads to partial DoS
  * Backport the upsteam commits:
  - Fixed several possible crashes when running db_verify
    on a corrupted database. [#27864]
  - Fixed several possible hangs when running db_verify
    on a corrupted database. [#27864]
  - Added a warning message when attempting to verify a queue
    database which has many extent files. Verification will take
    a long time if there are many extent files. [#27864]
  * Add libdb-4_8-CVE-2019-2708.patch</changelog>
</package>
<package pkgid="0205fdee7a070af95ec9eb98b2d58f06d97d515494a91fe0d1a5d5d4e2e1d2bf" name="libdb-4_8" arch="src">
  <version epoch="0" ver="4.8.30" rel="150000.7.6.1"/>
  <changelog author="jengelh@medozas.de" date="1316174400">- Add libdb-devel to baselibs</changelog>
  <changelog author="prusnak@opensuse.org" date="1317124800">- enable C++ bindings
- spec cleanup</changelog>
  <changelog author="adrian@suse.de" date="1317211200">- fix arm build</changelog>
  <changelog author="coolo@suse.com" date="1324382400">- add autoconf as buildrequire to avoid implicit dependency</changelog>
  <changelog author="jengelh@medozas.de" date="1324555200">- Remove redundant/unwanted tags/section (cf. specfile guidelines)</changelog>
  <changelog author="aj@suse.de" date="1326110400">- Do not use build date as version string.</changelog>
  <changelog author="ro@suse.de" date="1353153600">- fix check-build.sh for kernel &gt; 3.0</changelog>
  <changelog author="jengelh@inai.de" date="1371124800">- Rename db_ binaries to db48_ to make room for libdb-6_0
- Add conflict markers against libdb-4_5 (overlapping files)</changelog>
  <changelog author="werner@suse.de" date="1371556800">- Try to change baselibs.conf to fit coolo's comment hopefully</changelog>
  <changelog author="werner@suse.de" date="1371643200">- Explicit add a conflict to other providers of /usr/lib/libdb.so
  and /usr/lib/libdb-4.so</changelog>
  <changelog author="coolo@suse.com" date="1374580800">- readd the provides of db-*, we're not going to switch to db 6.0
  too eagerly: http://lwn.net/Articles/557487/</changelog>
  <changelog author="jengelh@inai.de" date="1381233600">- Add update-alternatives rules to db48-utils (bnc#840738)</changelog>
  <changelog author="coolo@suse.com" date="1382356800">- fix update-alternatives usage</changelog>
  <changelog author="schwab@suse.de" date="1399896000">- remove generation of unused tarball
- remove setting of unused variable</changelog>
  <changelog author="tchvatal@suse.com" date="1459425600">- Use upstream tarball
- Cleanup a bit with spec-cleaner
- remove unused script check-build.sh</changelog>
  <changelog author="rguenther@suse.com" date="1520942400">- Add libdb-fix-atomic.patch to fix __atomic_compare_exchange clash
  with GCCs builtin.  Fixes build with GCC8 which now rejects this.</changelog>
  <changelog author="tchvatal@suse.com" date="1545307200">- Fix the license to match up really what is in there</changelog>
  <changelog author="tchvatal@suse.com" date="1566216000">- Remove the getpatches as it does not work at all, oracle
  removed the pages
- Use spec-cleaner
- Fix stripped debuginfo to make sure we can debug with libdb</changelog>
  <changelog author="william.brown@suse.com" date="1566907200">- Add opd deadlock patch as found and documented by Red Hat.
  (bsc#1148244)
  * 0001-OPD-deadlock-RH-BZ-1349779.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668513600">- Security fix: [bsc#1174414, CVE-2019-2708]
  * libdb: Data store execution leads to partial DoS
  * Backport the upsteam commits:
  - Fixed several possible crashes when running db_verify
    on a corrupted database. [#27864]
  - Fixed several possible hangs when running db_verify
    on a corrupted database. [#27864]
  - Added a warning message when attempting to verify a queue
    database which has many extent files. Verification will take
    a long time if there are many extent files. [#27864]
  * Add libdb-4_8-CVE-2019-2708.patch</changelog>
</package>
<package pkgid="bdef2597cd89294d01d6e03ca0baa1eea8cd4349290753917ffe4a9ec55c5d79" name="libdb-4_8" arch="x86_64">
  <version epoch="0" ver="4.8.30" rel="150000.7.6.1"/>
  <changelog author="coolo@suse.com" date="1374580800">- readd the provides of db-*, we're not going to switch to db 6.0
  too eagerly: http://lwn.net/Articles/557487/</changelog>
  <changelog author="jengelh@inai.de" date="1381233600">- Add update-alternatives rules to db48-utils (bnc#840738)</changelog>
  <changelog author="coolo@suse.com" date="1382356800">- fix update-alternatives usage</changelog>
  <changelog author="schwab@suse.de" date="1399896000">- remove generation of unused tarball
- remove setting of unused variable</changelog>
  <changelog author="tchvatal@suse.com" date="1459425600">- Use upstream tarball
- Cleanup a bit with spec-cleaner
- remove unused script check-build.sh</changelog>
  <changelog author="rguenther@suse.com" date="1520942400">- Add libdb-fix-atomic.patch to fix __atomic_compare_exchange clash
  with GCCs builtin.  Fixes build with GCC8 which now rejects this.</changelog>
  <changelog author="tchvatal@suse.com" date="1545307200">- Fix the license to match up really what is in there</changelog>
  <changelog author="tchvatal@suse.com" date="1566216000">- Remove the getpatches as it does not work at all, oracle
  removed the pages
- Use spec-cleaner
- Fix stripped debuginfo to make sure we can debug with libdb</changelog>
  <changelog author="william.brown@suse.com" date="1566907200">- Add opd deadlock patch as found and documented by Red Hat.
  (bsc#1148244)
  * 0001-OPD-deadlock-RH-BZ-1349779.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668513600">- Security fix: [bsc#1174414, CVE-2019-2708]
  * libdb: Data store execution leads to partial DoS
  * Backport the upsteam commits:
  - Fixed several possible crashes when running db_verify
    on a corrupted database. [#27864]
  - Fixed several possible hangs when running db_verify
    on a corrupted database. [#27864]
  - Added a warning message when attempting to verify a queue
    database which has many extent files. Verification will take
    a long time if there are many extent files. [#27864]
  * Add libdb-4_8-CVE-2019-2708.patch</changelog>
</package>
<package pkgid="5564fcc36c1d0a1e10957b26d43cdb828976c093c9015c54bbab75996b0fbfe1" name="libdevmapper-event1_03" arch="aarch64">
  <version epoch="0" ver="2.03.05_1.02.163" rel="150400.185.1"/>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1647172800">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  + change lvm.conf item external_device_info_source from none to udev
  + bug-1179691_config-set-external_device_info_source-none.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1659528000">- lvm reports udev database has incomplete information on devices (bsc#1202011)
  + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1664193600">- lvmlockd is not supporting sanlock (bsc#1203482)
  - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="187799e781e3274db06c4c0ebcf19a9f2e6b73e010b470ea2f28d39d8905c400" name="libdevmapper-event1_03" arch="x86_64">
  <version epoch="0" ver="2.03.05_1.02.163" rel="150400.185.1"/>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1647172800">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  + change lvm.conf item external_device_info_source from none to udev
  + bug-1179691_config-set-external_device_info_source-none.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1659528000">- lvm reports udev database has incomplete information on devices (bsc#1202011)
  + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1664193600">- lvmlockd is not supporting sanlock (bsc#1203482)
  - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="d852f02adfaa7947a6ece6f51a514bc8a70c1a1d7078cb914c55042bc2c5376d" name="libdevmapper1_03" arch="aarch64">
  <version epoch="0" ver="2.03.05_1.02.163" rel="150400.185.1"/>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1647172800">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  + change lvm.conf item external_device_info_source from none to udev
  + bug-1179691_config-set-external_device_info_source-none.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1659528000">- lvm reports udev database has incomplete information on devices (bsc#1202011)
  + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1664193600">- lvmlockd is not supporting sanlock (bsc#1203482)
  - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="e83e851629b18493c6dc5d2463d0b1c2ae45ff708434439129b30784e6bc027e" name="libdevmapper1_03" arch="x86_64">
  <version epoch="0" ver="2.03.05_1.02.163" rel="150400.185.1"/>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1647172800">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  + change lvm.conf item external_device_info_source from none to udev
  + bug-1179691_config-set-external_device_info_source-none.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1659528000">- lvm reports udev database has incomplete information on devices (bsc#1202011)
  + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1664193600">- lvmlockd is not supporting sanlock (bsc#1203482)
  - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="098141ed59d1977638f87fe5e04d11ccb55204d5a90dda66e912aa94470c8150" name="libfdisk1" arch="aarch64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="0c0bb065ceec4229d751bb7012edd17555ffe90352777ad2961ed868daadc086" name="libfdisk1" arch="x86_64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="f3d093433ac02c5ad4e913528efacfc3834b05a819756e038f17763690c7f4d8" name="libfreebl3" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="d168aadc6d1fa944ae06629ad84e1d82e5e27e48ca3d07237d6f0b4034464c8f" name="libfreebl3" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="d8df16b15d8d23dbf836188936b314fe3327d2d74e9e2316e1fda6c8891ea375" name="libfreebl3" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="b22175cfecea4ba6782508a3e174d6d9ef9f123947d2564df05682a9a3988b30" name="libfreebl3" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="c53fb2da319562b1389f3b9bd73d8091abfda39c3b8fec23c94a4eaee835ad87" name="libfreebl3" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="c7ae1e6a39a60b24ddf4d368d4de2deb92e1773a9ed7d83021ac2c13ed0f4405" name="libfreebl3" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="d45d0ad15b36b5912146dae86a2b9f7e3e17494fa83b39bea55b32221c85e8d7" name="libfreebl3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="48aedfc9df8bfc1c9be830919aa768b0068ef33815872b7f0e04dee3c2da0564" name="libfreebl3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="b137bda616d71a2bf2b2e7a40ef7a7a78f527d30e2bc64c47f2588161f6c6fdd" name="libfreebl3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="431daa72f13450745eb4189a66153588bc04a1033c90b552949e03882c0524f2" name="libfreebl3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="97ecb57c6f469c3e7a064f08890d3c75a77ee960cb05300fbbe2396a3b7df5b2" name="libfreebl3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="97aef239bf98148d98e619af0aa7a35db14a07ba825bdd1ea7fceb3a74b8e4e6" name="libfreebl3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="73e6dac3ac8dfa163a8b4a3c283fd7e28c824cdbe7d8011f046fbe3e72d19405" name="libgcc_s1" arch="aarch64">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.5.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="1263d90280698c7d15339543715c564b6cff3af739533dcb4991ca48815f18e3" name="libgcc_s1" arch="x86_64">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.5.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="da049faaa6726762ef0f58d480981139c85d5affec9249020e21ce43a2660120" name="libgcc_s1" arch="aarch64">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.7.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="a9545ea1c5490cec9380f1e59fe0ccf2201b5f1f98c179e64b3ef799b361377d" name="libgcc_s1" arch="x86_64">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.7.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="7db6d9a4645dc12a6f7d56b961503ace54fb3e961f366651f0aa746f84e0c342" name="libgcrypt" arch="src">
  <version epoch="0" ver="1.9.4" rel="150400.6.8.1"/>
  <changelog author="pmonreal@suse.com" date="1632225600">- FIPS: Enable hardware support also in FIPS mode [bsc#1187110]
  * Add libgcrypt-FIPS-hw-optimizations.patch
  * Upstream task: https://dev.gnupg.org/T5508</changelog>
  <changelog author="pmonreal@suse.com" date="1632225601">- FIPS: Provide a module name/identifier and version that can be
  mapped to the validation records. [bsc#1190706]
  * Add libgcrypt-FIPS-module-version.patch
  * Upstream task: https://dev.gnupg.org/T5600</changelog>
  <changelog author="pmonreal@suse.com" date="1635422400">- FIPS: Fix regression tests in FIPS mode [bsc#1192131]
  * Add libgcrypt-FIPS-fix-regression-tests.patch
  * Upstream task: https://dev.gnupg.org/T5520</changelog>
  <changelog author="pmonreal@suse.com" date="1635854400">- FIPS: PBKDF requirements [bsc#1185137]
  * The PBKDF2 selftests were introduced in libgcrypt version
    1.9.1 in the function selftest_pbkdf2()
  * Upstream task: https://dev.gnupg.org/T5182</changelog>
  <changelog author="pmonreal@suse.com" date="1636372800">- FIPS: Disable 3DES/Triple-DES in FIPS mode [bsc#1185138]
  * Add libgcrypt-FIPS-disable-3DES.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1637928000">- FIPS: RSA KeyGen/SigGen fail with 4096 bit key sizes [bsc#1192240]
  * rsa: Check RSA keylen constraints for key operations.
  * rsa: Fix regression in not returning an error for prime generation.
  * tests: Add 2k RSA key working in FIPS mode.
  * tests: pubkey: Replace RSA key to one of 2k.
  * tests: pkcs1v2: Skip tests with small keys in FIPS.
  * Add patches:
  - libgcrypt-FIPS-RSA-keylen.patch
  - libgcrypt-FIPS-RSA-keylen-tests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1638273600">- FIPS: Define an entropy source SP800-90B compliant [bsc#1185140]
  * Disable jitter entropy by default in random.conf
  * Disable only-urandom option by default in random.conf</changelog>
  <changelog author="pmonreal@suse.com" date="1638878400">- FIPS: Fix gcry_mpi_sub_ui subtraction [bsc#1193480]
  * gcry_mpi_sub_ui: fix subtracting from negative value
  * Add libgcrypt-FIPS-fix-gcry_mpi_sub_ui.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1642593600">- FIPS: Service level indicator [bsc#1190700]
  * Provide an indicator to check wether the service utilizes an
    approved cryptographic algorithm or not.
  * Add patches:
  - libgcrypt-FIPS-service-indicators.patch
  - libgcrypt-FIPS-verify-unsupported-KDF-test.patch
  - libgcrypt-FIPS-HMAC-short-keylen.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1643716800">- FIPS: Disable DSA in FIPS mode [bsc#1195385]
  * Upstream task: https://dev.gnupg.org/T5710
  * Add libgcrypt-FIPS-disable-DSA.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1647950400">- FIPS: Implement a service indicator for asymmetric ciphers [bsc#1190700]
  * Mark RSA public key encryption and private key decryption with
    padding (e.g. OAEP, PKCS) as non-approved since RSA-OAEP lacks
    peer key assurance validation requirements per SP800-56Brev2.
  * Mark ECC as approved only for NIST curves P-224, P-256, P-384
    and P-521 with check for common NIST names and aliases.
  * Mark DSA, ELG, EDDSA, ECDSA and ECDH as non-approved.
  * Add libgcrypt-FIPS-SLI-pk.patch
  * Rebase libgcrypt-FIPS-service-indicators.patch
- Run the regression tests also in FIPS mode.
  * Disable tests for non-FIPS approved algos.
  * Rebase: libgcrypt-FIPS-verify-unsupported-KDF-test.patch</changelog>
  <changelog author="dennis.knorr@suse.com" date="1649937600">- FIPS: extend the service indicator [bsc#1190700]
  * introduced a pk indicator function
  * adapted the approved and non approved ciphersuites
  * Add libgcrypt_indicators_changes.patch
  * Add libgcrypt-indicate-shake.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659960000">- FIPS: Port libgcrypt to use jitterentropy [bsc#1202117, jsc#SLE-24941]
  * Enable the jitter based entropy generator by default in random.conf
  - Add libgcrypt-jitterentropy-3.3.0.patch
  * Update the internal jitterentropy to version 3.4.0
  - Add libgcrypt-jitterentropy-3.4.0.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661256000">- FIPS: gpg/gpg2 gets out of core handler in FIPS mode while
  typing Tab key to Auto-Completion. [bsc#1182983]
  * Add libgcrypt-out-of-core-handler.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662552000">- FIPS: Zeroize buffer and digest in check_binary_integrity()
  * Add libgcrypt-FIPS-Zeroize-hmac.patch [bsc#1191020]</changelog>
  <changelog author="pmonreal@suse.com" date="1662552001">- FIPS: Check keylength in gcry_fips_indicator_kdf() [bsc#1190700]
  * Consider approved keylength greater or equal to 112 bits.
  * Add libgcrypt-FIPS-kdf-leylength.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662638400">- FIPS: Get most of the entropy from rndjent_poll [bsc#1202117]
  * Add libgcrypt-FIPS-rndjent_poll.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1677931200">- FIPS: PBKDF2: Add additional checks for the minimum key length,
  salt length, iteration count and passphrase length to the kdf
  fips indicator in _gcry_fips_indicator_kdf() [bsc#1208926]
  * Add libgcrypt-FIPS-pkdf2-Additional-checks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678104000">- FIPS: ECDSA: Avoid no-keytest in ECDSA keygen [bsc#1208924]
  * Add libgcrypt-FIPS-ECC-disallow-skip-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678104001">- FIPS: ECC: Transition to error-state if PCT fail [bsc#1208925]
  * Add libgcrypt-FIPS-ECC-PCT-Add-transition-to-error.patch</changelog>
</package>
<package pkgid="ee0d62001ca3e6b2733a11d817f2bbcdbc0700a6fe024b43a5fe0df77c95c6b3" name="libgcrypt20" arch="aarch64">
  <version epoch="0" ver="1.9.4" rel="150400.6.8.1"/>
  <changelog author="pmonreal@suse.com" date="1632225600">- FIPS: Enable hardware support also in FIPS mode [bsc#1187110]
  * Add libgcrypt-FIPS-hw-optimizations.patch
  * Upstream task: https://dev.gnupg.org/T5508</changelog>
  <changelog author="pmonreal@suse.com" date="1632225601">- FIPS: Provide a module name/identifier and version that can be
  mapped to the validation records. [bsc#1190706]
  * Add libgcrypt-FIPS-module-version.patch
  * Upstream task: https://dev.gnupg.org/T5600</changelog>
  <changelog author="pmonreal@suse.com" date="1635422400">- FIPS: Fix regression tests in FIPS mode [bsc#1192131]
  * Add libgcrypt-FIPS-fix-regression-tests.patch
  * Upstream task: https://dev.gnupg.org/T5520</changelog>
  <changelog author="pmonreal@suse.com" date="1635854400">- FIPS: PBKDF requirements [bsc#1185137]
  * The PBKDF2 selftests were introduced in libgcrypt version
    1.9.1 in the function selftest_pbkdf2()
  * Upstream task: https://dev.gnupg.org/T5182</changelog>
  <changelog author="pmonreal@suse.com" date="1636372800">- FIPS: Disable 3DES/Triple-DES in FIPS mode [bsc#1185138]
  * Add libgcrypt-FIPS-disable-3DES.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1637928000">- FIPS: RSA KeyGen/SigGen fail with 4096 bit key sizes [bsc#1192240]
  * rsa: Check RSA keylen constraints for key operations.
  * rsa: Fix regression in not returning an error for prime generation.
  * tests: Add 2k RSA key working in FIPS mode.
  * tests: pubkey: Replace RSA key to one of 2k.
  * tests: pkcs1v2: Skip tests with small keys in FIPS.
  * Add patches:
  - libgcrypt-FIPS-RSA-keylen.patch
  - libgcrypt-FIPS-RSA-keylen-tests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1638273600">- FIPS: Define an entropy source SP800-90B compliant [bsc#1185140]
  * Disable jitter entropy by default in random.conf
  * Disable only-urandom option by default in random.conf</changelog>
  <changelog author="pmonreal@suse.com" date="1638878400">- FIPS: Fix gcry_mpi_sub_ui subtraction [bsc#1193480]
  * gcry_mpi_sub_ui: fix subtracting from negative value
  * Add libgcrypt-FIPS-fix-gcry_mpi_sub_ui.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1642593600">- FIPS: Service level indicator [bsc#1190700]
  * Provide an indicator to check wether the service utilizes an
    approved cryptographic algorithm or not.
  * Add patches:
  - libgcrypt-FIPS-service-indicators.patch
  - libgcrypt-FIPS-verify-unsupported-KDF-test.patch
  - libgcrypt-FIPS-HMAC-short-keylen.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1643716800">- FIPS: Disable DSA in FIPS mode [bsc#1195385]
  * Upstream task: https://dev.gnupg.org/T5710
  * Add libgcrypt-FIPS-disable-DSA.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1647950400">- FIPS: Implement a service indicator for asymmetric ciphers [bsc#1190700]
  * Mark RSA public key encryption and private key decryption with
    padding (e.g. OAEP, PKCS) as non-approved since RSA-OAEP lacks
    peer key assurance validation requirements per SP800-56Brev2.
  * Mark ECC as approved only for NIST curves P-224, P-256, P-384
    and P-521 with check for common NIST names and aliases.
  * Mark DSA, ELG, EDDSA, ECDSA and ECDH as non-approved.
  * Add libgcrypt-FIPS-SLI-pk.patch
  * Rebase libgcrypt-FIPS-service-indicators.patch
- Run the regression tests also in FIPS mode.
  * Disable tests for non-FIPS approved algos.
  * Rebase: libgcrypt-FIPS-verify-unsupported-KDF-test.patch</changelog>
  <changelog author="dennis.knorr@suse.com" date="1649937600">- FIPS: extend the service indicator [bsc#1190700]
  * introduced a pk indicator function
  * adapted the approved and non approved ciphersuites
  * Add libgcrypt_indicators_changes.patch
  * Add libgcrypt-indicate-shake.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659960000">- FIPS: Port libgcrypt to use jitterentropy [bsc#1202117, jsc#SLE-24941]
  * Enable the jitter based entropy generator by default in random.conf
  - Add libgcrypt-jitterentropy-3.3.0.patch
  * Update the internal jitterentropy to version 3.4.0
  - Add libgcrypt-jitterentropy-3.4.0.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661256000">- FIPS: gpg/gpg2 gets out of core handler in FIPS mode while
  typing Tab key to Auto-Completion. [bsc#1182983]
  * Add libgcrypt-out-of-core-handler.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662552000">- FIPS: Zeroize buffer and digest in check_binary_integrity()
  * Add libgcrypt-FIPS-Zeroize-hmac.patch [bsc#1191020]</changelog>
  <changelog author="pmonreal@suse.com" date="1662552001">- FIPS: Check keylength in gcry_fips_indicator_kdf() [bsc#1190700]
  * Consider approved keylength greater or equal to 112 bits.
  * Add libgcrypt-FIPS-kdf-leylength.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662638400">- FIPS: Get most of the entropy from rndjent_poll [bsc#1202117]
  * Add libgcrypt-FIPS-rndjent_poll.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1677931200">- FIPS: PBKDF2: Add additional checks for the minimum key length,
  salt length, iteration count and passphrase length to the kdf
  fips indicator in _gcry_fips_indicator_kdf() [bsc#1208926]
  * Add libgcrypt-FIPS-pkdf2-Additional-checks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678104000">- FIPS: ECDSA: Avoid no-keytest in ECDSA keygen [bsc#1208924]
  * Add libgcrypt-FIPS-ECC-disallow-skip-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678104001">- FIPS: ECC: Transition to error-state if PCT fail [bsc#1208925]
  * Add libgcrypt-FIPS-ECC-PCT-Add-transition-to-error.patch</changelog>
</package>
<package pkgid="b3baf7ef331f97881e854d6edd73923b4dac1b0b3b08705e052772e83358d730" name="libgcrypt20" arch="x86_64">
  <version epoch="0" ver="1.9.4" rel="150400.6.8.1"/>
  <changelog author="pmonreal@suse.com" date="1632225600">- FIPS: Enable hardware support also in FIPS mode [bsc#1187110]
  * Add libgcrypt-FIPS-hw-optimizations.patch
  * Upstream task: https://dev.gnupg.org/T5508</changelog>
  <changelog author="pmonreal@suse.com" date="1632225601">- FIPS: Provide a module name/identifier and version that can be
  mapped to the validation records. [bsc#1190706]
  * Add libgcrypt-FIPS-module-version.patch
  * Upstream task: https://dev.gnupg.org/T5600</changelog>
  <changelog author="pmonreal@suse.com" date="1635422400">- FIPS: Fix regression tests in FIPS mode [bsc#1192131]
  * Add libgcrypt-FIPS-fix-regression-tests.patch
  * Upstream task: https://dev.gnupg.org/T5520</changelog>
  <changelog author="pmonreal@suse.com" date="1635854400">- FIPS: PBKDF requirements [bsc#1185137]
  * The PBKDF2 selftests were introduced in libgcrypt version
    1.9.1 in the function selftest_pbkdf2()
  * Upstream task: https://dev.gnupg.org/T5182</changelog>
  <changelog author="pmonreal@suse.com" date="1636372800">- FIPS: Disable 3DES/Triple-DES in FIPS mode [bsc#1185138]
  * Add libgcrypt-FIPS-disable-3DES.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1637928000">- FIPS: RSA KeyGen/SigGen fail with 4096 bit key sizes [bsc#1192240]
  * rsa: Check RSA keylen constraints for key operations.
  * rsa: Fix regression in not returning an error for prime generation.
  * tests: Add 2k RSA key working in FIPS mode.
  * tests: pubkey: Replace RSA key to one of 2k.
  * tests: pkcs1v2: Skip tests with small keys in FIPS.
  * Add patches:
  - libgcrypt-FIPS-RSA-keylen.patch
  - libgcrypt-FIPS-RSA-keylen-tests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1638273600">- FIPS: Define an entropy source SP800-90B compliant [bsc#1185140]
  * Disable jitter entropy by default in random.conf
  * Disable only-urandom option by default in random.conf</changelog>
  <changelog author="pmonreal@suse.com" date="1638878400">- FIPS: Fix gcry_mpi_sub_ui subtraction [bsc#1193480]
  * gcry_mpi_sub_ui: fix subtracting from negative value
  * Add libgcrypt-FIPS-fix-gcry_mpi_sub_ui.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1642593600">- FIPS: Service level indicator [bsc#1190700]
  * Provide an indicator to check wether the service utilizes an
    approved cryptographic algorithm or not.
  * Add patches:
  - libgcrypt-FIPS-service-indicators.patch
  - libgcrypt-FIPS-verify-unsupported-KDF-test.patch
  - libgcrypt-FIPS-HMAC-short-keylen.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1643716800">- FIPS: Disable DSA in FIPS mode [bsc#1195385]
  * Upstream task: https://dev.gnupg.org/T5710
  * Add libgcrypt-FIPS-disable-DSA.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1647950400">- FIPS: Implement a service indicator for asymmetric ciphers [bsc#1190700]
  * Mark RSA public key encryption and private key decryption with
    padding (e.g. OAEP, PKCS) as non-approved since RSA-OAEP lacks
    peer key assurance validation requirements per SP800-56Brev2.
  * Mark ECC as approved only for NIST curves P-224, P-256, P-384
    and P-521 with check for common NIST names and aliases.
  * Mark DSA, ELG, EDDSA, ECDSA and ECDH as non-approved.
  * Add libgcrypt-FIPS-SLI-pk.patch
  * Rebase libgcrypt-FIPS-service-indicators.patch
- Run the regression tests also in FIPS mode.
  * Disable tests for non-FIPS approved algos.
  * Rebase: libgcrypt-FIPS-verify-unsupported-KDF-test.patch</changelog>
  <changelog author="dennis.knorr@suse.com" date="1649937600">- FIPS: extend the service indicator [bsc#1190700]
  * introduced a pk indicator function
  * adapted the approved and non approved ciphersuites
  * Add libgcrypt_indicators_changes.patch
  * Add libgcrypt-indicate-shake.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659960000">- FIPS: Port libgcrypt to use jitterentropy [bsc#1202117, jsc#SLE-24941]
  * Enable the jitter based entropy generator by default in random.conf
  - Add libgcrypt-jitterentropy-3.3.0.patch
  * Update the internal jitterentropy to version 3.4.0
  - Add libgcrypt-jitterentropy-3.4.0.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661256000">- FIPS: gpg/gpg2 gets out of core handler in FIPS mode while
  typing Tab key to Auto-Completion. [bsc#1182983]
  * Add libgcrypt-out-of-core-handler.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662552000">- FIPS: Zeroize buffer and digest in check_binary_integrity()
  * Add libgcrypt-FIPS-Zeroize-hmac.patch [bsc#1191020]</changelog>
  <changelog author="pmonreal@suse.com" date="1662552001">- FIPS: Check keylength in gcry_fips_indicator_kdf() [bsc#1190700]
  * Consider approved keylength greater or equal to 112 bits.
  * Add libgcrypt-FIPS-kdf-leylength.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662638400">- FIPS: Get most of the entropy from rndjent_poll [bsc#1202117]
  * Add libgcrypt-FIPS-rndjent_poll.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1677931200">- FIPS: PBKDF2: Add additional checks for the minimum key length,
  salt length, iteration count and passphrase length to the kdf
  fips indicator in _gcry_fips_indicator_kdf() [bsc#1208926]
  * Add libgcrypt-FIPS-pkdf2-Additional-checks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678104000">- FIPS: ECDSA: Avoid no-keytest in ECDSA keygen [bsc#1208924]
  * Add libgcrypt-FIPS-ECC-disallow-skip-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678104001">- FIPS: ECC: Transition to error-state if PCT fail [bsc#1208925]
  * Add libgcrypt-FIPS-ECC-PCT-Add-transition-to-error.patch</changelog>
</package>
<package pkgid="3c786200b6c75eae3734c53c07f4c9fb05e97e192d34a522892c1bbcb29e8d3c" name="libgcrypt20-hmac" arch="aarch64">
  <version epoch="0" ver="1.9.4" rel="150400.6.8.1"/>
  <changelog author="pmonreal@suse.com" date="1632225600">- FIPS: Enable hardware support also in FIPS mode [bsc#1187110]
  * Add libgcrypt-FIPS-hw-optimizations.patch
  * Upstream task: https://dev.gnupg.org/T5508</changelog>
  <changelog author="pmonreal@suse.com" date="1632225601">- FIPS: Provide a module name/identifier and version that can be
  mapped to the validation records. [bsc#1190706]
  * Add libgcrypt-FIPS-module-version.patch
  * Upstream task: https://dev.gnupg.org/T5600</changelog>
  <changelog author="pmonreal@suse.com" date="1635422400">- FIPS: Fix regression tests in FIPS mode [bsc#1192131]
  * Add libgcrypt-FIPS-fix-regression-tests.patch
  * Upstream task: https://dev.gnupg.org/T5520</changelog>
  <changelog author="pmonreal@suse.com" date="1635854400">- FIPS: PBKDF requirements [bsc#1185137]
  * The PBKDF2 selftests were introduced in libgcrypt version
    1.9.1 in the function selftest_pbkdf2()
  * Upstream task: https://dev.gnupg.org/T5182</changelog>
  <changelog author="pmonreal@suse.com" date="1636372800">- FIPS: Disable 3DES/Triple-DES in FIPS mode [bsc#1185138]
  * Add libgcrypt-FIPS-disable-3DES.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1637928000">- FIPS: RSA KeyGen/SigGen fail with 4096 bit key sizes [bsc#1192240]
  * rsa: Check RSA keylen constraints for key operations.
  * rsa: Fix regression in not returning an error for prime generation.
  * tests: Add 2k RSA key working in FIPS mode.
  * tests: pubkey: Replace RSA key to one of 2k.
  * tests: pkcs1v2: Skip tests with small keys in FIPS.
  * Add patches:
  - libgcrypt-FIPS-RSA-keylen.patch
  - libgcrypt-FIPS-RSA-keylen-tests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1638273600">- FIPS: Define an entropy source SP800-90B compliant [bsc#1185140]
  * Disable jitter entropy by default in random.conf
  * Disable only-urandom option by default in random.conf</changelog>
  <changelog author="pmonreal@suse.com" date="1638878400">- FIPS: Fix gcry_mpi_sub_ui subtraction [bsc#1193480]
  * gcry_mpi_sub_ui: fix subtracting from negative value
  * Add libgcrypt-FIPS-fix-gcry_mpi_sub_ui.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1642593600">- FIPS: Service level indicator [bsc#1190700]
  * Provide an indicator to check wether the service utilizes an
    approved cryptographic algorithm or not.
  * Add patches:
  - libgcrypt-FIPS-service-indicators.patch
  - libgcrypt-FIPS-verify-unsupported-KDF-test.patch
  - libgcrypt-FIPS-HMAC-short-keylen.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1643716800">- FIPS: Disable DSA in FIPS mode [bsc#1195385]
  * Upstream task: https://dev.gnupg.org/T5710
  * Add libgcrypt-FIPS-disable-DSA.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1647950400">- FIPS: Implement a service indicator for asymmetric ciphers [bsc#1190700]
  * Mark RSA public key encryption and private key decryption with
    padding (e.g. OAEP, PKCS) as non-approved since RSA-OAEP lacks
    peer key assurance validation requirements per SP800-56Brev2.
  * Mark ECC as approved only for NIST curves P-224, P-256, P-384
    and P-521 with check for common NIST names and aliases.
  * Mark DSA, ELG, EDDSA, ECDSA and ECDH as non-approved.
  * Add libgcrypt-FIPS-SLI-pk.patch
  * Rebase libgcrypt-FIPS-service-indicators.patch
- Run the regression tests also in FIPS mode.
  * Disable tests for non-FIPS approved algos.
  * Rebase: libgcrypt-FIPS-verify-unsupported-KDF-test.patch</changelog>
  <changelog author="dennis.knorr@suse.com" date="1649937600">- FIPS: extend the service indicator [bsc#1190700]
  * introduced a pk indicator function
  * adapted the approved and non approved ciphersuites
  * Add libgcrypt_indicators_changes.patch
  * Add libgcrypt-indicate-shake.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659960000">- FIPS: Port libgcrypt to use jitterentropy [bsc#1202117, jsc#SLE-24941]
  * Enable the jitter based entropy generator by default in random.conf
  - Add libgcrypt-jitterentropy-3.3.0.patch
  * Update the internal jitterentropy to version 3.4.0
  - Add libgcrypt-jitterentropy-3.4.0.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661256000">- FIPS: gpg/gpg2 gets out of core handler in FIPS mode while
  typing Tab key to Auto-Completion. [bsc#1182983]
  * Add libgcrypt-out-of-core-handler.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662552000">- FIPS: Zeroize buffer and digest in check_binary_integrity()
  * Add libgcrypt-FIPS-Zeroize-hmac.patch [bsc#1191020]</changelog>
  <changelog author="pmonreal@suse.com" date="1662552001">- FIPS: Check keylength in gcry_fips_indicator_kdf() [bsc#1190700]
  * Consider approved keylength greater or equal to 112 bits.
  * Add libgcrypt-FIPS-kdf-leylength.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662638400">- FIPS: Get most of the entropy from rndjent_poll [bsc#1202117]
  * Add libgcrypt-FIPS-rndjent_poll.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1677931200">- FIPS: PBKDF2: Add additional checks for the minimum key length,
  salt length, iteration count and passphrase length to the kdf
  fips indicator in _gcry_fips_indicator_kdf() [bsc#1208926]
  * Add libgcrypt-FIPS-pkdf2-Additional-checks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678104000">- FIPS: ECDSA: Avoid no-keytest in ECDSA keygen [bsc#1208924]
  * Add libgcrypt-FIPS-ECC-disallow-skip-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678104001">- FIPS: ECC: Transition to error-state if PCT fail [bsc#1208925]
  * Add libgcrypt-FIPS-ECC-PCT-Add-transition-to-error.patch</changelog>
</package>
<package pkgid="6190cfe0762badc1e6567cc9a024810f47dde6b3569840fcb1108ca3a787c1ad" name="libgcrypt20-hmac" arch="x86_64">
  <version epoch="0" ver="1.9.4" rel="150400.6.8.1"/>
  <changelog author="pmonreal@suse.com" date="1632225600">- FIPS: Enable hardware support also in FIPS mode [bsc#1187110]
  * Add libgcrypt-FIPS-hw-optimizations.patch
  * Upstream task: https://dev.gnupg.org/T5508</changelog>
  <changelog author="pmonreal@suse.com" date="1632225601">- FIPS: Provide a module name/identifier and version that can be
  mapped to the validation records. [bsc#1190706]
  * Add libgcrypt-FIPS-module-version.patch
  * Upstream task: https://dev.gnupg.org/T5600</changelog>
  <changelog author="pmonreal@suse.com" date="1635422400">- FIPS: Fix regression tests in FIPS mode [bsc#1192131]
  * Add libgcrypt-FIPS-fix-regression-tests.patch
  * Upstream task: https://dev.gnupg.org/T5520</changelog>
  <changelog author="pmonreal@suse.com" date="1635854400">- FIPS: PBKDF requirements [bsc#1185137]
  * The PBKDF2 selftests were introduced in libgcrypt version
    1.9.1 in the function selftest_pbkdf2()
  * Upstream task: https://dev.gnupg.org/T5182</changelog>
  <changelog author="pmonreal@suse.com" date="1636372800">- FIPS: Disable 3DES/Triple-DES in FIPS mode [bsc#1185138]
  * Add libgcrypt-FIPS-disable-3DES.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1637928000">- FIPS: RSA KeyGen/SigGen fail with 4096 bit key sizes [bsc#1192240]
  * rsa: Check RSA keylen constraints for key operations.
  * rsa: Fix regression in not returning an error for prime generation.
  * tests: Add 2k RSA key working in FIPS mode.
  * tests: pubkey: Replace RSA key to one of 2k.
  * tests: pkcs1v2: Skip tests with small keys in FIPS.
  * Add patches:
  - libgcrypt-FIPS-RSA-keylen.patch
  - libgcrypt-FIPS-RSA-keylen-tests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1638273600">- FIPS: Define an entropy source SP800-90B compliant [bsc#1185140]
  * Disable jitter entropy by default in random.conf
  * Disable only-urandom option by default in random.conf</changelog>
  <changelog author="pmonreal@suse.com" date="1638878400">- FIPS: Fix gcry_mpi_sub_ui subtraction [bsc#1193480]
  * gcry_mpi_sub_ui: fix subtracting from negative value
  * Add libgcrypt-FIPS-fix-gcry_mpi_sub_ui.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1642593600">- FIPS: Service level indicator [bsc#1190700]
  * Provide an indicator to check wether the service utilizes an
    approved cryptographic algorithm or not.
  * Add patches:
  - libgcrypt-FIPS-service-indicators.patch
  - libgcrypt-FIPS-verify-unsupported-KDF-test.patch
  - libgcrypt-FIPS-HMAC-short-keylen.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1643716800">- FIPS: Disable DSA in FIPS mode [bsc#1195385]
  * Upstream task: https://dev.gnupg.org/T5710
  * Add libgcrypt-FIPS-disable-DSA.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1647950400">- FIPS: Implement a service indicator for asymmetric ciphers [bsc#1190700]
  * Mark RSA public key encryption and private key decryption with
    padding (e.g. OAEP, PKCS) as non-approved since RSA-OAEP lacks
    peer key assurance validation requirements per SP800-56Brev2.
  * Mark ECC as approved only for NIST curves P-224, P-256, P-384
    and P-521 with check for common NIST names and aliases.
  * Mark DSA, ELG, EDDSA, ECDSA and ECDH as non-approved.
  * Add libgcrypt-FIPS-SLI-pk.patch
  * Rebase libgcrypt-FIPS-service-indicators.patch
- Run the regression tests also in FIPS mode.
  * Disable tests for non-FIPS approved algos.
  * Rebase: libgcrypt-FIPS-verify-unsupported-KDF-test.patch</changelog>
  <changelog author="dennis.knorr@suse.com" date="1649937600">- FIPS: extend the service indicator [bsc#1190700]
  * introduced a pk indicator function
  * adapted the approved and non approved ciphersuites
  * Add libgcrypt_indicators_changes.patch
  * Add libgcrypt-indicate-shake.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659960000">- FIPS: Port libgcrypt to use jitterentropy [bsc#1202117, jsc#SLE-24941]
  * Enable the jitter based entropy generator by default in random.conf
  - Add libgcrypt-jitterentropy-3.3.0.patch
  * Update the internal jitterentropy to version 3.4.0
  - Add libgcrypt-jitterentropy-3.4.0.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661256000">- FIPS: gpg/gpg2 gets out of core handler in FIPS mode while
  typing Tab key to Auto-Completion. [bsc#1182983]
  * Add libgcrypt-out-of-core-handler.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662552000">- FIPS: Zeroize buffer and digest in check_binary_integrity()
  * Add libgcrypt-FIPS-Zeroize-hmac.patch [bsc#1191020]</changelog>
  <changelog author="pmonreal@suse.com" date="1662552001">- FIPS: Check keylength in gcry_fips_indicator_kdf() [bsc#1190700]
  * Consider approved keylength greater or equal to 112 bits.
  * Add libgcrypt-FIPS-kdf-leylength.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662638400">- FIPS: Get most of the entropy from rndjent_poll [bsc#1202117]
  * Add libgcrypt-FIPS-rndjent_poll.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1677931200">- FIPS: PBKDF2: Add additional checks for the minimum key length,
  salt length, iteration count and passphrase length to the kdf
  fips indicator in _gcry_fips_indicator_kdf() [bsc#1208926]
  * Add libgcrypt-FIPS-pkdf2-Additional-checks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678104000">- FIPS: ECDSA: Avoid no-keytest in ECDSA keygen [bsc#1208924]
  * Add libgcrypt-FIPS-ECC-disallow-skip-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678104001">- FIPS: ECC: Transition to error-state if PCT fail [bsc#1208925]
  * Add libgcrypt-FIPS-ECC-PCT-Add-transition-to-error.patch</changelog>
</package>
<package pkgid="ece331f5d3e2396f306dac0660a628ab2722885c1aa62b1eca5a5453431d1980" name="libgio-2_0-0" arch="aarch64">
  <version epoch="0" ver="2.70.5" rel="150400.3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 2.68.2:
  + Fix building third-party projects against GLib on CentOS 7.
  + Bugs fixed:
  - json-glib does not build with glib 2.68.1.
  - gmacros: check that __cplusplus or _MSC_VER is defined.
  - gmacros: missing check if __STDC_VERSION__ is defined.
  - Backport !2078 ?gthreadedresolver: don't ignore flags in
    lookup_by_name_with_flags? to glib-2-68.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1623412800">- Update to version 2.68.3:
  + Bugs fixed:
  - testfilemonitor test leaks ip_watched_file_t struct
  - GFile: `g_file_replace_contents()` reports
    `G_IO_ERROR_WRONG_ETAG` when saving from a symlink
  - Backport !2128 ?inotify: Fix a memory leak? to glib-2-68
  - Backport !2136 ?tlscertificate: Avoid possible invalid read?
    to glib-2-68
  - Backport !2138 ?glocalfileoutputstream: Fix ETag check when
    replacing through a symlink? to glib-2-68.</changelog>
  <changelog author="dimstar@opensuse.org" date="1626350400">- Silence output in libgio-2_0-0 post scriptlet in case the
  ENV-mimeapps.list files do not exist: we are ready to create them
  in this case. An error message is only confusing.</changelog>
  <changelog author="yfjiang@suse.com" date="1627646400">- Drop patches fixed upstream on SLE and Leap 15.4:
  + glib2-add-support-for-slim-timezone-format.patch
  + glib2-fix-6-days-until-the-end-of-the-month.patch
  + glib2-CVE-2021-27218.patch
  + glib2-CVE-2021-27219-add-g_memdup2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters
  for close_range (boo#1189088).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629460800">- Update to version 2.68.4:
  + Various bugfixes and backports from master.
  + Updated translations.
- Drop 63e7864.patch: fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629720000">- Update to version 2.69.0:
  + Fix a crash in `GKeyFile` when parsing a file which contains
    translations using a `GKeyFile` instance which has loaded
    another file previously.
  + Ensure `dlerror()` is used with locking as it?s not thread-safe
    in some libc implementations.
  + Drop internal libpcre copy in favour of a subproject from
    wrapdb.
  + Optimise grefcount atomic operations.
  + Fix `g_date_time_format()` return value encoding if `LC_TIME`
    is not a UTF-8 locale but other locale settings are.
  + Set app name in freedesktop.org notifications with
    `GNotification`.
  + Add PKCS#11 flags to `GTlsPasswordFlags`.
  - Drop -Dinternal_pcre=false meson parameter: follow upstreams
    build recipe changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720001">- Update to version 2.69.1:
  + Support categories in desktop notifications (`GNotification`)
  + Add `GPowerProfileMonitor` for monitoring when to use less
    power (due to being on battery power, electricity being
    expensive or high-carbon, etc.)
  + Allow static names to be set for `GSource`s to avoid
    unnecessary string copies
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720002">- Update to version 2.69.2:
  + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once
    more not used if the process is `AT_SECURE`
    (setuid/setgid/setcap); this change was previously applied and
    then reverted because it broke gnome-keyring
  + Add `g_test_fail_printf()`, `g_test_skip_printf()`,
    `g_test_incomplete_printf()` helper functions for printing
    messages when tests end prematurely
  + Add portal implementation of `GPowerProfileMonitor`
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1631016000">- Update to version 2.69.3:
  + g_settings_schema_key_range_check() misbehaves for int versus
    bool.
  + Compiling anything with GCC &lt;4.6 spews deprecation warnings.
  + `g_invoke_closure` bindings API break..
  + GPowerProfileMonitorPortal does not notice initial
    power-saver-enabled status.
  + doc: Explicitly said, that no null term. is needed.
  + ci: Use C.UTF-8 locale on FreeBSD 12.
  + gio: Fix conditions in memory-monitor test.
  + Updated translations.</changelog>
  <changelog author="avvissu@yandex.by" date="1631016001">- desktop-file-utils: add Pantheon desktop environment</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.70.0:
  + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635422400">- Update to version 2.70.1:
  + Fix network changes not being signalled from NetworkManager.
  + Fix build when building with --fatal-meson-warnings.
  + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245,
    glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256,
    glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262,
    glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276,
    glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301,
    glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304.
- Refresh patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636545600">- Stop passing fam=true to meson and drop gamin-devel
  BuildRequires, following upstream default. Following this, drop
  libgio-fam sub-package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638532800">- Update to version 2.70.2:
  + Fix use of the default log writer with journald namespaces
  + Fix hang in `dbus-daemon` under `GTestDBus` when
    `G_MESSAGES_DEBUG=all` is set
  + Speed up `g_canonicalize_filename()` to avoid pathogenic cases
    with `..`
  + Fix URI for pcre subproject as it?s moved upstream
  + Fix storing GSettings dictionaries on macOS
  + Speed up ?remove dot segments? algorithm in `GUri` to avoid
    pathogenic cases with `..`
  + Fix infinite loops in D-Bus message parsing for truncated
    inputs
  + Improve correctness of version information returned by
    `g_get_os_info()` for Windows 10/Server 2019+
  + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426,
    glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530,
    glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541,
    glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313,
    glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316,
    glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335,
    glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340,
    glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356,
    glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361,
    glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366,
    glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643198400">- Update to version 2.70.3:
  + Several important fixes to FD handling in gspawn.
  + Several important fixes to GDBus message and GVariant parsing
    of invalid data.
  + Fix potential data loss due to missing fsync when saving files
    on btrfs.
  + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506,
    glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572,
    glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394,
    glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437,
    glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644580800">- Update to version 2.70.4:
  + Bugs fixed: glgo#GNOME/GLib!2462 ?Fix memory leak in
    gio/gdbusauthmechanismsha1.c? to glib-2-70.
  + Updated translations.</changelog>
  <changelog author="dmueller@suse.com" date="1646049600">- Split gtk-docs from -devel package, these are not needed
  during building projects using glib2
- Use _multibuild as the meson buildprocess is very awkward
  regarding the documentation - builds single-jobs only and
  twice (again during %install). This way the rest of distribution
  waiting for glib2-devel to be available is not blocked by this</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.70.5:
  Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537,
  glgo#GNOME/GLib!2555</changelog>
</package>
<package pkgid="5dee47ecf11d8baea949c46571798fdc029e438210b087df446512839dc20faf" name="libgio-2_0-0" arch="x86_64">
  <version epoch="0" ver="2.70.5" rel="150400.3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 2.68.2:
  + Fix building third-party projects against GLib on CentOS 7.
  + Bugs fixed:
  - json-glib does not build with glib 2.68.1.
  - gmacros: check that __cplusplus or _MSC_VER is defined.
  - gmacros: missing check if __STDC_VERSION__ is defined.
  - Backport !2078 ?gthreadedresolver: don't ignore flags in
    lookup_by_name_with_flags? to glib-2-68.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1623412800">- Update to version 2.68.3:
  + Bugs fixed:
  - testfilemonitor test leaks ip_watched_file_t struct
  - GFile: `g_file_replace_contents()` reports
    `G_IO_ERROR_WRONG_ETAG` when saving from a symlink
  - Backport !2128 ?inotify: Fix a memory leak? to glib-2-68
  - Backport !2136 ?tlscertificate: Avoid possible invalid read?
    to glib-2-68
  - Backport !2138 ?glocalfileoutputstream: Fix ETag check when
    replacing through a symlink? to glib-2-68.</changelog>
  <changelog author="dimstar@opensuse.org" date="1626350400">- Silence output in libgio-2_0-0 post scriptlet in case the
  ENV-mimeapps.list files do not exist: we are ready to create them
  in this case. An error message is only confusing.</changelog>
  <changelog author="yfjiang@suse.com" date="1627646400">- Drop patches fixed upstream on SLE and Leap 15.4:
  + glib2-add-support-for-slim-timezone-format.patch
  + glib2-fix-6-days-until-the-end-of-the-month.patch
  + glib2-CVE-2021-27218.patch
  + glib2-CVE-2021-27219-add-g_memdup2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters
  for close_range (boo#1189088).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629460800">- Update to version 2.68.4:
  + Various bugfixes and backports from master.
  + Updated translations.
- Drop 63e7864.patch: fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629720000">- Update to version 2.69.0:
  + Fix a crash in `GKeyFile` when parsing a file which contains
    translations using a `GKeyFile` instance which has loaded
    another file previously.
  + Ensure `dlerror()` is used with locking as it?s not thread-safe
    in some libc implementations.
  + Drop internal libpcre copy in favour of a subproject from
    wrapdb.
  + Optimise grefcount atomic operations.
  + Fix `g_date_time_format()` return value encoding if `LC_TIME`
    is not a UTF-8 locale but other locale settings are.
  + Set app name in freedesktop.org notifications with
    `GNotification`.
  + Add PKCS#11 flags to `GTlsPasswordFlags`.
  - Drop -Dinternal_pcre=false meson parameter: follow upstreams
    build recipe changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720001">- Update to version 2.69.1:
  + Support categories in desktop notifications (`GNotification`)
  + Add `GPowerProfileMonitor` for monitoring when to use less
    power (due to being on battery power, electricity being
    expensive or high-carbon, etc.)
  + Allow static names to be set for `GSource`s to avoid
    unnecessary string copies
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720002">- Update to version 2.69.2:
  + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once
    more not used if the process is `AT_SECURE`
    (setuid/setgid/setcap); this change was previously applied and
    then reverted because it broke gnome-keyring
  + Add `g_test_fail_printf()`, `g_test_skip_printf()`,
    `g_test_incomplete_printf()` helper functions for printing
    messages when tests end prematurely
  + Add portal implementation of `GPowerProfileMonitor`
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1631016000">- Update to version 2.69.3:
  + g_settings_schema_key_range_check() misbehaves for int versus
    bool.
  + Compiling anything with GCC &lt;4.6 spews deprecation warnings.
  + `g_invoke_closure` bindings API break..
  + GPowerProfileMonitorPortal does not notice initial
    power-saver-enabled status.
  + doc: Explicitly said, that no null term. is needed.
  + ci: Use C.UTF-8 locale on FreeBSD 12.
  + gio: Fix conditions in memory-monitor test.
  + Updated translations.</changelog>
  <changelog author="avvissu@yandex.by" date="1631016001">- desktop-file-utils: add Pantheon desktop environment</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.70.0:
  + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635422400">- Update to version 2.70.1:
  + Fix network changes not being signalled from NetworkManager.
  + Fix build when building with --fatal-meson-warnings.
  + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245,
    glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256,
    glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262,
    glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276,
    glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301,
    glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304.
- Refresh patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636545600">- Stop passing fam=true to meson and drop gamin-devel
  BuildRequires, following upstream default. Following this, drop
  libgio-fam sub-package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638532800">- Update to version 2.70.2:
  + Fix use of the default log writer with journald namespaces
  + Fix hang in `dbus-daemon` under `GTestDBus` when
    `G_MESSAGES_DEBUG=all` is set
  + Speed up `g_canonicalize_filename()` to avoid pathogenic cases
    with `..`
  + Fix URI for pcre subproject as it?s moved upstream
  + Fix storing GSettings dictionaries on macOS
  + Speed up ?remove dot segments? algorithm in `GUri` to avoid
    pathogenic cases with `..`
  + Fix infinite loops in D-Bus message parsing for truncated
    inputs
  + Improve correctness of version information returned by
    `g_get_os_info()` for Windows 10/Server 2019+
  + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426,
    glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530,
    glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541,
    glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313,
    glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316,
    glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335,
    glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340,
    glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356,
    glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361,
    glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366,
    glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643198400">- Update to version 2.70.3:
  + Several important fixes to FD handling in gspawn.
  + Several important fixes to GDBus message and GVariant parsing
    of invalid data.
  + Fix potential data loss due to missing fsync when saving files
    on btrfs.
  + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506,
    glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572,
    glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394,
    glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437,
    glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644580800">- Update to version 2.70.4:
  + Bugs fixed: glgo#GNOME/GLib!2462 ?Fix memory leak in
    gio/gdbusauthmechanismsha1.c? to glib-2-70.
  + Updated translations.</changelog>
  <changelog author="dmueller@suse.com" date="1646049600">- Split gtk-docs from -devel package, these are not needed
  during building projects using glib2
- Use _multibuild as the meson buildprocess is very awkward
  regarding the documentation - builds single-jobs only and
  twice (again during %install). This way the rest of distribution
  waiting for glib2-devel to be available is not blocked by this</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.70.5:
  Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537,
  glgo#GNOME/GLib!2555</changelog>
</package>
<package pkgid="31dd24219c78af2d9c3e5dcef7ca667a2f0a05c298422f6341409b99310b1539" name="libglib-2_0-0" arch="aarch64">
  <version epoch="0" ver="2.70.5" rel="150400.3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 2.68.2:
  + Fix building third-party projects against GLib on CentOS 7.
  + Bugs fixed:
  - json-glib does not build with glib 2.68.1.
  - gmacros: check that __cplusplus or _MSC_VER is defined.
  - gmacros: missing check if __STDC_VERSION__ is defined.
  - Backport !2078 ?gthreadedresolver: don't ignore flags in
    lookup_by_name_with_flags? to glib-2-68.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1623412800">- Update to version 2.68.3:
  + Bugs fixed:
  - testfilemonitor test leaks ip_watched_file_t struct
  - GFile: `g_file_replace_contents()` reports
    `G_IO_ERROR_WRONG_ETAG` when saving from a symlink
  - Backport !2128 ?inotify: Fix a memory leak? to glib-2-68
  - Backport !2136 ?tlscertificate: Avoid possible invalid read?
    to glib-2-68
  - Backport !2138 ?glocalfileoutputstream: Fix ETag check when
    replacing through a symlink? to glib-2-68.</changelog>
  <changelog author="dimstar@opensuse.org" date="1626350400">- Silence output in libgio-2_0-0 post scriptlet in case the
  ENV-mimeapps.list files do not exist: we are ready to create them
  in this case. An error message is only confusing.</changelog>
  <changelog author="yfjiang@suse.com" date="1627646400">- Drop patches fixed upstream on SLE and Leap 15.4:
  + glib2-add-support-for-slim-timezone-format.patch
  + glib2-fix-6-days-until-the-end-of-the-month.patch
  + glib2-CVE-2021-27218.patch
  + glib2-CVE-2021-27219-add-g_memdup2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters
  for close_range (boo#1189088).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629460800">- Update to version 2.68.4:
  + Various bugfixes and backports from master.
  + Updated translations.
- Drop 63e7864.patch: fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629720000">- Update to version 2.69.0:
  + Fix a crash in `GKeyFile` when parsing a file which contains
    translations using a `GKeyFile` instance which has loaded
    another file previously.
  + Ensure `dlerror()` is used with locking as it?s not thread-safe
    in some libc implementations.
  + Drop internal libpcre copy in favour of a subproject from
    wrapdb.
  + Optimise grefcount atomic operations.
  + Fix `g_date_time_format()` return value encoding if `LC_TIME`
    is not a UTF-8 locale but other locale settings are.
  + Set app name in freedesktop.org notifications with
    `GNotification`.
  + Add PKCS#11 flags to `GTlsPasswordFlags`.
  - Drop -Dinternal_pcre=false meson parameter: follow upstreams
    build recipe changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720001">- Update to version 2.69.1:
  + Support categories in desktop notifications (`GNotification`)
  + Add `GPowerProfileMonitor` for monitoring when to use less
    power (due to being on battery power, electricity being
    expensive or high-carbon, etc.)
  + Allow static names to be set for `GSource`s to avoid
    unnecessary string copies
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720002">- Update to version 2.69.2:
  + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once
    more not used if the process is `AT_SECURE`
    (setuid/setgid/setcap); this change was previously applied and
    then reverted because it broke gnome-keyring
  + Add `g_test_fail_printf()`, `g_test_skip_printf()`,
    `g_test_incomplete_printf()` helper functions for printing
    messages when tests end prematurely
  + Add portal implementation of `GPowerProfileMonitor`
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1631016000">- Update to version 2.69.3:
  + g_settings_schema_key_range_check() misbehaves for int versus
    bool.
  + Compiling anything with GCC &lt;4.6 spews deprecation warnings.
  + `g_invoke_closure` bindings API break..
  + GPowerProfileMonitorPortal does not notice initial
    power-saver-enabled status.
  + doc: Explicitly said, that no null term. is needed.
  + ci: Use C.UTF-8 locale on FreeBSD 12.
  + gio: Fix conditions in memory-monitor test.
  + Updated translations.</changelog>
  <changelog author="avvissu@yandex.by" date="1631016001">- desktop-file-utils: add Pantheon desktop environment</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.70.0:
  + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635422400">- Update to version 2.70.1:
  + Fix network changes not being signalled from NetworkManager.
  + Fix build when building with --fatal-meson-warnings.
  + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245,
    glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256,
    glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262,
    glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276,
    glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301,
    glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304.
- Refresh patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636545600">- Stop passing fam=true to meson and drop gamin-devel
  BuildRequires, following upstream default. Following this, drop
  libgio-fam sub-package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638532800">- Update to version 2.70.2:
  + Fix use of the default log writer with journald namespaces
  + Fix hang in `dbus-daemon` under `GTestDBus` when
    `G_MESSAGES_DEBUG=all` is set
  + Speed up `g_canonicalize_filename()` to avoid pathogenic cases
    with `..`
  + Fix URI for pcre subproject as it?s moved upstream
  + Fix storing GSettings dictionaries on macOS
  + Speed up ?remove dot segments? algorithm in `GUri` to avoid
    pathogenic cases with `..`
  + Fix infinite loops in D-Bus message parsing for truncated
    inputs
  + Improve correctness of version information returned by
    `g_get_os_info()` for Windows 10/Server 2019+
  + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426,
    glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530,
    glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541,
    glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313,
    glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316,
    glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335,
    glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340,
    glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356,
    glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361,
    glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366,
    glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643198400">- Update to version 2.70.3:
  + Several important fixes to FD handling in gspawn.
  + Several important fixes to GDBus message and GVariant parsing
    of invalid data.
  + Fix potential data loss due to missing fsync when saving files
    on btrfs.
  + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506,
    glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572,
    glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394,
    glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437,
    glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644580800">- Update to version 2.70.4:
  + Bugs fixed: glgo#GNOME/GLib!2462 ?Fix memory leak in
    gio/gdbusauthmechanismsha1.c? to glib-2-70.
  + Updated translations.</changelog>
  <changelog author="dmueller@suse.com" date="1646049600">- Split gtk-docs from -devel package, these are not needed
  during building projects using glib2
- Use _multibuild as the meson buildprocess is very awkward
  regarding the documentation - builds single-jobs only and
  twice (again during %install). This way the rest of distribution
  waiting for glib2-devel to be available is not blocked by this</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.70.5:
  Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537,
  glgo#GNOME/GLib!2555</changelog>
</package>
<package pkgid="59d5fc68efda4717845e4206eb423e6a69939aade66bf1ec7ee5c5c0ccbc9b41" name="libglib-2_0-0" arch="x86_64">
  <version epoch="0" ver="2.70.5" rel="150400.3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 2.68.2:
  + Fix building third-party projects against GLib on CentOS 7.
  + Bugs fixed:
  - json-glib does not build with glib 2.68.1.
  - gmacros: check that __cplusplus or _MSC_VER is defined.
  - gmacros: missing check if __STDC_VERSION__ is defined.
  - Backport !2078 ?gthreadedresolver: don't ignore flags in
    lookup_by_name_with_flags? to glib-2-68.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1623412800">- Update to version 2.68.3:
  + Bugs fixed:
  - testfilemonitor test leaks ip_watched_file_t struct
  - GFile: `g_file_replace_contents()` reports
    `G_IO_ERROR_WRONG_ETAG` when saving from a symlink
  - Backport !2128 ?inotify: Fix a memory leak? to glib-2-68
  - Backport !2136 ?tlscertificate: Avoid possible invalid read?
    to glib-2-68
  - Backport !2138 ?glocalfileoutputstream: Fix ETag check when
    replacing through a symlink? to glib-2-68.</changelog>
  <changelog author="dimstar@opensuse.org" date="1626350400">- Silence output in libgio-2_0-0 post scriptlet in case the
  ENV-mimeapps.list files do not exist: we are ready to create them
  in this case. An error message is only confusing.</changelog>
  <changelog author="yfjiang@suse.com" date="1627646400">- Drop patches fixed upstream on SLE and Leap 15.4:
  + glib2-add-support-for-slim-timezone-format.patch
  + glib2-fix-6-days-until-the-end-of-the-month.patch
  + glib2-CVE-2021-27218.patch
  + glib2-CVE-2021-27219-add-g_memdup2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters
  for close_range (boo#1189088).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629460800">- Update to version 2.68.4:
  + Various bugfixes and backports from master.
  + Updated translations.
- Drop 63e7864.patch: fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629720000">- Update to version 2.69.0:
  + Fix a crash in `GKeyFile` when parsing a file which contains
    translations using a `GKeyFile` instance which has loaded
    another file previously.
  + Ensure `dlerror()` is used with locking as it?s not thread-safe
    in some libc implementations.
  + Drop internal libpcre copy in favour of a subproject from
    wrapdb.
  + Optimise grefcount atomic operations.
  + Fix `g_date_time_format()` return value encoding if `LC_TIME`
    is not a UTF-8 locale but other locale settings are.
  + Set app name in freedesktop.org notifications with
    `GNotification`.
  + Add PKCS#11 flags to `GTlsPasswordFlags`.
  - Drop -Dinternal_pcre=false meson parameter: follow upstreams
    build recipe changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720001">- Update to version 2.69.1:
  + Support categories in desktop notifications (`GNotification`)
  + Add `GPowerProfileMonitor` for monitoring when to use less
    power (due to being on battery power, electricity being
    expensive or high-carbon, etc.)
  + Allow static names to be set for `GSource`s to avoid
    unnecessary string copies
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720002">- Update to version 2.69.2:
  + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once
    more not used if the process is `AT_SECURE`
    (setuid/setgid/setcap); this change was previously applied and
    then reverted because it broke gnome-keyring
  + Add `g_test_fail_printf()`, `g_test_skip_printf()`,
    `g_test_incomplete_printf()` helper functions for printing
    messages when tests end prematurely
  + Add portal implementation of `GPowerProfileMonitor`
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1631016000">- Update to version 2.69.3:
  + g_settings_schema_key_range_check() misbehaves for int versus
    bool.
  + Compiling anything with GCC &lt;4.6 spews deprecation warnings.
  + `g_invoke_closure` bindings API break..
  + GPowerProfileMonitorPortal does not notice initial
    power-saver-enabled status.
  + doc: Explicitly said, that no null term. is needed.
  + ci: Use C.UTF-8 locale on FreeBSD 12.
  + gio: Fix conditions in memory-monitor test.
  + Updated translations.</changelog>
  <changelog author="avvissu@yandex.by" date="1631016001">- desktop-file-utils: add Pantheon desktop environment</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.70.0:
  + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635422400">- Update to version 2.70.1:
  + Fix network changes not being signalled from NetworkManager.
  + Fix build when building with --fatal-meson-warnings.
  + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245,
    glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256,
    glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262,
    glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276,
    glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301,
    glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304.
- Refresh patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636545600">- Stop passing fam=true to meson and drop gamin-devel
  BuildRequires, following upstream default. Following this, drop
  libgio-fam sub-package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638532800">- Update to version 2.70.2:
  + Fix use of the default log writer with journald namespaces
  + Fix hang in `dbus-daemon` under `GTestDBus` when
    `G_MESSAGES_DEBUG=all` is set
  + Speed up `g_canonicalize_filename()` to avoid pathogenic cases
    with `..`
  + Fix URI for pcre subproject as it?s moved upstream
  + Fix storing GSettings dictionaries on macOS
  + Speed up ?remove dot segments? algorithm in `GUri` to avoid
    pathogenic cases with `..`
  + Fix infinite loops in D-Bus message parsing for truncated
    inputs
  + Improve correctness of version information returned by
    `g_get_os_info()` for Windows 10/Server 2019+
  + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426,
    glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530,
    glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541,
    glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313,
    glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316,
    glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335,
    glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340,
    glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356,
    glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361,
    glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366,
    glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643198400">- Update to version 2.70.3:
  + Several important fixes to FD handling in gspawn.
  + Several important fixes to GDBus message and GVariant parsing
    of invalid data.
  + Fix potential data loss due to missing fsync when saving files
    on btrfs.
  + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506,
    glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572,
    glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394,
    glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437,
    glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644580800">- Update to version 2.70.4:
  + Bugs fixed: glgo#GNOME/GLib!2462 ?Fix memory leak in
    gio/gdbusauthmechanismsha1.c? to glib-2-70.
  + Updated translations.</changelog>
  <changelog author="dmueller@suse.com" date="1646049600">- Split gtk-docs from -devel package, these are not needed
  during building projects using glib2
- Use _multibuild as the meson buildprocess is very awkward
  regarding the documentation - builds single-jobs only and
  twice (again during %install). This way the rest of distribution
  waiting for glib2-devel to be available is not blocked by this</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.70.5:
  Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537,
  glgo#GNOME/GLib!2555</changelog>
</package>
<package pkgid="37fbf2072c2bce4f41a2784278a15c8adc217afaa559d1386e39aaa9f0b7e615" name="libgmodule-2_0-0" arch="aarch64">
  <version epoch="0" ver="2.70.5" rel="150400.3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 2.68.2:
  + Fix building third-party projects against GLib on CentOS 7.
  + Bugs fixed:
  - json-glib does not build with glib 2.68.1.
  - gmacros: check that __cplusplus or _MSC_VER is defined.
  - gmacros: missing check if __STDC_VERSION__ is defined.
  - Backport !2078 ?gthreadedresolver: don't ignore flags in
    lookup_by_name_with_flags? to glib-2-68.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1623412800">- Update to version 2.68.3:
  + Bugs fixed:
  - testfilemonitor test leaks ip_watched_file_t struct
  - GFile: `g_file_replace_contents()` reports
    `G_IO_ERROR_WRONG_ETAG` when saving from a symlink
  - Backport !2128 ?inotify: Fix a memory leak? to glib-2-68
  - Backport !2136 ?tlscertificate: Avoid possible invalid read?
    to glib-2-68
  - Backport !2138 ?glocalfileoutputstream: Fix ETag check when
    replacing through a symlink? to glib-2-68.</changelog>
  <changelog author="dimstar@opensuse.org" date="1626350400">- Silence output in libgio-2_0-0 post scriptlet in case the
  ENV-mimeapps.list files do not exist: we are ready to create them
  in this case. An error message is only confusing.</changelog>
  <changelog author="yfjiang@suse.com" date="1627646400">- Drop patches fixed upstream on SLE and Leap 15.4:
  + glib2-add-support-for-slim-timezone-format.patch
  + glib2-fix-6-days-until-the-end-of-the-month.patch
  + glib2-CVE-2021-27218.patch
  + glib2-CVE-2021-27219-add-g_memdup2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters
  for close_range (boo#1189088).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629460800">- Update to version 2.68.4:
  + Various bugfixes and backports from master.
  + Updated translations.
- Drop 63e7864.patch: fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629720000">- Update to version 2.69.0:
  + Fix a crash in `GKeyFile` when parsing a file which contains
    translations using a `GKeyFile` instance which has loaded
    another file previously.
  + Ensure `dlerror()` is used with locking as it?s not thread-safe
    in some libc implementations.
  + Drop internal libpcre copy in favour of a subproject from
    wrapdb.
  + Optimise grefcount atomic operations.
  + Fix `g_date_time_format()` return value encoding if `LC_TIME`
    is not a UTF-8 locale but other locale settings are.
  + Set app name in freedesktop.org notifications with
    `GNotification`.
  + Add PKCS#11 flags to `GTlsPasswordFlags`.
  - Drop -Dinternal_pcre=false meson parameter: follow upstreams
    build recipe changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720001">- Update to version 2.69.1:
  + Support categories in desktop notifications (`GNotification`)
  + Add `GPowerProfileMonitor` for monitoring when to use less
    power (due to being on battery power, electricity being
    expensive or high-carbon, etc.)
  + Allow static names to be set for `GSource`s to avoid
    unnecessary string copies
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720002">- Update to version 2.69.2:
  + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once
    more not used if the process is `AT_SECURE`
    (setuid/setgid/setcap); this change was previously applied and
    then reverted because it broke gnome-keyring
  + Add `g_test_fail_printf()`, `g_test_skip_printf()`,
    `g_test_incomplete_printf()` helper functions for printing
    messages when tests end prematurely
  + Add portal implementation of `GPowerProfileMonitor`
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1631016000">- Update to version 2.69.3:
  + g_settings_schema_key_range_check() misbehaves for int versus
    bool.
  + Compiling anything with GCC &lt;4.6 spews deprecation warnings.
  + `g_invoke_closure` bindings API break..
  + GPowerProfileMonitorPortal does not notice initial
    power-saver-enabled status.
  + doc: Explicitly said, that no null term. is needed.
  + ci: Use C.UTF-8 locale on FreeBSD 12.
  + gio: Fix conditions in memory-monitor test.
  + Updated translations.</changelog>
  <changelog author="avvissu@yandex.by" date="1631016001">- desktop-file-utils: add Pantheon desktop environment</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.70.0:
  + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635422400">- Update to version 2.70.1:
  + Fix network changes not being signalled from NetworkManager.
  + Fix build when building with --fatal-meson-warnings.
  + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245,
    glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256,
    glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262,
    glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276,
    glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301,
    glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304.
- Refresh patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636545600">- Stop passing fam=true to meson and drop gamin-devel
  BuildRequires, following upstream default. Following this, drop
  libgio-fam sub-package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638532800">- Update to version 2.70.2:
  + Fix use of the default log writer with journald namespaces
  + Fix hang in `dbus-daemon` under `GTestDBus` when
    `G_MESSAGES_DEBUG=all` is set
  + Speed up `g_canonicalize_filename()` to avoid pathogenic cases
    with `..`
  + Fix URI for pcre subproject as it?s moved upstream
  + Fix storing GSettings dictionaries on macOS
  + Speed up ?remove dot segments? algorithm in `GUri` to avoid
    pathogenic cases with `..`
  + Fix infinite loops in D-Bus message parsing for truncated
    inputs
  + Improve correctness of version information returned by
    `g_get_os_info()` for Windows 10/Server 2019+
  + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426,
    glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530,
    glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541,
    glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313,
    glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316,
    glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335,
    glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340,
    glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356,
    glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361,
    glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366,
    glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643198400">- Update to version 2.70.3:
  + Several important fixes to FD handling in gspawn.
  + Several important fixes to GDBus message and GVariant parsing
    of invalid data.
  + Fix potential data loss due to missing fsync when saving files
    on btrfs.
  + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506,
    glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572,
    glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394,
    glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437,
    glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644580800">- Update to version 2.70.4:
  + Bugs fixed: glgo#GNOME/GLib!2462 ?Fix memory leak in
    gio/gdbusauthmechanismsha1.c? to glib-2-70.
  + Updated translations.</changelog>
  <changelog author="dmueller@suse.com" date="1646049600">- Split gtk-docs from -devel package, these are not needed
  during building projects using glib2
- Use _multibuild as the meson buildprocess is very awkward
  regarding the documentation - builds single-jobs only and
  twice (again during %install). This way the rest of distribution
  waiting for glib2-devel to be available is not blocked by this</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.70.5:
  Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537,
  glgo#GNOME/GLib!2555</changelog>
</package>
<package pkgid="604e5e92226c61cfe03cdd5714510ca152540790d63439d99b1360a0bfd5f39a" name="libgmodule-2_0-0" arch="x86_64">
  <version epoch="0" ver="2.70.5" rel="150400.3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 2.68.2:
  + Fix building third-party projects against GLib on CentOS 7.
  + Bugs fixed:
  - json-glib does not build with glib 2.68.1.
  - gmacros: check that __cplusplus or _MSC_VER is defined.
  - gmacros: missing check if __STDC_VERSION__ is defined.
  - Backport !2078 ?gthreadedresolver: don't ignore flags in
    lookup_by_name_with_flags? to glib-2-68.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1623412800">- Update to version 2.68.3:
  + Bugs fixed:
  - testfilemonitor test leaks ip_watched_file_t struct
  - GFile: `g_file_replace_contents()` reports
    `G_IO_ERROR_WRONG_ETAG` when saving from a symlink
  - Backport !2128 ?inotify: Fix a memory leak? to glib-2-68
  - Backport !2136 ?tlscertificate: Avoid possible invalid read?
    to glib-2-68
  - Backport !2138 ?glocalfileoutputstream: Fix ETag check when
    replacing through a symlink? to glib-2-68.</changelog>
  <changelog author="dimstar@opensuse.org" date="1626350400">- Silence output in libgio-2_0-0 post scriptlet in case the
  ENV-mimeapps.list files do not exist: we are ready to create them
  in this case. An error message is only confusing.</changelog>
  <changelog author="yfjiang@suse.com" date="1627646400">- Drop patches fixed upstream on SLE and Leap 15.4:
  + glib2-add-support-for-slim-timezone-format.patch
  + glib2-fix-6-days-until-the-end-of-the-month.patch
  + glib2-CVE-2021-27218.patch
  + glib2-CVE-2021-27219-add-g_memdup2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters
  for close_range (boo#1189088).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629460800">- Update to version 2.68.4:
  + Various bugfixes and backports from master.
  + Updated translations.
- Drop 63e7864.patch: fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629720000">- Update to version 2.69.0:
  + Fix a crash in `GKeyFile` when parsing a file which contains
    translations using a `GKeyFile` instance which has loaded
    another file previously.
  + Ensure `dlerror()` is used with locking as it?s not thread-safe
    in some libc implementations.
  + Drop internal libpcre copy in favour of a subproject from
    wrapdb.
  + Optimise grefcount atomic operations.
  + Fix `g_date_time_format()` return value encoding if `LC_TIME`
    is not a UTF-8 locale but other locale settings are.
  + Set app name in freedesktop.org notifications with
    `GNotification`.
  + Add PKCS#11 flags to `GTlsPasswordFlags`.
  - Drop -Dinternal_pcre=false meson parameter: follow upstreams
    build recipe changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720001">- Update to version 2.69.1:
  + Support categories in desktop notifications (`GNotification`)
  + Add `GPowerProfileMonitor` for monitoring when to use less
    power (due to being on battery power, electricity being
    expensive or high-carbon, etc.)
  + Allow static names to be set for `GSource`s to avoid
    unnecessary string copies
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720002">- Update to version 2.69.2:
  + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once
    more not used if the process is `AT_SECURE`
    (setuid/setgid/setcap); this change was previously applied and
    then reverted because it broke gnome-keyring
  + Add `g_test_fail_printf()`, `g_test_skip_printf()`,
    `g_test_incomplete_printf()` helper functions for printing
    messages when tests end prematurely
  + Add portal implementation of `GPowerProfileMonitor`
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1631016000">- Update to version 2.69.3:
  + g_settings_schema_key_range_check() misbehaves for int versus
    bool.
  + Compiling anything with GCC &lt;4.6 spews deprecation warnings.
  + `g_invoke_closure` bindings API break..
  + GPowerProfileMonitorPortal does not notice initial
    power-saver-enabled status.
  + doc: Explicitly said, that no null term. is needed.
  + ci: Use C.UTF-8 locale on FreeBSD 12.
  + gio: Fix conditions in memory-monitor test.
  + Updated translations.</changelog>
  <changelog author="avvissu@yandex.by" date="1631016001">- desktop-file-utils: add Pantheon desktop environment</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.70.0:
  + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635422400">- Update to version 2.70.1:
  + Fix network changes not being signalled from NetworkManager.
  + Fix build when building with --fatal-meson-warnings.
  + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245,
    glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256,
    glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262,
    glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276,
    glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301,
    glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304.
- Refresh patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636545600">- Stop passing fam=true to meson and drop gamin-devel
  BuildRequires, following upstream default. Following this, drop
  libgio-fam sub-package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638532800">- Update to version 2.70.2:
  + Fix use of the default log writer with journald namespaces
  + Fix hang in `dbus-daemon` under `GTestDBus` when
    `G_MESSAGES_DEBUG=all` is set
  + Speed up `g_canonicalize_filename()` to avoid pathogenic cases
    with `..`
  + Fix URI for pcre subproject as it?s moved upstream
  + Fix storing GSettings dictionaries on macOS
  + Speed up ?remove dot segments? algorithm in `GUri` to avoid
    pathogenic cases with `..`
  + Fix infinite loops in D-Bus message parsing for truncated
    inputs
  + Improve correctness of version information returned by
    `g_get_os_info()` for Windows 10/Server 2019+
  + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426,
    glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530,
    glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541,
    glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313,
    glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316,
    glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335,
    glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340,
    glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356,
    glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361,
    glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366,
    glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643198400">- Update to version 2.70.3:
  + Several important fixes to FD handling in gspawn.
  + Several important fixes to GDBus message and GVariant parsing
    of invalid data.
  + Fix potential data loss due to missing fsync when saving files
    on btrfs.
  + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506,
    glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572,
    glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394,
    glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437,
    glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644580800">- Update to version 2.70.4:
  + Bugs fixed: glgo#GNOME/GLib!2462 ?Fix memory leak in
    gio/gdbusauthmechanismsha1.c? to glib-2-70.
  + Updated translations.</changelog>
  <changelog author="dmueller@suse.com" date="1646049600">- Split gtk-docs from -devel package, these are not needed
  during building projects using glib2
- Use _multibuild as the meson buildprocess is very awkward
  regarding the documentation - builds single-jobs only and
  twice (again during %install). This way the rest of distribution
  waiting for glib2-devel to be available is not blocked by this</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.70.5:
  Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537,
  glgo#GNOME/GLib!2555</changelog>
</package>
<package pkgid="5ac3ad0cfc1d607aa500472ef72a9d54c5b18a4f8103c8722d942a14bac75dfc" name="libgobject-2_0-0" arch="aarch64">
  <version epoch="0" ver="2.70.5" rel="150400.3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 2.68.2:
  + Fix building third-party projects against GLib on CentOS 7.
  + Bugs fixed:
  - json-glib does not build with glib 2.68.1.
  - gmacros: check that __cplusplus or _MSC_VER is defined.
  - gmacros: missing check if __STDC_VERSION__ is defined.
  - Backport !2078 ?gthreadedresolver: don't ignore flags in
    lookup_by_name_with_flags? to glib-2-68.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1623412800">- Update to version 2.68.3:
  + Bugs fixed:
  - testfilemonitor test leaks ip_watched_file_t struct
  - GFile: `g_file_replace_contents()` reports
    `G_IO_ERROR_WRONG_ETAG` when saving from a symlink
  - Backport !2128 ?inotify: Fix a memory leak? to glib-2-68
  - Backport !2136 ?tlscertificate: Avoid possible invalid read?
    to glib-2-68
  - Backport !2138 ?glocalfileoutputstream: Fix ETag check when
    replacing through a symlink? to glib-2-68.</changelog>
  <changelog author="dimstar@opensuse.org" date="1626350400">- Silence output in libgio-2_0-0 post scriptlet in case the
  ENV-mimeapps.list files do not exist: we are ready to create them
  in this case. An error message is only confusing.</changelog>
  <changelog author="yfjiang@suse.com" date="1627646400">- Drop patches fixed upstream on SLE and Leap 15.4:
  + glib2-add-support-for-slim-timezone-format.patch
  + glib2-fix-6-days-until-the-end-of-the-month.patch
  + glib2-CVE-2021-27218.patch
  + glib2-CVE-2021-27219-add-g_memdup2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters
  for close_range (boo#1189088).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629460800">- Update to version 2.68.4:
  + Various bugfixes and backports from master.
  + Updated translations.
- Drop 63e7864.patch: fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629720000">- Update to version 2.69.0:
  + Fix a crash in `GKeyFile` when parsing a file which contains
    translations using a `GKeyFile` instance which has loaded
    another file previously.
  + Ensure `dlerror()` is used with locking as it?s not thread-safe
    in some libc implementations.
  + Drop internal libpcre copy in favour of a subproject from
    wrapdb.
  + Optimise grefcount atomic operations.
  + Fix `g_date_time_format()` return value encoding if `LC_TIME`
    is not a UTF-8 locale but other locale settings are.
  + Set app name in freedesktop.org notifications with
    `GNotification`.
  + Add PKCS#11 flags to `GTlsPasswordFlags`.
  - Drop -Dinternal_pcre=false meson parameter: follow upstreams
    build recipe changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720001">- Update to version 2.69.1:
  + Support categories in desktop notifications (`GNotification`)
  + Add `GPowerProfileMonitor` for monitoring when to use less
    power (due to being on battery power, electricity being
    expensive or high-carbon, etc.)
  + Allow static names to be set for `GSource`s to avoid
    unnecessary string copies
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720002">- Update to version 2.69.2:
  + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once
    more not used if the process is `AT_SECURE`
    (setuid/setgid/setcap); this change was previously applied and
    then reverted because it broke gnome-keyring
  + Add `g_test_fail_printf()`, `g_test_skip_printf()`,
    `g_test_incomplete_printf()` helper functions for printing
    messages when tests end prematurely
  + Add portal implementation of `GPowerProfileMonitor`
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1631016000">- Update to version 2.69.3:
  + g_settings_schema_key_range_check() misbehaves for int versus
    bool.
  + Compiling anything with GCC &lt;4.6 spews deprecation warnings.
  + `g_invoke_closure` bindings API break..
  + GPowerProfileMonitorPortal does not notice initial
    power-saver-enabled status.
  + doc: Explicitly said, that no null term. is needed.
  + ci: Use C.UTF-8 locale on FreeBSD 12.
  + gio: Fix conditions in memory-monitor test.
  + Updated translations.</changelog>
  <changelog author="avvissu@yandex.by" date="1631016001">- desktop-file-utils: add Pantheon desktop environment</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.70.0:
  + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635422400">- Update to version 2.70.1:
  + Fix network changes not being signalled from NetworkManager.
  + Fix build when building with --fatal-meson-warnings.
  + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245,
    glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256,
    glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262,
    glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276,
    glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301,
    glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304.
- Refresh patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636545600">- Stop passing fam=true to meson and drop gamin-devel
  BuildRequires, following upstream default. Following this, drop
  libgio-fam sub-package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638532800">- Update to version 2.70.2:
  + Fix use of the default log writer with journald namespaces
  + Fix hang in `dbus-daemon` under `GTestDBus` when
    `G_MESSAGES_DEBUG=all` is set
  + Speed up `g_canonicalize_filename()` to avoid pathogenic cases
    with `..`
  + Fix URI for pcre subproject as it?s moved upstream
  + Fix storing GSettings dictionaries on macOS
  + Speed up ?remove dot segments? algorithm in `GUri` to avoid
    pathogenic cases with `..`
  + Fix infinite loops in D-Bus message parsing for truncated
    inputs
  + Improve correctness of version information returned by
    `g_get_os_info()` for Windows 10/Server 2019+
  + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426,
    glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530,
    glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541,
    glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313,
    glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316,
    glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335,
    glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340,
    glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356,
    glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361,
    glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366,
    glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643198400">- Update to version 2.70.3:
  + Several important fixes to FD handling in gspawn.
  + Several important fixes to GDBus message and GVariant parsing
    of invalid data.
  + Fix potential data loss due to missing fsync when saving files
    on btrfs.
  + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506,
    glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572,
    glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394,
    glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437,
    glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644580800">- Update to version 2.70.4:
  + Bugs fixed: glgo#GNOME/GLib!2462 ?Fix memory leak in
    gio/gdbusauthmechanismsha1.c? to glib-2-70.
  + Updated translations.</changelog>
  <changelog author="dmueller@suse.com" date="1646049600">- Split gtk-docs from -devel package, these are not needed
  during building projects using glib2
- Use _multibuild as the meson buildprocess is very awkward
  regarding the documentation - builds single-jobs only and
  twice (again during %install). This way the rest of distribution
  waiting for glib2-devel to be available is not blocked by this</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.70.5:
  Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537,
  glgo#GNOME/GLib!2555</changelog>
</package>
<package pkgid="5c993621656213f8502d39a9ac434d58ad309b25c7500c3d9048d15f94bdfaee" name="libgobject-2_0-0" arch="x86_64">
  <version epoch="0" ver="2.70.5" rel="150400.3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 2.68.2:
  + Fix building third-party projects against GLib on CentOS 7.
  + Bugs fixed:
  - json-glib does not build with glib 2.68.1.
  - gmacros: check that __cplusplus or _MSC_VER is defined.
  - gmacros: missing check if __STDC_VERSION__ is defined.
  - Backport !2078 ?gthreadedresolver: don't ignore flags in
    lookup_by_name_with_flags? to glib-2-68.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1623412800">- Update to version 2.68.3:
  + Bugs fixed:
  - testfilemonitor test leaks ip_watched_file_t struct
  - GFile: `g_file_replace_contents()` reports
    `G_IO_ERROR_WRONG_ETAG` when saving from a symlink
  - Backport !2128 ?inotify: Fix a memory leak? to glib-2-68
  - Backport !2136 ?tlscertificate: Avoid possible invalid read?
    to glib-2-68
  - Backport !2138 ?glocalfileoutputstream: Fix ETag check when
    replacing through a symlink? to glib-2-68.</changelog>
  <changelog author="dimstar@opensuse.org" date="1626350400">- Silence output in libgio-2_0-0 post scriptlet in case the
  ENV-mimeapps.list files do not exist: we are ready to create them
  in this case. An error message is only confusing.</changelog>
  <changelog author="yfjiang@suse.com" date="1627646400">- Drop patches fixed upstream on SLE and Leap 15.4:
  + glib2-add-support-for-slim-timezone-format.patch
  + glib2-fix-6-days-until-the-end-of-the-month.patch
  + glib2-CVE-2021-27218.patch
  + glib2-CVE-2021-27219-add-g_memdup2.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters
  for close_range (boo#1189088).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629460800">- Update to version 2.68.4:
  + Various bugfixes and backports from master.
  + Updated translations.
- Drop 63e7864.patch: fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629720000">- Update to version 2.69.0:
  + Fix a crash in `GKeyFile` when parsing a file which contains
    translations using a `GKeyFile` instance which has loaded
    another file previously.
  + Ensure `dlerror()` is used with locking as it?s not thread-safe
    in some libc implementations.
  + Drop internal libpcre copy in favour of a subproject from
    wrapdb.
  + Optimise grefcount atomic operations.
  + Fix `g_date_time_format()` return value encoding if `LC_TIME`
    is not a UTF-8 locale but other locale settings are.
  + Set app name in freedesktop.org notifications with
    `GNotification`.
  + Add PKCS#11 flags to `GTlsPasswordFlags`.
  - Drop -Dinternal_pcre=false meson parameter: follow upstreams
    build recipe changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720001">- Update to version 2.69.1:
  + Support categories in desktop notifications (`GNotification`)
  + Add `GPowerProfileMonitor` for monitoring when to use less
    power (due to being on battery power, electricity being
    expensive or high-carbon, etc.)
  + Allow static names to be set for `GSource`s to avoid
    unnecessary string copies
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629720002">- Update to version 2.69.2:
  + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once
    more not used if the process is `AT_SECURE`
    (setuid/setgid/setcap); this change was previously applied and
    then reverted because it broke gnome-keyring
  + Add `g_test_fail_printf()`, `g_test_skip_printf()`,
    `g_test_incomplete_printf()` helper functions for printing
    messages when tests end prematurely
  + Add portal implementation of `GPowerProfileMonitor`
  + Various bugs fixed
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1631016000">- Update to version 2.69.3:
  + g_settings_schema_key_range_check() misbehaves for int versus
    bool.
  + Compiling anything with GCC &lt;4.6 spews deprecation warnings.
  + `g_invoke_closure` bindings API break..
  + GPowerProfileMonitorPortal does not notice initial
    power-saver-enabled status.
  + doc: Explicitly said, that no null term. is needed.
  + ci: Use C.UTF-8 locale on FreeBSD 12.
  + gio: Fix conditions in memory-monitor test.
  + Updated translations.</changelog>
  <changelog author="avvissu@yandex.by" date="1631016001">- desktop-file-utils: add Pantheon desktop environment</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.70.0:
  + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635422400">- Update to version 2.70.1:
  + Fix network changes not being signalled from NetworkManager.
  + Fix build when building with --fatal-meson-warnings.
  + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245,
    glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256,
    glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262,
    glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276,
    glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301,
    glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304.
- Refresh patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636545600">- Stop passing fam=true to meson and drop gamin-devel
  BuildRequires, following upstream default. Following this, drop
  libgio-fam sub-package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638532800">- Update to version 2.70.2:
  + Fix use of the default log writer with journald namespaces
  + Fix hang in `dbus-daemon` under `GTestDBus` when
    `G_MESSAGES_DEBUG=all` is set
  + Speed up `g_canonicalize_filename()` to avoid pathogenic cases
    with `..`
  + Fix URI for pcre subproject as it?s moved upstream
  + Fix storing GSettings dictionaries on macOS
  + Speed up ?remove dot segments? algorithm in `GUri` to avoid
    pathogenic cases with `..`
  + Fix infinite loops in D-Bus message parsing for truncated
    inputs
  + Improve correctness of version information returned by
    `g_get_os_info()` for Windows 10/Server 2019+
  + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426,
    glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530,
    glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541,
    glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313,
    glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316,
    glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335,
    glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340,
    glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356,
    glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361,
    glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366,
    glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643198400">- Update to version 2.70.3:
  + Several important fixes to FD handling in gspawn.
  + Several important fixes to GDBus message and GVariant parsing
    of invalid data.
  + Fix potential data loss due to missing fsync when saving files
    on btrfs.
  + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506,
    glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572,
    glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394,
    glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437,
    glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1644580800">- Update to version 2.70.4:
  + Bugs fixed: glgo#GNOME/GLib!2462 ?Fix memory leak in
    gio/gdbusauthmechanismsha1.c? to glib-2-70.
  + Updated translations.</changelog>
  <changelog author="dmueller@suse.com" date="1646049600">- Split gtk-docs from -devel package, these are not needed
  during building projects using glib2
- Use _multibuild as the meson buildprocess is very awkward
  regarding the documentation - builds single-jobs only and
  twice (again during %install). This way the rest of distribution
  waiting for glib2-devel to be available is not blocked by this</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.70.5:
  Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537,
  glgo#GNOME/GLib!2555</changelog>
</package>
<package pkgid="09312218abb67f65db4b27cb69747d17c5ff8b6f1a22c1cc656dd810b5f5a10f" name="libgraphite2-3" arch="aarch64">
  <version epoch="0" ver="1.3.11" rel="150000.4.3.1"/>
  <changelog author="dmueller@suse.com" date="1413892800">- add link-gcc-shared.diff: link -lgcc_s to fix undefined symbols
  on various ARM architectures</changelog>
  <changelog author="fstrba@suse.com" date="1432036800">- Remove unnecessary utf-8  characters from the spec file</changelog>
  <changelog author="tchvatal@suse.com" date="1438948800">- Version bump to 1.3.0:
  * Various tweaks for the arabic fonts
- Added patches:
  * graphite-nonvoid-return.patch
  * graphite2-1.2.0-cmakepath.patch
- Removed patches:
  * no-specific-nunit-version.diff
  * soname.diff</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Version bump to 1.3.1:
  * Deprecation warning: Full bidi support is about to be deprecated. Make
    contact if this impacts you.
  * Change compression block format slightly to conform to LZ4
  * Handle mono direction text with diacritics consistently. Fonts
    now see the direction they expect consistently and bidi now
    gives expected results.
  * Fixed lots of fuzz bugs
  * Coverity cleanups
  * Build now works for clang and/or asan and/or afl etc.</changelog>
  <changelog author="tchvatal@suse.com" date="1441886400">- Version bump top 1.3.2:
  * Remove full bidi. All segments are assumed to be single directioned.
  * Bug fixes:
    + Decompressor corner cases
    + Various fuzz bugs</changelog>
  <changelog author="pgajdos@suse.com" date="1450267200">- updated to 1.3.3
  * Slight speed up in Collision Avoidance
  * Remove dead bidi code
  * Bug fixes
    . Between pass bidi reorderings and at the end
    . Decompressor fuzz bugs
    . Other fuzz bugs</changelog>
  <changelog author="tchvatal@suse.com" date="1450699200">- Version update to 1.3.4:
  * Fix Collision Kerning ignoring some diacritics
  * Handle pass bits 16-31 to speed up fonts with &gt; 16 passes
  * Various minor fuzz bug fixes
  * Make Coverity happy
  * Add GR_FALLTHROUGH macro for clang c++11
- Upstream moved to github</changelog>
  <changelog author="pgajdos@suse.com" date="1455278400">- updated to 1.3.5 bnc#965803 CVE-2016-1521:
  * Security bug fix
  * Fix ARM misalignment problem
  * Track latest cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1456747200">- Update to 1.3.6
  * This fixes a number of security related bugs. There are no feature
    improvements or bug fixes in this release.</changelog>
  <changelog author="tchvatal@suse.com" date="1464868800">- Version update to 1.3.8:
  * Various bugfixes found by fuzzers</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- Version update to 1.3.9: fixes some bugs in the collision
  avoidance and may give slightly improved results in some cases.</changelog>
  <changelog author="pgajdos@suse.com" date="1493035200">- security update:
  * CVE-2017-5436 [bsc#1035204]
    + graphite2-CVE-2017-5436.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498046400">- Use %ctest macro
- Update license string to lgpl2.1+ and mpl2.0+
- Remove patch graphite2-CVE-2017-5436.patch
- Update to 1.3.10:
  * Upstream marks this as contianing various bugfixes without
    any specific mentions</changelog>
  <changelog author="mpluskal@suse.com" date="1511179200">- Add patches to fix tests when using python3:
  * graphite2-python3_tests.patch
  * graphite2-python3_tests_cornercases.patch
- Refresh all other patches
- Use fancy name for downloaded tarball
- Run spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1512475200">- Make sure we switch to python3 only on SLE15+ and not on SLE12</changelog>
  <changelog author="tchvatal@suse.com" date="1516276800">- Do not BR asciidoc as we do not install the generated html page</changelog>
  <changelog author="schwab@suse.de" date="1518696000">- gcc8.patch: return correct value from stream operator</changelog>
  <changelog author="pgajdos@suse.com" date="1520856000">- Update to 1.3.11:
- removed patches (upstreamed or not needed)
  * gcc8.patch (code commeted out)
  * graphite-nonvoid-return.patch (code commented out)
  * graphite2-python3_tests.patch (upstreamed)
  * graphite2-python3_tests_cornercases.patch (upstreamed
- refreshed patch
  * link-gcc-shared.diff
- fixes security issue: CVE-2018-7999 [bsc#1084850]
  + graphite2-CVE-2018-7999.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1521201600">- Use python3 everywhere
- Drop fonttools test dep as it pulls TON of py3 packages</changelog>
  <changelog author="pgajdos@suse.com" date="1675425600">- fixed license string [bsc#1207676]:
  LGPL-2.1-or-later OR MPL-2.0 OR GPL-2.0-or-later</changelog>
</package>
<package pkgid="1018226950c3f27ffe3fb182658ee2241ebb3d1447aae95854f2df2203f09c20" name="libgraphite2-3" arch="x86_64">
  <version epoch="0" ver="1.3.11" rel="150000.4.3.1"/>
  <changelog author="dmueller@suse.com" date="1413892800">- add link-gcc-shared.diff: link -lgcc_s to fix undefined symbols
  on various ARM architectures</changelog>
  <changelog author="fstrba@suse.com" date="1432036800">- Remove unnecessary utf-8  characters from the spec file</changelog>
  <changelog author="tchvatal@suse.com" date="1438948800">- Version bump to 1.3.0:
  * Various tweaks for the arabic fonts
- Added patches:
  * graphite-nonvoid-return.patch
  * graphite2-1.2.0-cmakepath.patch
- Removed patches:
  * no-specific-nunit-version.diff
  * soname.diff</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Version bump to 1.3.1:
  * Deprecation warning: Full bidi support is about to be deprecated. Make
    contact if this impacts you.
  * Change compression block format slightly to conform to LZ4
  * Handle mono direction text with diacritics consistently. Fonts
    now see the direction they expect consistently and bidi now
    gives expected results.
  * Fixed lots of fuzz bugs
  * Coverity cleanups
  * Build now works for clang and/or asan and/or afl etc.</changelog>
  <changelog author="tchvatal@suse.com" date="1441886400">- Version bump top 1.3.2:
  * Remove full bidi. All segments are assumed to be single directioned.
  * Bug fixes:
    + Decompressor corner cases
    + Various fuzz bugs</changelog>
  <changelog author="pgajdos@suse.com" date="1450267200">- updated to 1.3.3
  * Slight speed up in Collision Avoidance
  * Remove dead bidi code
  * Bug fixes
    . Between pass bidi reorderings and at the end
    . Decompressor fuzz bugs
    . Other fuzz bugs</changelog>
  <changelog author="tchvatal@suse.com" date="1450699200">- Version update to 1.3.4:
  * Fix Collision Kerning ignoring some diacritics
  * Handle pass bits 16-31 to speed up fonts with &gt; 16 passes
  * Various minor fuzz bug fixes
  * Make Coverity happy
  * Add GR_FALLTHROUGH macro for clang c++11
- Upstream moved to github</changelog>
  <changelog author="pgajdos@suse.com" date="1455278400">- updated to 1.3.5 bnc#965803 CVE-2016-1521:
  * Security bug fix
  * Fix ARM misalignment problem
  * Track latest cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1456747200">- Update to 1.3.6
  * This fixes a number of security related bugs. There are no feature
    improvements or bug fixes in this release.</changelog>
  <changelog author="tchvatal@suse.com" date="1464868800">- Version update to 1.3.8:
  * Various bugfixes found by fuzzers</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- Version update to 1.3.9: fixes some bugs in the collision
  avoidance and may give slightly improved results in some cases.</changelog>
  <changelog author="pgajdos@suse.com" date="1493035200">- security update:
  * CVE-2017-5436 [bsc#1035204]
    + graphite2-CVE-2017-5436.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498046400">- Use %ctest macro
- Update license string to lgpl2.1+ and mpl2.0+
- Remove patch graphite2-CVE-2017-5436.patch
- Update to 1.3.10:
  * Upstream marks this as contianing various bugfixes without
    any specific mentions</changelog>
  <changelog author="mpluskal@suse.com" date="1511179200">- Add patches to fix tests when using python3:
  * graphite2-python3_tests.patch
  * graphite2-python3_tests_cornercases.patch
- Refresh all other patches
- Use fancy name for downloaded tarball
- Run spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1512475200">- Make sure we switch to python3 only on SLE15+ and not on SLE12</changelog>
  <changelog author="tchvatal@suse.com" date="1516276800">- Do not BR asciidoc as we do not install the generated html page</changelog>
  <changelog author="schwab@suse.de" date="1518696000">- gcc8.patch: return correct value from stream operator</changelog>
  <changelog author="pgajdos@suse.com" date="1520856000">- Update to 1.3.11:
- removed patches (upstreamed or not needed)
  * gcc8.patch (code commeted out)
  * graphite-nonvoid-return.patch (code commented out)
  * graphite2-python3_tests.patch (upstreamed)
  * graphite2-python3_tests_cornercases.patch (upstreamed
- refreshed patch
  * link-gcc-shared.diff
- fixes security issue: CVE-2018-7999 [bsc#1084850]
  + graphite2-CVE-2018-7999.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1521201600">- Use python3 everywhere
- Drop fonttools test dep as it pulls TON of py3 packages</changelog>
  <changelog author="pgajdos@suse.com" date="1675425600">- fixed license string [bsc#1207676]:
  LGPL-2.1-or-later OR MPL-2.0 OR GPL-2.0-or-later</changelog>
</package>
<package pkgid="a3a47a20a842f58055be7acf38572df4d358d17fdb6b50e975c5bd37d309f875" name="libipset13" arch="aarch64">
  <version epoch="0" ver="7.15" rel="150400.12.3.2"/>
  <changelog author="jengelh@inai.de" date="1505649600">- Update to new upstream release 6.33
  * Report if the option is supported by a newer kernel release
- Add ipset-6.33-export-func.diff</changelog>
  <changelog author="jengelh@inai.de" date="1506168000">- Update to new upstream release 6.34
  * Reset state after a command failed, when multiple ones
    are issued.
  * Handle padding attribute properly in userspace.
  * Test to check the fix to add an IPv4 range containing more
    than 2^31 addresses.
- Remove ipset-6.33-export-func.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1515240000">- Update to new upstream release 6.35
  * Userspace revision handling is reworked
  * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked
  * Missing nfnl_lock()/nfnl_unlock() is added to
    ip_set_net_exit()
  * netfilter: ipset: add resched points during set listing
  * Fix "don't update counters" mode when counters used at the
    matching
  * netfilter: ipset: Fix race between dump and swap</changelog>
  <changelog author="jengelh@inai.de" date="1516622400">- Add 0001-build-do-install-libipset-args.h.patch [boo#1077037].</changelog>
  <changelog author="jengelh@inai.de" date="1520078400">- Update to new upstream release 6.36
  * Adding a IPv4 range x.x.x.x?255.255.255.255 could lead to
    memory exhaustion, which has been fixed.
- Drop 0001-build-do-install-libipset-args.h.patch (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1523361600">- Update to new upstream release 6.38
  * Fix parsing service names for ports.</changelog>
  <changelog author="jengelh@inai.de" date="1540900800">- Update to new upstream release 7.0
  * A new internal protocol version between the kernel and
    userspace is used. This is required in order to support two
    new functions and the extendend LIST operation, which makes
    possible to run ipset in every case entirely over netlink,
    without the need to use getsockopt().
  * The userspace library was reworked so it can be embedded
    without calling the binary.</changelog>
  <changelog author="suse+build@de-korte.org" date="1542715200">- Add ipset-file.diff [boo#1116432].</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Update to new upstream release 7.1
  * Correct the manpage about the sort option
  * Implement sorting for hash types in the ipset tool
  * Fix to list/save into file specified by option
- Remove ipset-file.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1560168000">- Update to new upstream release 7.2
  * ipset: Fix memory accounting for hash types on resize</changelog>
  <changelog author="jengelh@inai.de" date="1566216000">- Update to new upstream release 7.3
  * Fix rename concurrency with listing, which can result broken
    list/save results.
  * ipset: Copy the right MAC address in bitmap:ip,mac and
    hash:ip,mac sets.
  * ipset: Actually allow destination MAC address for hash:ip,mac
    sets too.</changelog>
  <changelog author="jengelh@inai.de" date="1572609600">- Update to release 7.4
  * Wildcard support for the "hash:net,iface" type.</changelog>
  <changelog author="jengelh@inai.de" date="1578657600">- Update to release 7.5
  * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO
    is present.
  * netfilter: xt_set: Do not restrict --map-set to the
    mangle table.</changelog>
  <changelog author="jengelh@inai.de" date="1582545600">- Update to release 7.6
  * Add checking system_power_efficient_wq in the source tree.</changelog>
  <changelog author="jengelh@inai.de" date="1605787200">- Update to release 7.9
  * Enable memory accounting for ipset allocations
  * Expose the initval hash parameter to userspace
  * Add bucketsize parameter to all hash types
  * Support the -exist flag with the destroy command</changelog>
  <changelog author="jengelh@inai.de" date="1608465600">- Update to release 7.10
  * Fix shift-out-of-bounds in htable_bits()</changelog>
  <changelog author="jengelh@inai.de" date="1613736000">- Update to release 7.11
  * Argument parsing buffer overflow in ipset_parse_argv fixed</changelog>
  <changelog author="jengelh@inai.de" date="1627473600">- Update to release 7.14
  * Allow specifying protocols by number
  * Limit the maximum range of consecutive elements to add/delete</changelog>
  <changelog author="info@paolostivanin.com" date="1628078400">- Update to release 7.15
  * netfilter: ipset: Fix maximal range check in
    hash_ipportnet4_uadt()</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667563200">- Tumbleweed is not affected by the following SLE issues:
  bsc#1122853</changelog>
</package>
<package pkgid="8d05373170679c857e50231b71934d1e6bed90a3e079b4b6e332df728f2cc267" name="libipset13" arch="ppc64le">
  <version epoch="0" ver="7.15" rel="150400.12.3.2"/>
  <changelog author="jengelh@inai.de" date="1505649600">- Update to new upstream release 6.33
  * Report if the option is supported by a newer kernel release
- Add ipset-6.33-export-func.diff</changelog>
  <changelog author="jengelh@inai.de" date="1506168000">- Update to new upstream release 6.34
  * Reset state after a command failed, when multiple ones
    are issued.
  * Handle padding attribute properly in userspace.
  * Test to check the fix to add an IPv4 range containing more
    than 2^31 addresses.
- Remove ipset-6.33-export-func.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1515240000">- Update to new upstream release 6.35
  * Userspace revision handling is reworked
  * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked
  * Missing nfnl_lock()/nfnl_unlock() is added to
    ip_set_net_exit()
  * netfilter: ipset: add resched points during set listing
  * Fix "don't update counters" mode when counters used at the
    matching
  * netfilter: ipset: Fix race between dump and swap</changelog>
  <changelog author="jengelh@inai.de" date="1516622400">- Add 0001-build-do-install-libipset-args.h.patch [boo#1077037].</changelog>
  <changelog author="jengelh@inai.de" date="1520078400">- Update to new upstream release 6.36
  * Adding a IPv4 range x.x.x.x?255.255.255.255 could lead to
    memory exhaustion, which has been fixed.
- Drop 0001-build-do-install-libipset-args.h.patch (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1523361600">- Update to new upstream release 6.38
  * Fix parsing service names for ports.</changelog>
  <changelog author="jengelh@inai.de" date="1540900800">- Update to new upstream release 7.0
  * A new internal protocol version between the kernel and
    userspace is used. This is required in order to support two
    new functions and the extendend LIST operation, which makes
    possible to run ipset in every case entirely over netlink,
    without the need to use getsockopt().
  * The userspace library was reworked so it can be embedded
    without calling the binary.</changelog>
  <changelog author="suse+build@de-korte.org" date="1542715200">- Add ipset-file.diff [boo#1116432].</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Update to new upstream release 7.1
  * Correct the manpage about the sort option
  * Implement sorting for hash types in the ipset tool
  * Fix to list/save into file specified by option
- Remove ipset-file.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1560168000">- Update to new upstream release 7.2
  * ipset: Fix memory accounting for hash types on resize</changelog>
  <changelog author="jengelh@inai.de" date="1566216000">- Update to new upstream release 7.3
  * Fix rename concurrency with listing, which can result broken
    list/save results.
  * ipset: Copy the right MAC address in bitmap:ip,mac and
    hash:ip,mac sets.
  * ipset: Actually allow destination MAC address for hash:ip,mac
    sets too.</changelog>
  <changelog author="jengelh@inai.de" date="1572609600">- Update to release 7.4
  * Wildcard support for the "hash:net,iface" type.</changelog>
  <changelog author="jengelh@inai.de" date="1578657600">- Update to release 7.5
  * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO
    is present.
  * netfilter: xt_set: Do not restrict --map-set to the
    mangle table.</changelog>
  <changelog author="jengelh@inai.de" date="1582545600">- Update to release 7.6
  * Add checking system_power_efficient_wq in the source tree.</changelog>
  <changelog author="jengelh@inai.de" date="1605787200">- Update to release 7.9
  * Enable memory accounting for ipset allocations
  * Expose the initval hash parameter to userspace
  * Add bucketsize parameter to all hash types
  * Support the -exist flag with the destroy command</changelog>
  <changelog author="jengelh@inai.de" date="1608465600">- Update to release 7.10
  * Fix shift-out-of-bounds in htable_bits()</changelog>
  <changelog author="jengelh@inai.de" date="1613736000">- Update to release 7.11
  * Argument parsing buffer overflow in ipset_parse_argv fixed</changelog>
  <changelog author="jengelh@inai.de" date="1627473600">- Update to release 7.14
  * Allow specifying protocols by number
  * Limit the maximum range of consecutive elements to add/delete</changelog>
  <changelog author="info@paolostivanin.com" date="1628078400">- Update to release 7.15
  * netfilter: ipset: Fix maximal range check in
    hash_ipportnet4_uadt()</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667563200">- Tumbleweed is not affected by the following SLE issues:
  bsc#1122853</changelog>
</package>
<package pkgid="0b4c68e7428ec6b6906e5fd226ddd88cc376b38dd42ac7047925e34b62e486e2" name="libipset13" arch="s390x">
  <version epoch="0" ver="7.15" rel="150400.12.3.2"/>
  <changelog author="jengelh@inai.de" date="1505649600">- Update to new upstream release 6.33
  * Report if the option is supported by a newer kernel release
- Add ipset-6.33-export-func.diff</changelog>
  <changelog author="jengelh@inai.de" date="1506168000">- Update to new upstream release 6.34
  * Reset state after a command failed, when multiple ones
    are issued.
  * Handle padding attribute properly in userspace.
  * Test to check the fix to add an IPv4 range containing more
    than 2^31 addresses.
- Remove ipset-6.33-export-func.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1515240000">- Update to new upstream release 6.35
  * Userspace revision handling is reworked
  * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked
  * Missing nfnl_lock()/nfnl_unlock() is added to
    ip_set_net_exit()
  * netfilter: ipset: add resched points during set listing
  * Fix "don't update counters" mode when counters used at the
    matching
  * netfilter: ipset: Fix race between dump and swap</changelog>
  <changelog author="jengelh@inai.de" date="1516622400">- Add 0001-build-do-install-libipset-args.h.patch [boo#1077037].</changelog>
  <changelog author="jengelh@inai.de" date="1520078400">- Update to new upstream release 6.36
  * Adding a IPv4 range x.x.x.x?255.255.255.255 could lead to
    memory exhaustion, which has been fixed.
- Drop 0001-build-do-install-libipset-args.h.patch (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1523361600">- Update to new upstream release 6.38
  * Fix parsing service names for ports.</changelog>
  <changelog author="jengelh@inai.de" date="1540900800">- Update to new upstream release 7.0
  * A new internal protocol version between the kernel and
    userspace is used. This is required in order to support two
    new functions and the extendend LIST operation, which makes
    possible to run ipset in every case entirely over netlink,
    without the need to use getsockopt().
  * The userspace library was reworked so it can be embedded
    without calling the binary.</changelog>
  <changelog author="suse+build@de-korte.org" date="1542715200">- Add ipset-file.diff [boo#1116432].</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Update to new upstream release 7.1
  * Correct the manpage about the sort option
  * Implement sorting for hash types in the ipset tool
  * Fix to list/save into file specified by option
- Remove ipset-file.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1560168000">- Update to new upstream release 7.2
  * ipset: Fix memory accounting for hash types on resize</changelog>
  <changelog author="jengelh@inai.de" date="1566216000">- Update to new upstream release 7.3
  * Fix rename concurrency with listing, which can result broken
    list/save results.
  * ipset: Copy the right MAC address in bitmap:ip,mac and
    hash:ip,mac sets.
  * ipset: Actually allow destination MAC address for hash:ip,mac
    sets too.</changelog>
  <changelog author="jengelh@inai.de" date="1572609600">- Update to release 7.4
  * Wildcard support for the "hash:net,iface" type.</changelog>
  <changelog author="jengelh@inai.de" date="1578657600">- Update to release 7.5
  * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO
    is present.
  * netfilter: xt_set: Do not restrict --map-set to the
    mangle table.</changelog>
  <changelog author="jengelh@inai.de" date="1582545600">- Update to release 7.6
  * Add checking system_power_efficient_wq in the source tree.</changelog>
  <changelog author="jengelh@inai.de" date="1605787200">- Update to release 7.9
  * Enable memory accounting for ipset allocations
  * Expose the initval hash parameter to userspace
  * Add bucketsize parameter to all hash types
  * Support the -exist flag with the destroy command</changelog>
  <changelog author="jengelh@inai.de" date="1608465600">- Update to release 7.10
  * Fix shift-out-of-bounds in htable_bits()</changelog>
  <changelog author="jengelh@inai.de" date="1613736000">- Update to release 7.11
  * Argument parsing buffer overflow in ipset_parse_argv fixed</changelog>
  <changelog author="jengelh@inai.de" date="1627473600">- Update to release 7.14
  * Allow specifying protocols by number
  * Limit the maximum range of consecutive elements to add/delete</changelog>
  <changelog author="info@paolostivanin.com" date="1628078400">- Update to release 7.15
  * netfilter: ipset: Fix maximal range check in
    hash_ipportnet4_uadt()</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667563200">- Tumbleweed is not affected by the following SLE issues:
  bsc#1122853</changelog>
</package>
<package pkgid="029b74c68132892b0916a52bd50f8197ace0dadcf1ec99f023cb5186ed9a1e5e" name="libipset13" arch="x86_64">
  <version epoch="0" ver="7.15" rel="150400.12.3.2"/>
  <changelog author="jengelh@inai.de" date="1505649600">- Update to new upstream release 6.33
  * Report if the option is supported by a newer kernel release
- Add ipset-6.33-export-func.diff</changelog>
  <changelog author="jengelh@inai.de" date="1506168000">- Update to new upstream release 6.34
  * Reset state after a command failed, when multiple ones
    are issued.
  * Handle padding attribute properly in userspace.
  * Test to check the fix to add an IPv4 range containing more
    than 2^31 addresses.
- Remove ipset-6.33-export-func.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1515240000">- Update to new upstream release 6.35
  * Userspace revision handling is reworked
  * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked
  * Missing nfnl_lock()/nfnl_unlock() is added to
    ip_set_net_exit()
  * netfilter: ipset: add resched points during set listing
  * Fix "don't update counters" mode when counters used at the
    matching
  * netfilter: ipset: Fix race between dump and swap</changelog>
  <changelog author="jengelh@inai.de" date="1516622400">- Add 0001-build-do-install-libipset-args.h.patch [boo#1077037].</changelog>
  <changelog author="jengelh@inai.de" date="1520078400">- Update to new upstream release 6.36
  * Adding a IPv4 range x.x.x.x?255.255.255.255 could lead to
    memory exhaustion, which has been fixed.
- Drop 0001-build-do-install-libipset-args.h.patch (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1523361600">- Update to new upstream release 6.38
  * Fix parsing service names for ports.</changelog>
  <changelog author="jengelh@inai.de" date="1540900800">- Update to new upstream release 7.0
  * A new internal protocol version between the kernel and
    userspace is used. This is required in order to support two
    new functions and the extendend LIST operation, which makes
    possible to run ipset in every case entirely over netlink,
    without the need to use getsockopt().
  * The userspace library was reworked so it can be embedded
    without calling the binary.</changelog>
  <changelog author="suse+build@de-korte.org" date="1542715200">- Add ipset-file.diff [boo#1116432].</changelog>
  <changelog author="jengelh@inai.de" date="1544529600">- Update to new upstream release 7.1
  * Correct the manpage about the sort option
  * Implement sorting for hash types in the ipset tool
  * Fix to list/save into file specified by option
- Remove ipset-file.diff (merged)</changelog>
  <changelog author="jengelh@inai.de" date="1560168000">- Update to new upstream release 7.2
  * ipset: Fix memory accounting for hash types on resize</changelog>
  <changelog author="jengelh@inai.de" date="1566216000">- Update to new upstream release 7.3
  * Fix rename concurrency with listing, which can result broken
    list/save results.
  * ipset: Copy the right MAC address in bitmap:ip,mac and
    hash:ip,mac sets.
  * ipset: Actually allow destination MAC address for hash:ip,mac
    sets too.</changelog>
  <changelog author="jengelh@inai.de" date="1572609600">- Update to release 7.4
  * Wildcard support for the "hash:net,iface" type.</changelog>
  <changelog author="jengelh@inai.de" date="1578657600">- Update to release 7.5
  * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO
    is present.
  * netfilter: xt_set: Do not restrict --map-set to the
    mangle table.</changelog>
  <changelog author="jengelh@inai.de" date="1582545600">- Update to release 7.6
  * Add checking system_power_efficient_wq in the source tree.</changelog>
  <changelog author="jengelh@inai.de" date="1605787200">- Update to release 7.9
  * Enable memory accounting for ipset allocations
  * Expose the initval hash parameter to userspace
  * Add bucketsize parameter to all hash types
  * Support the -exist flag with the destroy command</changelog>
  <changelog author="jengelh@inai.de" date="1608465600">- Update to release 7.10
  * Fix shift-out-of-bounds in htable_bits()</changelog>
  <changelog author="jengelh@inai.de" date="1613736000">- Update to release 7.11
  * Argument parsing buffer overflow in ipset_parse_argv fixed</changelog>
  <changelog author="jengelh@inai.de" date="1627473600">- Update to release 7.14
  * Allow specifying protocols by number
  * Limit the maximum range of consecutive elements to add/delete</changelog>
  <changelog author="info@paolostivanin.com" date="1628078400">- Update to release 7.15
  * netfilter: ipset: Fix maximal range check in
    hash_ipportnet4_uadt()</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667563200">- Tumbleweed is not affected by the following SLE issues:
  bsc#1122853</changelog>
</package>
<package pkgid="8c38e6b2ad9ef9d5c2e2991eb1fc2aff8d2a036a44719836ce271e3b86f6873b" name="libjitterentropy3" arch="aarch64">
  <version epoch="0" ver="3.4.0" rel="150000.1.9.1"/>
  <changelog author="meissner@suse.com" date="1632225600">- add a userspace jitter entropy generator library</changelog>
  <changelog author="jengelh@inai.de" date="1632830400">- Trim conjecture from descriptions.</changelog>
  <changelog author="meissner@suse.com" date="1659528000">- updated to 3.4.0
  * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo
  * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state.
  It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8.
  * enhancement: add CMake support by Andrew Hopkins
- updated to 3.3.1
  * fix: bug fix in initialization logic by Vladis Dronov &lt;vdronov@redhat.com&gt;
  * fix: use __asm__ instead of asm to suit the C11 standard
- added a -devel-static package to be able to link it static.</changelog>
  <changelog author="meissner@suse.com" date="1663070400">- jitterentropy-split-internal-header.patch:
  Hide the non-GNUC constructs that are library internal from the
  exported header. (bsc#1202870)</changelog>
  <changelog author="meissner@suse.com" date="1674734400">- jitterentropy-with-debug.patch: build with debuginfo (bsc#1207789)</changelog>
</package>
<package pkgid="535cda8fbc1781560907d1514d53849270912bcd7ddcf94c1eda99bb8c3716c6" name="libjitterentropy3" arch="x86_64">
  <version epoch="0" ver="3.4.0" rel="150000.1.9.1"/>
  <changelog author="meissner@suse.com" date="1632225600">- add a userspace jitter entropy generator library</changelog>
  <changelog author="jengelh@inai.de" date="1632830400">- Trim conjecture from descriptions.</changelog>
  <changelog author="meissner@suse.com" date="1659528000">- updated to 3.4.0
  * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo
  * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state.
  It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8.
  * enhancement: add CMake support by Andrew Hopkins
- updated to 3.3.1
  * fix: bug fix in initialization logic by Vladis Dronov &lt;vdronov@redhat.com&gt;
  * fix: use __asm__ instead of asm to suit the C11 standard
- added a -devel-static package to be able to link it static.</changelog>
  <changelog author="meissner@suse.com" date="1663070400">- jitterentropy-split-internal-header.patch:
  Hide the non-GNUC constructs that are library internal from the
  exported header. (bsc#1202870)</changelog>
  <changelog author="meissner@suse.com" date="1674734400">- jitterentropy-with-debug.patch: build with debuginfo (bsc#1207789)</changelog>
</package>
<package pkgid="02ed35b552d2aa5d4a0a6c7d469411004895d9fda2a5a298c65de64ad998b441" name="libksba" arch="src">
  <version epoch="0" ver="1.3.5" rel="150000.4.6.1"/>
  <changelog author="puzel@suse.cz" date="1231761600">- update to 1.0.5 (bugfix release)
  - minor bugfixes</changelog>
  <changelog author="crrodriguez@suse.de" date="1239105600">- remove static libraries and "la" files
- fix buildrequires and -devel package dependencies</changelog>
  <changelog author="puzel@suse.cz" date="1245844800">- update to libksba-1.0.6
  * Support SHA-{384,512} based signature generation.
  * The RSA algorithmIdentifier ASN.1 sequence is now emitted with an
  explicit NULL parameter.  Despite the interop testing we did in the
  past, some software still requires this and thus we better follow
  the best current practise.</changelog>
  <changelog author="puzel@novell.com" date="1247140800">- update to libksba-1.0.7
  * Detect overflow while parsing OIDs.  Map BER encoded OIDs to well
  known names.
  * Allow mixed case names in DNs.</changelog>
  <changelog author="puzel@novell.com" date="1282046400">- update to libksba-1.0.8
  * Fixed a CMS parsing bug exhibited by Lotus Notes.</changelog>
  <changelog author="jengelh@medozas.de" date="1288526400">- Use %_smp_mflags</changelog>
  <changelog author="puzel@novell.com" date="1291377600">- update to libksba-1.1.0
  * New functions to fix a leak in dirmngr.
  * Interface changes relative to the 1.0.0 release:
  ksba_reader_set_release_notify   NEW
  ksba_writer_set_release_notify   NEW
- clean up specfile</changelog>
  <changelog author="puzel@novell.com" date="1311940800">- update to libksba-1.2.0
  - New functions to allow the creation of X.509 certificates.
  - Interface changes relative to the 1.1.0 release:
    ksba_certreq_set_serial          NEW
    ksba_certreq_set_issuer          NEW
    ksba_certreq_set_validity        NEW
    ksba_certreq_set_siginfo         NEW</changelog>
  <changelog author="coolo@suse.com" date="1321704000">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1349092800">- update to libksba 1.3.0
  - change license from GPLv2 to LGPLv3/GPLv2
  - minor bug fixes
- implement shared library packaging policy
- remove nld-build.diff which was added 2004 before package was in
  the openSUSE OBS, was never used or applied cleanly since r1</changelog>
  <changelog author="meissner@suse.com" date="1354017600">- Use URL for source</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411300800">- libksba 1.3.1:
  * Fixed memory leak in CRL parsing
  * Build fixes for ppc64el</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1417003200">- libksba 1.3.2 [boo#907074] [CVE-2014-9087]
  This version contains a security update which fixes a buffer
  overflow in OID to string conversion code that can be triggered
  by a specially crafted S/MIME message or ECC based OpenPGP data.
  Users of GnuPG 2.x should install this version and restart the
  dirmgr process.
  * Fixed a buffer overflow in ksba_oid_to_str.
- verify source signature</changelog>
  <changelog author="astieger@suse.com" date="1426766400">- remove libtool requirement</changelog>
  <changelog author="astieger@suse.com" date="1428667200">- libksba 1.3.3:
  * Fixed an integer overflow in the DN decoder.
  * Now returns an error instead of terminating the process for
  certain bad BER encodings.
  * Improved the parsing of utf-8 strings in DNs.
  * Allow building with newer versions of Bison.</changelog>
  <changelog author="astieger@suse.com" date="1462881600">- libksba 1.3.4:
  * Fixed two OOB read access bugs which could be used to force a DoS.
  boo#979261 CVE-2016-4574, CVE-2016-4579
  * Fixed a crash due to faulty curve OID lookup code.
  * Synced the list of supported curves with those of Libgcrypt.
  * New configure option --enable-build-timestamp; a build timestamp is
  not anymore used by default.</changelog>
  <changelog author="astieger@suse.com" date="1471867200">- libksba 1.3.5:
  * Limit the allowed size of complex ASN.1 objects (e.g.
  certificates) to 16MiB.
  * Avoid read access to unitialized memory.
  * Improve detection of invalid RDNs.
  * Encode the OCSP nonce value as an octet string as described by
  RFC-6960.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security fix: [bsc#1204357, CVE-2022-3515]
  * Detect a possible overflow directly in the TLV parser.
  * Add libksba-CVE-2022-3515.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1672747200">- Security fix: [bsc#1206579, CVE-2022-47629]
  * Integer overflow in the CRL signature parser.
  * Add libksba-CVE-2022-47629.patch</changelog>
</package>
<package pkgid="39c3eda4c1c7e4fd7e6a196baf3d87a6f767c82bd4c8086e0e271afaceb7a36c" name="libksba8" arch="aarch64">
  <version epoch="0" ver="1.3.5" rel="150000.4.6.1"/>
  <changelog author="meissner@suse.com" date="1354017600">- Use URL for source</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411300800">- libksba 1.3.1:
  * Fixed memory leak in CRL parsing
  * Build fixes for ppc64el</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1417003200">- libksba 1.3.2 [boo#907074] [CVE-2014-9087]
  This version contains a security update which fixes a buffer
  overflow in OID to string conversion code that can be triggered
  by a specially crafted S/MIME message or ECC based OpenPGP data.
  Users of GnuPG 2.x should install this version and restart the
  dirmgr process.
  * Fixed a buffer overflow in ksba_oid_to_str.
- verify source signature</changelog>
  <changelog author="astieger@suse.com" date="1426766400">- remove libtool requirement</changelog>
  <changelog author="astieger@suse.com" date="1428667200">- libksba 1.3.3:
  * Fixed an integer overflow in the DN decoder.
  * Now returns an error instead of terminating the process for
  certain bad BER encodings.
  * Improved the parsing of utf-8 strings in DNs.
  * Allow building with newer versions of Bison.</changelog>
  <changelog author="astieger@suse.com" date="1462881600">- libksba 1.3.4:
  * Fixed two OOB read access bugs which could be used to force a DoS.
  boo#979261 CVE-2016-4574, CVE-2016-4579
  * Fixed a crash due to faulty curve OID lookup code.
  * Synced the list of supported curves with those of Libgcrypt.
  * New configure option --enable-build-timestamp; a build timestamp is
  not anymore used by default.</changelog>
  <changelog author="astieger@suse.com" date="1471867200">- libksba 1.3.5:
  * Limit the allowed size of complex ASN.1 objects (e.g.
  certificates) to 16MiB.
  * Avoid read access to unitialized memory.
  * Improve detection of invalid RDNs.
  * Encode the OCSP nonce value as an octet string as described by
  RFC-6960.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security fix: [bsc#1204357, CVE-2022-3515]
  * Detect a possible overflow directly in the TLV parser.
  * Add libksba-CVE-2022-3515.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1672747200">- Security fix: [bsc#1206579, CVE-2022-47629]
  * Integer overflow in the CRL signature parser.
  * Add libksba-CVE-2022-47629.patch</changelog>
</package>
<package pkgid="edb49c4da5f33a2cb56439a54e954ea2ac7a46962b38fee3e2ce2bd4749ae8a4" name="libksba8" arch="x86_64">
  <version epoch="0" ver="1.3.5" rel="150000.4.6.1"/>
  <changelog author="meissner@suse.com" date="1354017600">- Use URL for source</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411300800">- libksba 1.3.1:
  * Fixed memory leak in CRL parsing
  * Build fixes for ppc64el</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1417003200">- libksba 1.3.2 [boo#907074] [CVE-2014-9087]
  This version contains a security update which fixes a buffer
  overflow in OID to string conversion code that can be triggered
  by a specially crafted S/MIME message or ECC based OpenPGP data.
  Users of GnuPG 2.x should install this version and restart the
  dirmgr process.
  * Fixed a buffer overflow in ksba_oid_to_str.
- verify source signature</changelog>
  <changelog author="astieger@suse.com" date="1426766400">- remove libtool requirement</changelog>
  <changelog author="astieger@suse.com" date="1428667200">- libksba 1.3.3:
  * Fixed an integer overflow in the DN decoder.
  * Now returns an error instead of terminating the process for
  certain bad BER encodings.
  * Improved the parsing of utf-8 strings in DNs.
  * Allow building with newer versions of Bison.</changelog>
  <changelog author="astieger@suse.com" date="1462881600">- libksba 1.3.4:
  * Fixed two OOB read access bugs which could be used to force a DoS.
  boo#979261 CVE-2016-4574, CVE-2016-4579
  * Fixed a crash due to faulty curve OID lookup code.
  * Synced the list of supported curves with those of Libgcrypt.
  * New configure option --enable-build-timestamp; a build timestamp is
  not anymore used by default.</changelog>
  <changelog author="astieger@suse.com" date="1471867200">- libksba 1.3.5:
  * Limit the allowed size of complex ASN.1 objects (e.g.
  certificates) to 16MiB.
  * Avoid read access to unitialized memory.
  * Improve detection of invalid RDNs.
  * Encode the OCSP nonce value as an octet string as described by
  RFC-6960.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security fix: [bsc#1204357, CVE-2022-3515]
  * Detect a possible overflow directly in the TLV parser.
  * Add libksba-CVE-2022-3515.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1672747200">- Security fix: [bsc#1206579, CVE-2022-47629]
  * Integer overflow in the CRL signature parser.
  * Add libksba-CVE-2022-47629.patch</changelog>
</package>
<package pkgid="81d648910ea9b9b8854454c1b2f084e3a37716b406801378b1004e4ecdd5b495" name="liblvm2cmd2_03" arch="aarch64">
  <version epoch="0" ver="2.03.05" rel="150400.185.1"/>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1647172800">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  + change lvm.conf item external_device_info_source from none to udev
  + bug-1179691_config-set-external_device_info_source-none.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1659528000">- lvm reports udev database has incomplete information on devices (bsc#1202011)
  + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1664193600">- lvmlockd is not supporting sanlock (bsc#1203482)
  - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="f2eff6f089c18dd6c034d19c1ed2754abf747cd244e087ab14556aa4b26f418d" name="liblvm2cmd2_03" arch="x86_64">
  <version epoch="0" ver="2.03.05" rel="150400.185.1"/>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1647172800">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  + change lvm.conf item external_device_info_source from none to udev
  + bug-1179691_config-set-external_device_info_source-none.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1659528000">- lvm reports udev database has incomplete information on devices (bsc#1202011)
  + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1664193600">- lvmlockd is not supporting sanlock (bsc#1203482)
  - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="ed92801590e50b4bf2d4176c9e4e46d6ed689193b2706c2ee89a56279ba0a5e8" name="libmount1" arch="aarch64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="858db1204ff98c673a5825cb86f4a0420753ce7b6b7b0a63f91408d9e14c8c1a" name="libmount1" arch="x86_64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="d28c3bb0eb88c9a21a8833282565686ac4bc64712d80535af36997bb25dae31d" name="libmpath0" arch="aarch64">
  <version epoch="0" ver="0.9.0+62+suse.3e048d4" rel="150400.4.10.1"/>
  <changelog author="mwilck@suse.com" date="1632225600">- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1638446400">- Update to version 0.8.7+138+suse.7c9afe31:
  New upstream version (pre-0.8.8)
  * deprecate "config_dir" and "multipath_dir" config options
    (will be removed in future version)
  * remove dependency on systemd-udevd-settle.service (boo#1193336)
  * fix crash in remove_map (boo#1193334)
  * CLI: add path wildcard "%I" for init state
  * CLI: add "reconfigure all" command
  * allow multiple pending "reconfigure" commands (bsc#1189551)
  * speed up "reconfigure" by avoiding unnecessary map reloads
    (bsc#1189551)
  * rework of CLI command handler (unix socket handler) to avoid
    hanging CLI commands (bsc#1189551)
  * fix multipathd startup after stop during reconfigure (boo#1193338)
  * improve error detection and warning messages in config file parser
  * fix exit status of multipath -T (bsc#1191900)
  * fix defects reported by coverity (boo#1193342)
  - avoid sleeping with locks held
  - exit if bindings file is broken
  - set umask before mkstemp
  - add bounds and consistency checks in SCSI VPD parsing code
  * add hardware table entry for DellEMC/ME4 (PowerVault ME4)</changelog>
  <changelog author="mwilck@suse.com" date="1638532800">- Drop versioned dependency on libmpath0 again (bsc#1190622)
  * Since 0.8.6, libmultipath and libmpathpersist have got proper ABI
    versioning, and rpmbuild auto-generates dependencies on
    libmultipath.so.0(LIBMULTIPATH_13.0.0) etc.</changelog>
  <changelog author="mwilck@suse.com" date="1638792000">- Update to 0.8.8+38+suse.2bdd3a14.obscpio
  * upstream version bump. Code-wise identical to 0.8.7+138+suse.7c9afe31</changelog>
  <changelog author="mwilck@suse.com" date="1641556800">- Version 0.8.8+13+suse.79c3556f
  * code-wise identical to 0.8.8+38+suse.2bdd3a14
    (previous version number was too high by mistake)</changelog>
  <changelog author="mwilck@suse.com" date="1643803200">- Version 0.8.8+45+suse.628d603e
  * fix handling of historical-service-time path selector (bsc#1195425)
  * fix marking multipath devices as failed prematurely on startup
    (bsc#1195426)
  * multipathd.service: remove LimitCORE=infinity directive
    This should only be enabled for debugging.
  * multipathd.service: don't load scsi_dh modules (bsc#1195397)
    This is done via modules-load.d functionality on (open)SUSE
- Upstream fixes:
  * Fix claiming of paths with "find_multipaths strict"
  * Avoid unnecessary read-only reloads</changelog>
  <changelog author="mwilck@suse.com" date="1644408000">- Version 0.8.8+57+suse.dfb672fe
  * kpartx.rules: skip MD devices (bsc#1195644)
  * libmultipath: hwtable: use ALUA for all LIO targets (bsc#1195649)
  * multipathd.service: drop ExecStartPre for loading dm-multipath
    (bsc#1195397)</changelog>
  <changelog author="mwilck@suse.com" date="1644926400">- Update to version 0.8.8+60+suse.4c5922cb:
  * multipathd: add suppport for FC Fabric Performance Impact
    Notifications (FPIN) (bsc#1195506)</changelog>
  <changelog author="mwilck@suse.com" date="1645012800">- Update to version 0.8.8+64+suse.f265f7e0:
  * libmultipath: fix printing native nvme multipath topology
    (bsc#1196011)
  * libmultipath: add %L path wildcard for 64-bit hex LUN
  * libmultipath: support host adapter name lookup for s390x ccw bus</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- If multipath-tools is newly installed, load dm-multipath
  (bsc#1196898)</changelog>
  <changelog author="mwilck@suse.com" date="1649937600">- Update to version 0.8.9+42+suse.45974f11:
  * Logging improvements
  * Fix busy loop with delayed_reconfigure (bsc#1199342)
  * multipathd: use remove_map_callback for delayed reconfigure
  * multipathd: Don't keep starting TUR threads, if they always hang.
    (bsc#1199345)
  * Fix handling of path addition in read-only arrays on NVMe
  * Updates of built-in hardware database
- Update to upstream 0.8.9
  * libmultipath: only warn once about unsupported dev_loss_tmo
  * Otherwise code-identical to 0.8.8+64</changelog>
  <changelog author="mwilck@suse.com" date="1652097600">- Update to version 0.8.9+85+suse.a9da21c:
  * This is a pre-release of multipath-tools 0.9.0
  * multipath.conf: add "protocol" subsection in "overrides" section
    This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and
    "eh_deadline" on a per-protocol basis rather than per storage
  * multipath.conf: drop support for deprecated options:
    getuid_callout, pg_timeout, config_dir, multipath_dir
  * multipathd: don't switch to DAEMON_IDLE during startup
  (bsc#1199346, bsc#1197570)
  * multipathd: avoid delays during uevent processing (bsc#1199347)
  * Fixes for minor issues reported by coverity
  * Fix for memory leak with uid_attrs
  * Fix possibility to redefine -D_FORTIFY_SOURCE macro.
  * Updates for built in hardware db</changelog>
  <changelog author="mwilck@suse.com" date="1652184000">- Update to version 0.8.9+87+suse.a1eb122:
  * add ability to autodetect support for -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1652270400">- Update to version 0.8.9+90+suse.71a70fb:
  * support overriding -D_FORTIFY_SOURCE in OPTFLAGS
  * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors
    on old distros</changelog>
  <changelog author="mwilck@suse.com" date="1657713600">- Update to version 0.9.0+33+suse.fdc6686
  * multipath.conf: add support for "protocol" subsection in
    "overrides" section to set certain config options by protocol.
  * Removed the previously deprecated options getuid_callout,
    config_dir, multipath_dir, pg_timeout
  * hwable fixes and additions
  * multipath.conf(5): add disclaimer about vendor support
  * libmultipath, kpartx: fix callers of dm_get_next_target()
  * Change built-in defaults for NVMe: group by prio, and immediate
    failback
  * Allow compilation with -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1657713601">- Update to version 0.9.0+39+suse.51a2ab1:
  Upstream bug fixes:
  * libmultipath: fix find_multipaths_timeout for unknown hardware
  (boo#1201483)
  * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices
  (boo#1201483)</changelog>
  <changelog author="mwilck@suse.com" date="1661342400">- Update to version 0.9.0+55+suse.33d8854:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.9.0+62+suse.3e048d4:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="a11451ab5e733de80792e485557ab9052e506d5643daa34b8fc1d6256c444b0f" name="libmpath0" arch="x86_64">
  <version epoch="0" ver="0.9.0+62+suse.3e048d4" rel="150400.4.10.1"/>
  <changelog author="mwilck@suse.com" date="1632225600">- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1638446400">- Update to version 0.8.7+138+suse.7c9afe31:
  New upstream version (pre-0.8.8)
  * deprecate "config_dir" and "multipath_dir" config options
    (will be removed in future version)
  * remove dependency on systemd-udevd-settle.service (boo#1193336)
  * fix crash in remove_map (boo#1193334)
  * CLI: add path wildcard "%I" for init state
  * CLI: add "reconfigure all" command
  * allow multiple pending "reconfigure" commands (bsc#1189551)
  * speed up "reconfigure" by avoiding unnecessary map reloads
    (bsc#1189551)
  * rework of CLI command handler (unix socket handler) to avoid
    hanging CLI commands (bsc#1189551)
  * fix multipathd startup after stop during reconfigure (boo#1193338)
  * improve error detection and warning messages in config file parser
  * fix exit status of multipath -T (bsc#1191900)
  * fix defects reported by coverity (boo#1193342)
  - avoid sleeping with locks held
  - exit if bindings file is broken
  - set umask before mkstemp
  - add bounds and consistency checks in SCSI VPD parsing code
  * add hardware table entry for DellEMC/ME4 (PowerVault ME4)</changelog>
  <changelog author="mwilck@suse.com" date="1638532800">- Drop versioned dependency on libmpath0 again (bsc#1190622)
  * Since 0.8.6, libmultipath and libmpathpersist have got proper ABI
    versioning, and rpmbuild auto-generates dependencies on
    libmultipath.so.0(LIBMULTIPATH_13.0.0) etc.</changelog>
  <changelog author="mwilck@suse.com" date="1638792000">- Update to 0.8.8+38+suse.2bdd3a14.obscpio
  * upstream version bump. Code-wise identical to 0.8.7+138+suse.7c9afe31</changelog>
  <changelog author="mwilck@suse.com" date="1641556800">- Version 0.8.8+13+suse.79c3556f
  * code-wise identical to 0.8.8+38+suse.2bdd3a14
    (previous version number was too high by mistake)</changelog>
  <changelog author="mwilck@suse.com" date="1643803200">- Version 0.8.8+45+suse.628d603e
  * fix handling of historical-service-time path selector (bsc#1195425)
  * fix marking multipath devices as failed prematurely on startup
    (bsc#1195426)
  * multipathd.service: remove LimitCORE=infinity directive
    This should only be enabled for debugging.
  * multipathd.service: don't load scsi_dh modules (bsc#1195397)
    This is done via modules-load.d functionality on (open)SUSE
- Upstream fixes:
  * Fix claiming of paths with "find_multipaths strict"
  * Avoid unnecessary read-only reloads</changelog>
  <changelog author="mwilck@suse.com" date="1644408000">- Version 0.8.8+57+suse.dfb672fe
  * kpartx.rules: skip MD devices (bsc#1195644)
  * libmultipath: hwtable: use ALUA for all LIO targets (bsc#1195649)
  * multipathd.service: drop ExecStartPre for loading dm-multipath
    (bsc#1195397)</changelog>
  <changelog author="mwilck@suse.com" date="1644926400">- Update to version 0.8.8+60+suse.4c5922cb:
  * multipathd: add suppport for FC Fabric Performance Impact
    Notifications (FPIN) (bsc#1195506)</changelog>
  <changelog author="mwilck@suse.com" date="1645012800">- Update to version 0.8.8+64+suse.f265f7e0:
  * libmultipath: fix printing native nvme multipath topology
    (bsc#1196011)
  * libmultipath: add %L path wildcard for 64-bit hex LUN
  * libmultipath: support host adapter name lookup for s390x ccw bus</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- If multipath-tools is newly installed, load dm-multipath
  (bsc#1196898)</changelog>
  <changelog author="mwilck@suse.com" date="1649937600">- Update to version 0.8.9+42+suse.45974f11:
  * Logging improvements
  * Fix busy loop with delayed_reconfigure (bsc#1199342)
  * multipathd: use remove_map_callback for delayed reconfigure
  * multipathd: Don't keep starting TUR threads, if they always hang.
    (bsc#1199345)
  * Fix handling of path addition in read-only arrays on NVMe
  * Updates of built-in hardware database
- Update to upstream 0.8.9
  * libmultipath: only warn once about unsupported dev_loss_tmo
  * Otherwise code-identical to 0.8.8+64</changelog>
  <changelog author="mwilck@suse.com" date="1652097600">- Update to version 0.8.9+85+suse.a9da21c:
  * This is a pre-release of multipath-tools 0.9.0
  * multipath.conf: add "protocol" subsection in "overrides" section
    This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and
    "eh_deadline" on a per-protocol basis rather than per storage
  * multipath.conf: drop support for deprecated options:
    getuid_callout, pg_timeout, config_dir, multipath_dir
  * multipathd: don't switch to DAEMON_IDLE during startup
  (bsc#1199346, bsc#1197570)
  * multipathd: avoid delays during uevent processing (bsc#1199347)
  * Fixes for minor issues reported by coverity
  * Fix for memory leak with uid_attrs
  * Fix possibility to redefine -D_FORTIFY_SOURCE macro.
  * Updates for built in hardware db</changelog>
  <changelog author="mwilck@suse.com" date="1652184000">- Update to version 0.8.9+87+suse.a1eb122:
  * add ability to autodetect support for -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1652270400">- Update to version 0.8.9+90+suse.71a70fb:
  * support overriding -D_FORTIFY_SOURCE in OPTFLAGS
  * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors
    on old distros</changelog>
  <changelog author="mwilck@suse.com" date="1657713600">- Update to version 0.9.0+33+suse.fdc6686
  * multipath.conf: add support for "protocol" subsection in
    "overrides" section to set certain config options by protocol.
  * Removed the previously deprecated options getuid_callout,
    config_dir, multipath_dir, pg_timeout
  * hwable fixes and additions
  * multipath.conf(5): add disclaimer about vendor support
  * libmultipath, kpartx: fix callers of dm_get_next_target()
  * Change built-in defaults for NVMe: group by prio, and immediate
    failback
  * Allow compilation with -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1657713601">- Update to version 0.9.0+39+suse.51a2ab1:
  Upstream bug fixes:
  * libmultipath: fix find_multipaths_timeout for unknown hardware
  (boo#1201483)
  * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices
  (boo#1201483)</changelog>
  <changelog author="mwilck@suse.com" date="1661342400">- Update to version 0.9.0+55+suse.33d8854:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.9.0+62+suse.3e048d4:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="460995863d452e0bd9278f42e83cd6bb29cfa1be5ee80e71f4e5613111d53306" name="libndctl6" arch="x86_64">
  <version epoch="0" ver="71.1" rel="150400.10.3.1"/>
  <changelog author="msuchanek@suse.com" date="1565956800">- ndctl/list: Introduce region capability objects (bsc#1145772 ltc#178159).
  + ndctl-list-Introduce-region-capability-objects.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1566216000">- ndctl: Use the same align value as original namespace on reconfigure (bsc#1145577 ltc#178224).
  + ndctl-Use-the-same-align-value-as-original-namespace-on-reconfigure.patch
- ndctl/lib: Fix duplicate bus detection (bsc#1145573 ltc#180249).
  + ndctl-ndctl-lib-Fix-duplicate-bus-detection.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1566216001">- ndctl/namespace: Handle 'create-namespace' in label-less mode (bsc#1145471 ltc#179886).
  + ndctl-namespace-Handle-create-namespace-in-label-less-mode.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1566388800">- Refresh patches with upstream status:
  ndctl_check_Ensure_mmap_of_BTT_sections_work_with_64K_page-sizes.patch
  ndctl-namespace-Handle-create-namespace-in-label-less-mode.patch
  ndctl-list-Introduce-region-capability-objects.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1571400000">- Refresh patches with upstream status:
  ndctl-Use-the-same-align-value-as-original-namespace-on-reconfigure.patch
  ndctl-ndctl-lib-Fix-duplicate-bus-detection.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1573214400">- ndctl/dimm: Fix init-labels success reporting (bsc#1156308 ltc#181441).
  + ndctl-dimm-Fix-init-labels-success-reporting.patch
- Refresh patches with upstream status:
  ndctl-Use-the-same-align-value-as-original-namespace-on-reconfigure.patch
  ndctl-ndctl-lib-Fix-duplicate-bus-detection.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1583236800">- ndctl/test: Relax dax_pmem_compat requirement (bsc#1159523)
  + ndctl-test-Relax-dax_pmem_compat-requirement.patch
- Add -fcommon flag on Tumbleweed (boo#1160286).
- Fix 'ndctl enable-namespace all' fails trying to enable idle namespaces
  (bsc#1165509 ltc#182068).
  + ndctl-namespace-Fix-enable-namespace-error-for-seed-.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1585915200">- ndctl/namespace: Skip zero namespaces when processing all namespaces
  (bsc#1167861, bsc#1165509, ltc#182068).
  + ndctl-namespace-skip-zero-namespaces-when-processing.patch
- Refresh patch to upstream version:
  ndctl-test-Relax-dax_pmem_compat-requirement.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1589544000">- Update to v68:
  * zero-labels: display an error if regions are active
  * destroy-namespace: fix seed namespace accounting
  * list: drop named list objects from verbose listing
  * *-namespace: emit better errors on failure
  * read-infoblock: new command to read an infoblock
  * write-infoblock: new command to create and write an infoblock
  * create-namespace: add --continue option
  * daxctl-reconfigure-device: add --no-movable option
  * daxctl-reconfigure-device: display movable state in listings
  * daxctl-reconfigure-device: detect races in memory onlining
  * security: support for 'security frozen' attribute
  * daxctl-reconfigure-device: new command for device mode management
  * daxctl-{on,off}line-memory: new commands for devices in system-ram mode
  * monitor: logging improvements, allow sending to background
  * inject-error: refuse to operate on activew BTT namespaces
  * *-labels: improvements to minimize data transfer
  * create-namespace: usability improvements around region search
- Removed ndctl-Use-the-same-align-value-as-original-namespace-on-reconfigure.patch
- Removed ndctl-dimm-Fix-init-labels-success-reporting.patch
- Removed ndctl-list-Introduce-region-capability-objects.patch
- Removed ndctl-namespace-Fix-enable-namespace-error-for-seed-.patch
- Removed ndctl-namespace-Handle-create-namespace-in-label-less-mode.patch
- Removed ndctl-ndctl-lib-Fix-duplicate-bus-detection.patch
- Removed ndctl-test-Relax-dax_pmem_compat-requirement.patch
- Removed ndctl_check_Ensure_mmap_of_BTT_sections_work_with_64K_page-sizes.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1594728000">- Clarify documentation about filtering options (bsc#1173861)
  + ndctl-Documentation-use-includes-in-more-ndctl-command-pag.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1597060800">- Update to v69 (jsc#SLE-13824, jsc#SLE-12770, jsc#SLE-15065, jsc#SLE-15484,
    jsc#SLE-15485, bsc#1175052, ltc#186863, bsc#1174969, ltc#185845):
  * infoblock: Set the default alignment to the platform alignment
  * libndctl/papr_scm: Add support for reporting "life_used_percentage" metric
  * Skip region filtering if numa_node attribute is not present
  * libndctl,papr_scm: Implement support for PAPR_PDSM_HEALTH
  * miscellaneous bugfixes
- Removed ndctl-Documentation-use-includes-in-more-ndctl-command-pag.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1598616000">- Suppress ENXIO when processing all namespaces (jsc#SLE-13321, bsc#1175851, ltc#187867).
  + ndctl-namespace-Suppress-ENXIO-when-processing-all-n.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1603281600">- Update to upstream v70.1 (jsc#SLE-13338).
  Adds firmware activation support.</changelog>
  <changelog author="msuchanek@suse.de" date="1609416000">- Update to upstream v71 (jsc#SLE-14344, bsc#1170384).
  - support for the new device-dax subdivision functionality added in Linux in
    v5.10, including ways to create smaller devdax devices using
    daxctl/libdaxctl, as well as creating, listing, and restoring from a config
    dump, 'mappings' on these devices.
  - miscellaneous bugfixes
- Fix documentation and license packaging</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 71.1:
  * ndctl/dimm: Attempt an abort upon firmware-update-busy status
  * ndctl/dimm: Fix submit_abort_firmware()</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1611316800">- Enable aarch64 build (bsc#1188502).</changelog>
  <changelog author="jsegitz@suse.com" date="1634126400">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_ndctl-monitor.service.patch</changelog>
  <changelog author="mwilck@suse.com" date="1646395200">- Install modprobe.conf file to %_modprobedir (bsc#1196275, jsc#SLE-20639)</changelog>
  <changelog author="msuchanek@suse.com" date="1646654400">- Add support for reporting dirty shutdown count (jsc#SLE-18196).
  + 0016-libndctl-papr-Add-support-for-reporting-shutdown-cou.patch
  + 0009-libndctl-papr-Fix-probe-for-papr-scm-compatible-nvdi.patch
  + 0003-libndctl-Unify-adding-dimms-for-papr-and-nfit-famili.patch
- Merge fixes that went into v72 and v73
  - Documentation updates
    + 0015-ndctl-docs-Clarify-update-firwmware-activation-overf.patch
    + 0014-Documentation-ndctl-fix-self-reference-of-ndctl-disa.patch
    + 0013-daxctl-Add-Soft-Reservation-theory-of-operation.patch
    + 0008-ndctl-Update-nvdimm-mailing-list-address.patch
  - Label index block calculation fix
    + 0012-ndctl-dimm-Fix-label-index-block-calculations.patch
    + 0002-Expose-ndctl_bus_nfit_translate_spa-as-a-public-func.patch
  - Scrub fix
    + 0011-ndctl-scrub-Reread-scrub-engine-status-at-start.patch
    + 0010-ndctl-scrub-Stop-translating-return-values.patch
  - Add memblock count to JSON
    + 0007-daxctl-emit-counts-of-total-and-online-memblocks.patch
  - DAX disable fix
    + 0006-libndctl-check-for-active-system-ram-before-disablin.patch
    + 0005-libdaxctl-add-an-API-to-check-if-a-device-is-active.patch
    + 0001-ndctl-namespace-Fix-disable-namespace-accounting-rel.patch
  - DAX reconfigure fix
    + 0004-daxctl-fail-reconfigure-device-based-on-kernel-onlin.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1677067200">- Fix parsing NDCTL_TIMEOUT (bsc#1208548 ltc#199892)
    + ndctl-Fix-the-NDCTL_TIMEOUT-environment-variable-par.patch</changelog>
</package>
<package pkgid="e40328c0996870f6f7981010400f032cac777d7a0475a4736d47fa22cf4af007" name="libnvme" arch="src">
  <version epoch="0" ver="1.0" rel="150400.3.12.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- fabrics: Duplicate strings when merging configs (bsc#1205019)
  * add 0022-fabrics-Duplicate-strings-when-merging-configs.patch
- remove unused patch (duplicated of patch #0013)
  * remove 0022-json-schema-add-dhchap_key-details-to-host-section.patch</changelog>
  <changelog author="mwilck@suse.com" date="1669204800">- export nvme_ctrl_is_peristent() (bsc#1205657)
  * add 0023-libnvme.map-add-nvme_ctrl_is_persistent.patch</changelog>
</package>
<package pkgid="0172172214fcd611df5d50dc2c365c7628a294bc8978f916e1d7bcdb59c6b005" name="libnvme" arch="src">
  <version epoch="0" ver="1.0" rel="150400.3.15.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- fabrics: Duplicate strings when merging configs (bsc#1205019)
  * add 0022-fabrics-Duplicate-strings-when-merging-configs.patch
- remove unused patch (duplicated of patch #0013)
  * remove 0022-json-schema-add-dhchap_key-details-to-host-section.patch</changelog>
  <changelog author="mwilck@suse.com" date="1669204800">- export nvme_ctrl_is_peristent() (bsc#1205657)
  * add 0023-libnvme.map-add-nvme_ctrl_is_persistent.patch</changelog>
  <changelog author="mwilck@suse.com" date="1674648000">- Fix import error in python-libnvme (bsc#1207159)
  * add 0024-libnvme.map-export-nvme_ctrl_-get-set-_dhchap_host_k.patch
- spec file: add %check target</changelog>
</package>
<package pkgid="ceb7bc65a22fe49a918f622d528452b191e99d1ddefd9bfe9274bc38a4d7f90e" name="libnvme" arch="src">
  <version epoch="0" ver="1.0" rel="150400.3.9.3"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- fabrics: Duplicate strings when merging configs (bsc#1205019)
  * add 0022-fabrics-Duplicate-strings-when-merging-configs.patch
- remove unused patch (duplicated of patch #0013)
  * remove 0022-json-schema-add-dhchap_key-details-to-host-section.patch</changelog>
</package>
<package pkgid="cc8d63fe4d2d1fb6260968d4f1b336e8ede1fbcdb7540153158137707bc7c2c8" name="libnvme1" arch="aarch64">
  <version epoch="0" ver="1.0" rel="150400.3.12.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- fabrics: Duplicate strings when merging configs (bsc#1205019)
  * add 0022-fabrics-Duplicate-strings-when-merging-configs.patch
- remove unused patch (duplicated of patch #0013)
  * remove 0022-json-schema-add-dhchap_key-details-to-host-section.patch</changelog>
  <changelog author="mwilck@suse.com" date="1669204800">- export nvme_ctrl_is_peristent() (bsc#1205657)
  * add 0023-libnvme.map-add-nvme_ctrl_is_persistent.patch</changelog>
</package>
<package pkgid="709473364d7658f91e1d73096a97b7b5e894646aee84af587d5d2dc1d0539f2e" name="libnvme1" arch="x86_64">
  <version epoch="0" ver="1.0" rel="150400.3.12.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- fabrics: Duplicate strings when merging configs (bsc#1205019)
  * add 0022-fabrics-Duplicate-strings-when-merging-configs.patch
- remove unused patch (duplicated of patch #0013)
  * remove 0022-json-schema-add-dhchap_key-details-to-host-section.patch</changelog>
  <changelog author="mwilck@suse.com" date="1669204800">- export nvme_ctrl_is_peristent() (bsc#1205657)
  * add 0023-libnvme.map-add-nvme_ctrl_is_persistent.patch</changelog>
</package>
<package pkgid="57bb1bcf2d32fa9a375aa424126e107bf01b529de5af562cf01a40ede23b64e5" name="libnvme1" arch="aarch64">
  <version epoch="0" ver="1.0" rel="150400.3.15.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- fabrics: Duplicate strings when merging configs (bsc#1205019)
  * add 0022-fabrics-Duplicate-strings-when-merging-configs.patch
- remove unused patch (duplicated of patch #0013)
  * remove 0022-json-schema-add-dhchap_key-details-to-host-section.patch</changelog>
  <changelog author="mwilck@suse.com" date="1669204800">- export nvme_ctrl_is_peristent() (bsc#1205657)
  * add 0023-libnvme.map-add-nvme_ctrl_is_persistent.patch</changelog>
  <changelog author="mwilck@suse.com" date="1674648000">- Fix import error in python-libnvme (bsc#1207159)
  * add 0024-libnvme.map-export-nvme_ctrl_-get-set-_dhchap_host_k.patch
- spec file: add %check target</changelog>
</package>
<package pkgid="526bbc5c937fc1f4820685d324ad55326093c03c355ae13ac13bdbfbc9e2263a" name="libnvme1" arch="x86_64">
  <version epoch="0" ver="1.0" rel="150400.3.15.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- fabrics: Duplicate strings when merging configs (bsc#1205019)
  * add 0022-fabrics-Duplicate-strings-when-merging-configs.patch
- remove unused patch (duplicated of patch #0013)
  * remove 0022-json-schema-add-dhchap_key-details-to-host-section.patch</changelog>
  <changelog author="mwilck@suse.com" date="1669204800">- export nvme_ctrl_is_peristent() (bsc#1205657)
  * add 0023-libnvme.map-add-nvme_ctrl_is_persistent.patch</changelog>
  <changelog author="mwilck@suse.com" date="1674648000">- Fix import error in python-libnvme (bsc#1207159)
  * add 0024-libnvme.map-export-nvme_ctrl_-get-set-_dhchap_host_k.patch
- spec file: add %check target</changelog>
</package>
<package pkgid="ba033494e03378e7c57c2b78dea66ba304036d3829ba2b3a44bc1bd9ee7a2714" name="libnvme1" arch="aarch64">
  <version epoch="0" ver="1.0" rel="150400.3.9.3"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- fabrics: Duplicate strings when merging configs (bsc#1205019)
  * add 0022-fabrics-Duplicate-strings-when-merging-configs.patch
- remove unused patch (duplicated of patch #0013)
  * remove 0022-json-schema-add-dhchap_key-details-to-host-section.patch</changelog>
</package>
<package pkgid="019dd9bd021d212a14bfc7e707de8deca64c0cd7f150e26358f5b27623110071" name="libnvme1" arch="x86_64">
  <version epoch="0" ver="1.0" rel="150400.3.9.3"/>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Initial package creation for libnvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Fix Source URL</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507201">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- fabrics: Duplicate strings when merging configs (bsc#1205019)
  * add 0022-fabrics-Duplicate-strings-when-merging-configs.patch
- remove unused patch (duplicated of patch #0013)
  * remove 0022-json-schema-add-dhchap_key-details-to-host-section.patch</changelog>
</package>
<package pkgid="57ecd2264f02994072b50b71a16fd9298003d77b03c5fff949b2923cda561837" name="libopenssl-1_1-devel" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.16.1"/>
  <changelog author="pmonreal@suse.com" date="1647604800">- FIPS: Additional PBKDF2 requirements for KAT [bsc#1197280]
  * The IG 10.3.A and SP800-132 require some minimum parameters for
    the salt length, password length and iteration count. These
    parameters should be also used in the KAT.
  * Add openssl-1_1-FIPS-PBKDF2-KAT-requirements.patch</changelog>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
</package>
<package pkgid="c171d7a5a1d23d224217a9f029dd36f4cc66598d51c81c3a3eb0fb8461f6eaa5" name="libopenssl-1_1-devel" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.16.1"/>
  <changelog author="pmonreal@suse.com" date="1647604800">- FIPS: Additional PBKDF2 requirements for KAT [bsc#1197280]
  * The IG 10.3.A and SP800-132 require some minimum parameters for
    the salt length, password length and iteration count. These
    parameters should be also used in the KAT.
  * Add openssl-1_1-FIPS-PBKDF2-KAT-requirements.patch</changelog>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
</package>
<package pkgid="2c011111d7b0f97e4c553f80e959861cb073a706f80b87ae9dfbeea2db961f41" name="libopenssl-1_1-devel" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.19.1"/>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
</package>
<package pkgid="a31d9098c6362778a8f67c004052c031feacb557d83a9c05a04a8267b114e623" name="libopenssl-1_1-devel" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.19.1"/>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
</package>
<package pkgid="b5c8d72eb50c8dd916c44a5373a85e16de074c5d556c17197d66408db393a918" name="libopenssl-1_1-devel" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.22.1"/>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
</package>
<package pkgid="a9f7d38f661e3de4327f83303b97cc54415b5c15b61ddf816f2a1c2e6bda85d7" name="libopenssl-1_1-devel" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.22.1"/>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
</package>
<package pkgid="294b680e5c628014f45c99d186480a0a04016d7c375efd03564a7df6d20217df" name="libopenssl-1_1-devel" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.25.1"/>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
</package>
<package pkgid="46fc526d1b006bbd6ac713cd32a9afe01380ff9485e51b21a907186bb4b264a8" name="libopenssl-1_1-devel" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.25.1"/>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
</package>
<package pkgid="e11049d0dd424636643cf8f1f882404c7b65007ff7bbd541b784aa5c2077d783" name="libopenssl-1_1-devel" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.28.1"/>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
</package>
<package pkgid="66fb7ea250269746701374c30ea577652a0e0a8e01f171e715664b32cb7cc0c3" name="libopenssl-1_1-devel" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.28.1"/>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
</package>
<package pkgid="fcaaaeaa0dec3862db3551d346f3f9810dba81f86cbdbe78d23e43da6242f3cb" name="libopenssl1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.16.1"/>
  <changelog author="pmonreal@suse.com" date="1647604800">- FIPS: Additional PBKDF2 requirements for KAT [bsc#1197280]
  * The IG 10.3.A and SP800-132 require some minimum parameters for
    the salt length, password length and iteration count. These
    parameters should be also used in the KAT.
  * Add openssl-1_1-FIPS-PBKDF2-KAT-requirements.patch</changelog>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
</package>
<package pkgid="0e88397b3373873570918e91a709f7d6b5b6cc1cdd214504d06e13c7d4b8c244" name="libopenssl1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.16.1"/>
  <changelog author="pmonreal@suse.com" date="1647604800">- FIPS: Additional PBKDF2 requirements for KAT [bsc#1197280]
  * The IG 10.3.A and SP800-132 require some minimum parameters for
    the salt length, password length and iteration count. These
    parameters should be also used in the KAT.
  * Add openssl-1_1-FIPS-PBKDF2-KAT-requirements.patch</changelog>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
</package>
<package pkgid="bf19929a8c5a572cd478311d028b2f884fea3ea3a62d3323639c6dbe40c4bff9" name="libopenssl1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.19.1"/>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
</package>
<package pkgid="d9071667520e3563c8315eeef7815fc4d5b53476911fd6caafa1b9737bfe3103" name="libopenssl1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.19.1"/>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
</package>
<package pkgid="44746ef1091051c446f659e1daee861c8e1baeb631305215942e9e9fbfe67717" name="libopenssl1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.22.1"/>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
</package>
<package pkgid="d979527b2911c64f912fecec47bf41512b8009c195b7e80f6428bbaf837f9330" name="libopenssl1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.22.1"/>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
</package>
<package pkgid="7a80fe57c1c525078a72cd1634748054dfc715313ee5d974e10e87eb23645871" name="libopenssl1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.25.1"/>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
</package>
<package pkgid="48bff6032fca585ebd17971d13298f81a12bd6482ccd8c0fc0305b23350673f7" name="libopenssl1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.25.1"/>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
</package>
<package pkgid="233136bd22026487f48821c7561c28788e58f08db47727354a94340f7cce0900" name="libopenssl1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.28.1"/>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
</package>
<package pkgid="60fa2a92e11db166588ca4d331c2a9510be8fbbb53fc3bdf7ac2bc060ff3f058" name="libopenssl1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.28.1"/>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
</package>
<package pkgid="d3230b3439341e7b8dfa8da3f7cfc4bb9e228d22ca96276e589ac11a901371b1" name="libopenssl1_1-hmac" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.16.1"/>
  <changelog author="pmonreal@suse.com" date="1647604800">- FIPS: Additional PBKDF2 requirements for KAT [bsc#1197280]
  * The IG 10.3.A and SP800-132 require some minimum parameters for
    the salt length, password length and iteration count. These
    parameters should be also used in the KAT.
  * Add openssl-1_1-FIPS-PBKDF2-KAT-requirements.patch</changelog>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
</package>
<package pkgid="6a24b9c18c5d336713a6b1da1f9f4f1d572b02e84723c429d0229597f5903333" name="libopenssl1_1-hmac" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.16.1"/>
  <changelog author="pmonreal@suse.com" date="1647604800">- FIPS: Additional PBKDF2 requirements for KAT [bsc#1197280]
  * The IG 10.3.A and SP800-132 require some minimum parameters for
    the salt length, password length and iteration count. These
    parameters should be also used in the KAT.
  * Add openssl-1_1-FIPS-PBKDF2-KAT-requirements.patch</changelog>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
</package>
<package pkgid="9232185a38e64877beb7f80463c729d04f61ee60431e59a3f01e1e394724ac0e" name="libopenssl1_1-hmac" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.19.1"/>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
</package>
<package pkgid="c255af122d5792de3d115d4698c9c7c090a7f5ffee24f70c160cf71b5d6acd51" name="libopenssl1_1-hmac" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.19.1"/>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
</package>
<package pkgid="56f77e7406c02e1124988b4494447d30c5e2e2c633ef47716b38e94045439a50" name="libopenssl1_1-hmac" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.22.1"/>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
</package>
<package pkgid="9a96518c2c2708c8958d5d48f0e0d56402ece67d3ed477cbf202445263d2545a" name="libopenssl1_1-hmac" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.22.1"/>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
</package>
<package pkgid="70fd1c9daf854ef5578034cb4e8c60249b2a44164201aea40b7020537b3a0dea" name="libopenssl1_1-hmac" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.25.1"/>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
</package>
<package pkgid="25a171e8a6412dfeac2832853394236dd3e5d30d05d5d9517f7aa6c3974933b1" name="libopenssl1_1-hmac" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.25.1"/>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
</package>
<package pkgid="7b08f3a5b10b942e1abbd8ac1ff05fced1f1d009d8a582b8678a496dfa8ddf52" name="libopenssl1_1-hmac" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.28.1"/>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
</package>
<package pkgid="f9b262bf17fa34d3ec509d24f3fe871257524e0b727604f8b724815c37787833" name="libopenssl1_1-hmac" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.28.1"/>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
</package>
<package pkgid="d3bc0ae0a7767bd8805e80b98cb5b9c95cb1afc56dc1d38223edf2f215114775" name="libpixman-1-0" arch="aarch64">
  <version epoch="0" ver="0.40.0" rel="150400.3.3.1"/>
  <changelog author="zaitor@opensuse.org" date="1440244800">- Update to version 0.33.2:
  + ARMv6 - Many fast paths implementations were added.
  + PPC64/PPC64LE - Fix all outstanding bugs and add many fast
    paths implementations using vmx.
  + Major enhancements to lowlevel-blt-bench utility.
  + A couple of fixes and enhancements to mmx code.</changelog>
  <changelog author="zaitor@opensuse.org" date="1445947200">- Update to version 0.33.4:
  + Important security fix to prevent stack buffer overflow.
  + POWER: New fast-paths and optimizations to existing fast-paths.
  + ARMv6: New fast-path.
  + Tests: New cover and fence-image-self tests.
  + Remove redundant corrections in various calculations for
    COVER-CLIP and COVER analysis.</changelog>
  <changelog author="zaitor@opensuse.org" date="1451736000">- Update to version 0.33.6:
  + configura.ac: fix test for SSE2 &amp; SSSE3 assembler support.
  + mmx: Improve detection of support for "K" constraint.
  + Revert "mmx: Use MMX2 intrinsics from xmmintrin.h directly".</changelog>
  <changelog author="zaitor@opensuse.org" date="1454328000">- Update to version 0.34.0:
  + No changes from last version, stable version release only.</changelog>
  <changelog author="zaitor@opensuse.org" date="1459771200">- Add pixman-private-correct-include.patch: pixman-private: include
  &lt;float.h&gt; only in C code, patch from upstream git.</changelog>
  <changelog author="mgorse@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520251200">- Fix SRPM group. Update summaries.</changelog>
  <changelog author="mvetter@suse.com" date="1542974400">- Update to version 0.36.0:
  + Add tests for (a)rgb floating point formats
  + Add support for argb/xrgb float formats, v5
  + Fix stride calculation in stress-test
  + Adjust for clang's removal of __builtin_shuffle
  + Fix vector loads on ppc64le
  + Promote unsigned short to unsigned int explicitly
  + pixman-filter: Made Gaussian a bit wider
  + pixman-filter: Nested polynomial for cubic
  + pixman-filter: Fix several issues related to normalization
  + pixman-filter: Speed up BOX/BOX filter
  + pixman-filter: integral splitting is only needed for triangle
    filterdd
  + pixman-filter: Correct Simpsons integration
  + pixman-filter: reduce amount of malloc/free/memcpy to generate
    filter
  + pixman-image: Added enable-gnuplot config to view filters in
    gnuplot
  + pixman-fast-path.c: Pick NEAREST affine fast paths before
    BILINEAR ones
  + pixman-private: include &lt;float.h&gt; only in C code
- Remove pixman-private-correct-include.patch: upstreamed</changelog>
  <changelog author="info@paolostivanin.com" date="1587384000">- Update to versio 0.40.0:
  + Meson build system improvements
  + Supporting optimizations on Hygon Dhyana processors
    to match what is enabled for Intel/AMD CPUs.
  + A few Loongson fixes/improvements.
  + Lots of other fixes</changelog>
  <changelog author="mgorse@suse.com" date="1667563200">- Add pixman-CVE-2022-44638.patch: avoid an integer overflow
  (boo#1205033 CVE-2022-44638).</changelog>
</package>
<package pkgid="db6dd4d79d4f5f9bd6611b243466d68e58d452c65d23a2c255d8502c4ff8a245" name="libpixman-1-0" arch="x86_64">
  <version epoch="0" ver="0.40.0" rel="150400.3.3.1"/>
  <changelog author="zaitor@opensuse.org" date="1440244800">- Update to version 0.33.2:
  + ARMv6 - Many fast paths implementations were added.
  + PPC64/PPC64LE - Fix all outstanding bugs and add many fast
    paths implementations using vmx.
  + Major enhancements to lowlevel-blt-bench utility.
  + A couple of fixes and enhancements to mmx code.</changelog>
  <changelog author="zaitor@opensuse.org" date="1445947200">- Update to version 0.33.4:
  + Important security fix to prevent stack buffer overflow.
  + POWER: New fast-paths and optimizations to existing fast-paths.
  + ARMv6: New fast-path.
  + Tests: New cover and fence-image-self tests.
  + Remove redundant corrections in various calculations for
    COVER-CLIP and COVER analysis.</changelog>
  <changelog author="zaitor@opensuse.org" date="1451736000">- Update to version 0.33.6:
  + configura.ac: fix test for SSE2 &amp; SSSE3 assembler support.
  + mmx: Improve detection of support for "K" constraint.
  + Revert "mmx: Use MMX2 intrinsics from xmmintrin.h directly".</changelog>
  <changelog author="zaitor@opensuse.org" date="1454328000">- Update to version 0.34.0:
  + No changes from last version, stable version release only.</changelog>
  <changelog author="zaitor@opensuse.org" date="1459771200">- Add pixman-private-correct-include.patch: pixman-private: include
  &lt;float.h&gt; only in C code, patch from upstream git.</changelog>
  <changelog author="mgorse@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520251200">- Fix SRPM group. Update summaries.</changelog>
  <changelog author="mvetter@suse.com" date="1542974400">- Update to version 0.36.0:
  + Add tests for (a)rgb floating point formats
  + Add support for argb/xrgb float formats, v5
  + Fix stride calculation in stress-test
  + Adjust for clang's removal of __builtin_shuffle
  + Fix vector loads on ppc64le
  + Promote unsigned short to unsigned int explicitly
  + pixman-filter: Made Gaussian a bit wider
  + pixman-filter: Nested polynomial for cubic
  + pixman-filter: Fix several issues related to normalization
  + pixman-filter: Speed up BOX/BOX filter
  + pixman-filter: integral splitting is only needed for triangle
    filterdd
  + pixman-filter: Correct Simpsons integration
  + pixman-filter: reduce amount of malloc/free/memcpy to generate
    filter
  + pixman-image: Added enable-gnuplot config to view filters in
    gnuplot
  + pixman-fast-path.c: Pick NEAREST affine fast paths before
    BILINEAR ones
  + pixman-private: include &lt;float.h&gt; only in C code
- Remove pixman-private-correct-include.patch: upstreamed</changelog>
  <changelog author="info@paolostivanin.com" date="1587384000">- Update to versio 0.40.0:
  + Meson build system improvements
  + Supporting optimizations on Hygon Dhyana processors
    to match what is enabled for Intel/AMD CPUs.
  + A few Loongson fixes/improvements.
  + Lots of other fixes</changelog>
  <changelog author="mgorse@suse.com" date="1667563200">- Add pixman-CVE-2022-44638.patch: avoid an integer overflow
  (boo#1205033 CVE-2022-44638).</changelog>
</package>
<package pkgid="49239eb7f7f16956f387df0e9b23e2397d807f6dd50c9b9b7f3acf44a8ef99b6" name="libprocps7" arch="aarch64">
  <version epoch="0" ver="3.3.15" rel="150000.7.28.1"/>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
  <changelog author="werner@suse.de" date="1671105600">- Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412)
- Make sure that correct library version is installed (bsc#1206412)</changelog>
</package>
<package pkgid="c985064b5a3c22141b3f3e1124af14badda171f235881e774225ad0315069480" name="libprocps7" arch="x86_64">
  <version epoch="0" ver="3.3.15" rel="150000.7.28.1"/>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
  <changelog author="werner@suse.de" date="1671105600">- Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412)
- Make sure that correct library version is installed (bsc#1206412)</changelog>
</package>
<package pkgid="49902fcb5e9f25f24df32042872e6b6e98bfbf7a299de05a77aec1650023bc36" name="libpython3_6m1_0" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="2749258afbcbadc7f896d6a46ed3481034b6e9df19264462f8749e2337c1a886" name="libpython3_6m1_0" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="548e35746a4da58adc29a1926c15260c1dc22041096c8caa27a73098d2578d59" name="libpython3_6m1_0" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="d2405f2bf2822f171d52444d62e864c3c20a9a80076ca7944772418d45602044" name="libpython3_6m1_0" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="52ba2aeec406365cd45198485df422d1a05476f3c78b5209a1c8b787a6217d28" name="libpython3_6m1_0" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.45.1"/>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
</package>
<package pkgid="cda6765cd8de9d6f3e440af1041441c7994d5bd1f37812951e3e47ee9ab11ee0" name="libpython3_6m1_0" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.45.1"/>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
</package>
<package pkgid="34852d0aea50770445945037a53b252741ba988e6fb24f3253ed66d8c51bc1f2" name="librados2" arch="aarch64">
  <version epoch="0" ver="16.2.11.58+g38d6afd3b78" rel="150400.3.6.1"/>
  <changelog author="ncutler@suse.com" date="1636113600">- Update to 16.2.6-462-g5fefbbf8888:
  + rebased on top of upstream commit SHA1 dd7139c66c1d36da50475ec97d8d6b54b07d1dea
  * (bsc#1191751) rgw/tracing: unify SO version numbers within librgw2 package
  * spec: make selinux scriptlets respect CEPH_AUTO_RESTART_ON_UPGRADE</changelog>
  <changelog author="ncutler@suse.com" date="1636545600">- Preservation of Bugzilla, Jira and CVE citations from earlier incarnations of
  this changes file after double-checking that none of these fixes got lost in
  the pacific rebase:
  + bsc#1163764 (--container-init feature cherry-picked to octopus)
  + bsc#1170200 (mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically)
  + bsc#1172926 (mgr/orchestrator: Sort 'ceph orch device ls' by host)
  + bsc#1173079 (mgr/devicehealth: device_health_metrics pool gets created even without any OSDs in the cluster)
  + bsc#1174466 (mon: have 'mon stat' output json as well)
  + bsc#1174526 (mgr/dashboard: allow getting fresh inventory data from the orchestrator)
  + bsc#1174529 (rpm: on SUSE, podman is required for cephadm to work)
  + bsc#1174644 (cephadm: log to file)
  + bsc#1175120 (downstream branding)
  + bsc#1175161 (downstream branding)
  + bsc#1175169 (downstream branding)
  + bsc#1176390 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176451 (Drop patch "rpm: on SUSE, podman is required for cephadm to work")
  + bsc#1176489 (mgr/cephadm: lock multithreaded access to OSDRemovalQueue)
  + bsc#1176499 (mgr/cephadm: fix RemoveUtil.load_from_store())
  + bsc#1176638 (ceph-volume: batch: call the right prepare method)
  + bsc#1176679 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176828 (cephadm: command_unit: call systemctl with verbose=True)
  + bsc#1177078 (mgr/dashboard: Fix bugs in a unit test and i18n translation)
  + bsc#1177151 (python-common: do not skip unavailable devices)
  + bsc#1177319 (--container-init feature cherry-picked to octopus)
  + bsc#1177344 (mgr/dashboard: support Orchestrator and user-defined Ganesha cluster)
  + bsc#1177360 (cephadm: silence "Failed to evict container" log msg)
  + bsc#1177450 (ceph-volume: don't exit before empty report can be printed)
  + bsc#1177643 (Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse")
  + bsc#1177676 (cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files)
  + bsc#1177843 (CVE-2020-25660)
  + bsc#1177857 (mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails)
  + bsc#1177933 (cephadm: configure journald as the logdriver)
  + bsc#1178531 (cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph)
  + bsc#1178837 (rgw: cls/user: set from_index for reset stats calls)
  + bsc#1178860 (mgr/dashboard: Disable TLS 1.0 and 1.1)
  + bsc#1178905 (CVE-2020-25678)
  + bsc#1178932 (cephadm: reference the last local image by digest)
  + bsc#1179016 (rpm: require smartmontools on SUSE)
  + bsc#1179452 (mgr/insights: Test environment requires 'six')
  + bsc#1179526 (rgw: during GC defer, prevent new GC enqueue)
  + bsc#1179569 (cephadm: reference the last local image by digest)
  + bsc#1179802 (CVE-2020-27781)
  + bsc#1179997 (CVE-2020-27839)
  + bsc#1180107 (ceph-volume: pass --filter-for-batch from drive-group subcommand)
  + bsc#1180155 (CVE-2020-27781)
  + bsc#1181291 (mgr/cephadm: alias rgw-nfs -&gt; nfs)
  + bsc#1182766 (cephadm: fix 'inspect' and 'pull')
  + bsc#1183074 (CVE-2021-20288)
  + bsc#1183561 (mgr/cephadm: on ssh connection error, advice chmod 0600)
  + bsc#1183899 (bluestore: fix huge reads/writes at BlueFS)
  + bsc#1184231 (cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections)
  + bsc#1184517 (cls/rgw: look for plane entries in non-ascii plain namespace too)
  + bsc#1185246 (rgw: check object locks in multi-object delete)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1186020 (CVE-2021-3531)
  + bsc#1186021 (CVE-2021-3509)
  + bsc#1186348 (mgr/zabbix: adapt zabbix_sender default path)
  + bsc#1188979 ("mgr/cephadm: pass --container-init to "cephadm deploy" if specified" and "Revert "cephadm: default container_init to False")
  + bsc#1189173 (downstream branding)
  + jsc#SES-1071 (ceph-volume: major batch refactor - upstream PR#34740)
  + jsc#SES-185 (SES support with cache software)
  + jsc#SES-704 (mgr/snap_schedule)</changelog>
  <changelog author="ncutler@suse.com" date="1637582400">- Update to 16.2.6-463-g22e7612f9ad:
  + (bsc#1178073) mgr/dashboard: fix downstream NFS doc links</changelog>
  <changelog author="stefen.allen@suse.com" date="1641816000">- Update to 16.2.7-37-gb3be69440db:
  + (bsc#1194353) Downstream branding breaks dashboard npm build
  + (bsc#1188911) OSD marked down causes wrong backfill_toofull</changelog>
  <changelog author="stefen.allen@suse.com" date="1646395200">- Update to 16.2.7-577-g3e3603b5dd1
  + Update prometheus-server version</changelog>
  <changelog author="stefen.allen@suse.com" date="1646740800">- Update to 16.2.7-596-g7d574789716
  + Update Prometheus Container image paths (pr #459)
  + mgr/dashboard: Fix documentation URL (pr #456)
  + mgr/dashboard: Adapt downstream branded navigation page (pr #454)</changelog>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
</package>
<package pkgid="52998835663cc7952cb7d130e104ea38287dd56932fcb7fcbc43a7c7050a4362" name="librados2" arch="x86_64">
  <version epoch="0" ver="16.2.11.58+g38d6afd3b78" rel="150400.3.6.1"/>
  <changelog author="ncutler@suse.com" date="1636113600">- Update to 16.2.6-462-g5fefbbf8888:
  + rebased on top of upstream commit SHA1 dd7139c66c1d36da50475ec97d8d6b54b07d1dea
  * (bsc#1191751) rgw/tracing: unify SO version numbers within librgw2 package
  * spec: make selinux scriptlets respect CEPH_AUTO_RESTART_ON_UPGRADE</changelog>
  <changelog author="ncutler@suse.com" date="1636545600">- Preservation of Bugzilla, Jira and CVE citations from earlier incarnations of
  this changes file after double-checking that none of these fixes got lost in
  the pacific rebase:
  + bsc#1163764 (--container-init feature cherry-picked to octopus)
  + bsc#1170200 (mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically)
  + bsc#1172926 (mgr/orchestrator: Sort 'ceph orch device ls' by host)
  + bsc#1173079 (mgr/devicehealth: device_health_metrics pool gets created even without any OSDs in the cluster)
  + bsc#1174466 (mon: have 'mon stat' output json as well)
  + bsc#1174526 (mgr/dashboard: allow getting fresh inventory data from the orchestrator)
  + bsc#1174529 (rpm: on SUSE, podman is required for cephadm to work)
  + bsc#1174644 (cephadm: log to file)
  + bsc#1175120 (downstream branding)
  + bsc#1175161 (downstream branding)
  + bsc#1175169 (downstream branding)
  + bsc#1176390 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176451 (Drop patch "rpm: on SUSE, podman is required for cephadm to work")
  + bsc#1176489 (mgr/cephadm: lock multithreaded access to OSDRemovalQueue)
  + bsc#1176499 (mgr/cephadm: fix RemoveUtil.load_from_store())
  + bsc#1176638 (ceph-volume: batch: call the right prepare method)
  + bsc#1176679 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176828 (cephadm: command_unit: call systemctl with verbose=True)
  + bsc#1177078 (mgr/dashboard: Fix bugs in a unit test and i18n translation)
  + bsc#1177151 (python-common: do not skip unavailable devices)
  + bsc#1177319 (--container-init feature cherry-picked to octopus)
  + bsc#1177344 (mgr/dashboard: support Orchestrator and user-defined Ganesha cluster)
  + bsc#1177360 (cephadm: silence "Failed to evict container" log msg)
  + bsc#1177450 (ceph-volume: don't exit before empty report can be printed)
  + bsc#1177643 (Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse")
  + bsc#1177676 (cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files)
  + bsc#1177843 (CVE-2020-25660)
  + bsc#1177857 (mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails)
  + bsc#1177933 (cephadm: configure journald as the logdriver)
  + bsc#1178531 (cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph)
  + bsc#1178837 (rgw: cls/user: set from_index for reset stats calls)
  + bsc#1178860 (mgr/dashboard: Disable TLS 1.0 and 1.1)
  + bsc#1178905 (CVE-2020-25678)
  + bsc#1178932 (cephadm: reference the last local image by digest)
  + bsc#1179016 (rpm: require smartmontools on SUSE)
  + bsc#1179452 (mgr/insights: Test environment requires 'six')
  + bsc#1179526 (rgw: during GC defer, prevent new GC enqueue)
  + bsc#1179569 (cephadm: reference the last local image by digest)
  + bsc#1179802 (CVE-2020-27781)
  + bsc#1179997 (CVE-2020-27839)
  + bsc#1180107 (ceph-volume: pass --filter-for-batch from drive-group subcommand)
  + bsc#1180155 (CVE-2020-27781)
  + bsc#1181291 (mgr/cephadm: alias rgw-nfs -&gt; nfs)
  + bsc#1182766 (cephadm: fix 'inspect' and 'pull')
  + bsc#1183074 (CVE-2021-20288)
  + bsc#1183561 (mgr/cephadm: on ssh connection error, advice chmod 0600)
  + bsc#1183899 (bluestore: fix huge reads/writes at BlueFS)
  + bsc#1184231 (cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections)
  + bsc#1184517 (cls/rgw: look for plane entries in non-ascii plain namespace too)
  + bsc#1185246 (rgw: check object locks in multi-object delete)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1186020 (CVE-2021-3531)
  + bsc#1186021 (CVE-2021-3509)
  + bsc#1186348 (mgr/zabbix: adapt zabbix_sender default path)
  + bsc#1188979 ("mgr/cephadm: pass --container-init to "cephadm deploy" if specified" and "Revert "cephadm: default container_init to False")
  + bsc#1189173 (downstream branding)
  + jsc#SES-1071 (ceph-volume: major batch refactor - upstream PR#34740)
  + jsc#SES-185 (SES support with cache software)
  + jsc#SES-704 (mgr/snap_schedule)</changelog>
  <changelog author="ncutler@suse.com" date="1637582400">- Update to 16.2.6-463-g22e7612f9ad:
  + (bsc#1178073) mgr/dashboard: fix downstream NFS doc links</changelog>
  <changelog author="stefen.allen@suse.com" date="1641816000">- Update to 16.2.7-37-gb3be69440db:
  + (bsc#1194353) Downstream branding breaks dashboard npm build
  + (bsc#1188911) OSD marked down causes wrong backfill_toofull</changelog>
  <changelog author="stefen.allen@suse.com" date="1646395200">- Update to 16.2.7-577-g3e3603b5dd1
  + Update prometheus-server version</changelog>
  <changelog author="stefen.allen@suse.com" date="1646740800">- Update to 16.2.7-596-g7d574789716
  + Update Prometheus Container image paths (pr #459)
  + mgr/dashboard: Fix documentation URL (pr #456)
  + mgr/dashboard: Adapt downstream branded navigation page (pr #454)</changelog>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
</package>
<package pkgid="11e2d461b8cc5e8f7bb2558bbaabbcf39e2f837436020196d1e2a454dee7aeab" name="librbd1" arch="aarch64">
  <version epoch="0" ver="16.2.11.58+g38d6afd3b78" rel="150400.3.6.1"/>
  <changelog author="ncutler@suse.com" date="1636113600">- Update to 16.2.6-462-g5fefbbf8888:
  + rebased on top of upstream commit SHA1 dd7139c66c1d36da50475ec97d8d6b54b07d1dea
  * (bsc#1191751) rgw/tracing: unify SO version numbers within librgw2 package
  * spec: make selinux scriptlets respect CEPH_AUTO_RESTART_ON_UPGRADE</changelog>
  <changelog author="ncutler@suse.com" date="1636545600">- Preservation of Bugzilla, Jira and CVE citations from earlier incarnations of
  this changes file after double-checking that none of these fixes got lost in
  the pacific rebase:
  + bsc#1163764 (--container-init feature cherry-picked to octopus)
  + bsc#1170200 (mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically)
  + bsc#1172926 (mgr/orchestrator: Sort 'ceph orch device ls' by host)
  + bsc#1173079 (mgr/devicehealth: device_health_metrics pool gets created even without any OSDs in the cluster)
  + bsc#1174466 (mon: have 'mon stat' output json as well)
  + bsc#1174526 (mgr/dashboard: allow getting fresh inventory data from the orchestrator)
  + bsc#1174529 (rpm: on SUSE, podman is required for cephadm to work)
  + bsc#1174644 (cephadm: log to file)
  + bsc#1175120 (downstream branding)
  + bsc#1175161 (downstream branding)
  + bsc#1175169 (downstream branding)
  + bsc#1176390 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176451 (Drop patch "rpm: on SUSE, podman is required for cephadm to work")
  + bsc#1176489 (mgr/cephadm: lock multithreaded access to OSDRemovalQueue)
  + bsc#1176499 (mgr/cephadm: fix RemoveUtil.load_from_store())
  + bsc#1176638 (ceph-volume: batch: call the right prepare method)
  + bsc#1176679 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176828 (cephadm: command_unit: call systemctl with verbose=True)
  + bsc#1177078 (mgr/dashboard: Fix bugs in a unit test and i18n translation)
  + bsc#1177151 (python-common: do not skip unavailable devices)
  + bsc#1177319 (--container-init feature cherry-picked to octopus)
  + bsc#1177344 (mgr/dashboard: support Orchestrator and user-defined Ganesha cluster)
  + bsc#1177360 (cephadm: silence "Failed to evict container" log msg)
  + bsc#1177450 (ceph-volume: don't exit before empty report can be printed)
  + bsc#1177643 (Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse")
  + bsc#1177676 (cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files)
  + bsc#1177843 (CVE-2020-25660)
  + bsc#1177857 (mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails)
  + bsc#1177933 (cephadm: configure journald as the logdriver)
  + bsc#1178531 (cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph)
  + bsc#1178837 (rgw: cls/user: set from_index for reset stats calls)
  + bsc#1178860 (mgr/dashboard: Disable TLS 1.0 and 1.1)
  + bsc#1178905 (CVE-2020-25678)
  + bsc#1178932 (cephadm: reference the last local image by digest)
  + bsc#1179016 (rpm: require smartmontools on SUSE)
  + bsc#1179452 (mgr/insights: Test environment requires 'six')
  + bsc#1179526 (rgw: during GC defer, prevent new GC enqueue)
  + bsc#1179569 (cephadm: reference the last local image by digest)
  + bsc#1179802 (CVE-2020-27781)
  + bsc#1179997 (CVE-2020-27839)
  + bsc#1180107 (ceph-volume: pass --filter-for-batch from drive-group subcommand)
  + bsc#1180155 (CVE-2020-27781)
  + bsc#1181291 (mgr/cephadm: alias rgw-nfs -&gt; nfs)
  + bsc#1182766 (cephadm: fix 'inspect' and 'pull')
  + bsc#1183074 (CVE-2021-20288)
  + bsc#1183561 (mgr/cephadm: on ssh connection error, advice chmod 0600)
  + bsc#1183899 (bluestore: fix huge reads/writes at BlueFS)
  + bsc#1184231 (cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections)
  + bsc#1184517 (cls/rgw: look for plane entries in non-ascii plain namespace too)
  + bsc#1185246 (rgw: check object locks in multi-object delete)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1186020 (CVE-2021-3531)
  + bsc#1186021 (CVE-2021-3509)
  + bsc#1186348 (mgr/zabbix: adapt zabbix_sender default path)
  + bsc#1188979 ("mgr/cephadm: pass --container-init to "cephadm deploy" if specified" and "Revert "cephadm: default container_init to False")
  + bsc#1189173 (downstream branding)
  + jsc#SES-1071 (ceph-volume: major batch refactor - upstream PR#34740)
  + jsc#SES-185 (SES support with cache software)
  + jsc#SES-704 (mgr/snap_schedule)</changelog>
  <changelog author="ncutler@suse.com" date="1637582400">- Update to 16.2.6-463-g22e7612f9ad:
  + (bsc#1178073) mgr/dashboard: fix downstream NFS doc links</changelog>
  <changelog author="stefen.allen@suse.com" date="1641816000">- Update to 16.2.7-37-gb3be69440db:
  + (bsc#1194353) Downstream branding breaks dashboard npm build
  + (bsc#1188911) OSD marked down causes wrong backfill_toofull</changelog>
  <changelog author="stefen.allen@suse.com" date="1646395200">- Update to 16.2.7-577-g3e3603b5dd1
  + Update prometheus-server version</changelog>
  <changelog author="stefen.allen@suse.com" date="1646740800">- Update to 16.2.7-596-g7d574789716
  + Update Prometheus Container image paths (pr #459)
  + mgr/dashboard: Fix documentation URL (pr #456)
  + mgr/dashboard: Adapt downstream branded navigation page (pr #454)</changelog>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
</package>
<package pkgid="ddd3eb68bc820edf88bc1fe1fb5c2af21ee3ee932a352efbda7772cc3f7be218" name="librbd1" arch="x86_64">
  <version epoch="0" ver="16.2.11.58+g38d6afd3b78" rel="150400.3.6.1"/>
  <changelog author="ncutler@suse.com" date="1636113600">- Update to 16.2.6-462-g5fefbbf8888:
  + rebased on top of upstream commit SHA1 dd7139c66c1d36da50475ec97d8d6b54b07d1dea
  * (bsc#1191751) rgw/tracing: unify SO version numbers within librgw2 package
  * spec: make selinux scriptlets respect CEPH_AUTO_RESTART_ON_UPGRADE</changelog>
  <changelog author="ncutler@suse.com" date="1636545600">- Preservation of Bugzilla, Jira and CVE citations from earlier incarnations of
  this changes file after double-checking that none of these fixes got lost in
  the pacific rebase:
  + bsc#1163764 (--container-init feature cherry-picked to octopus)
  + bsc#1170200 (mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically)
  + bsc#1172926 (mgr/orchestrator: Sort 'ceph orch device ls' by host)
  + bsc#1173079 (mgr/devicehealth: device_health_metrics pool gets created even without any OSDs in the cluster)
  + bsc#1174466 (mon: have 'mon stat' output json as well)
  + bsc#1174526 (mgr/dashboard: allow getting fresh inventory data from the orchestrator)
  + bsc#1174529 (rpm: on SUSE, podman is required for cephadm to work)
  + bsc#1174644 (cephadm: log to file)
  + bsc#1175120 (downstream branding)
  + bsc#1175161 (downstream branding)
  + bsc#1175169 (downstream branding)
  + bsc#1176390 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176451 (Drop patch "rpm: on SUSE, podman is required for cephadm to work")
  + bsc#1176489 (mgr/cephadm: lock multithreaded access to OSDRemovalQueue)
  + bsc#1176499 (mgr/cephadm: fix RemoveUtil.load_from_store())
  + bsc#1176638 (ceph-volume: batch: call the right prepare method)
  + bsc#1176679 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176828 (cephadm: command_unit: call systemctl with verbose=True)
  + bsc#1177078 (mgr/dashboard: Fix bugs in a unit test and i18n translation)
  + bsc#1177151 (python-common: do not skip unavailable devices)
  + bsc#1177319 (--container-init feature cherry-picked to octopus)
  + bsc#1177344 (mgr/dashboard: support Orchestrator and user-defined Ganesha cluster)
  + bsc#1177360 (cephadm: silence "Failed to evict container" log msg)
  + bsc#1177450 (ceph-volume: don't exit before empty report can be printed)
  + bsc#1177643 (Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse")
  + bsc#1177676 (cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files)
  + bsc#1177843 (CVE-2020-25660)
  + bsc#1177857 (mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails)
  + bsc#1177933 (cephadm: configure journald as the logdriver)
  + bsc#1178531 (cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph)
  + bsc#1178837 (rgw: cls/user: set from_index for reset stats calls)
  + bsc#1178860 (mgr/dashboard: Disable TLS 1.0 and 1.1)
  + bsc#1178905 (CVE-2020-25678)
  + bsc#1178932 (cephadm: reference the last local image by digest)
  + bsc#1179016 (rpm: require smartmontools on SUSE)
  + bsc#1179452 (mgr/insights: Test environment requires 'six')
  + bsc#1179526 (rgw: during GC defer, prevent new GC enqueue)
  + bsc#1179569 (cephadm: reference the last local image by digest)
  + bsc#1179802 (CVE-2020-27781)
  + bsc#1179997 (CVE-2020-27839)
  + bsc#1180107 (ceph-volume: pass --filter-for-batch from drive-group subcommand)
  + bsc#1180155 (CVE-2020-27781)
  + bsc#1181291 (mgr/cephadm: alias rgw-nfs -&gt; nfs)
  + bsc#1182766 (cephadm: fix 'inspect' and 'pull')
  + bsc#1183074 (CVE-2021-20288)
  + bsc#1183561 (mgr/cephadm: on ssh connection error, advice chmod 0600)
  + bsc#1183899 (bluestore: fix huge reads/writes at BlueFS)
  + bsc#1184231 (cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections)
  + bsc#1184517 (cls/rgw: look for plane entries in non-ascii plain namespace too)
  + bsc#1185246 (rgw: check object locks in multi-object delete)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1186020 (CVE-2021-3531)
  + bsc#1186021 (CVE-2021-3509)
  + bsc#1186348 (mgr/zabbix: adapt zabbix_sender default path)
  + bsc#1188979 ("mgr/cephadm: pass --container-init to "cephadm deploy" if specified" and "Revert "cephadm: default container_init to False")
  + bsc#1189173 (downstream branding)
  + jsc#SES-1071 (ceph-volume: major batch refactor - upstream PR#34740)
  + jsc#SES-185 (SES support with cache software)
  + jsc#SES-704 (mgr/snap_schedule)</changelog>
  <changelog author="ncutler@suse.com" date="1637582400">- Update to 16.2.6-463-g22e7612f9ad:
  + (bsc#1178073) mgr/dashboard: fix downstream NFS doc links</changelog>
  <changelog author="stefen.allen@suse.com" date="1641816000">- Update to 16.2.7-37-gb3be69440db:
  + (bsc#1194353) Downstream branding breaks dashboard npm build
  + (bsc#1188911) OSD marked down causes wrong backfill_toofull</changelog>
  <changelog author="stefen.allen@suse.com" date="1646395200">- Update to 16.2.7-577-g3e3603b5dd1
  + Update prometheus-server version</changelog>
  <changelog author="stefen.allen@suse.com" date="1646740800">- Update to 16.2.7-596-g7d574789716
  + Update Prometheus Container image paths (pr #459)
  + mgr/dashboard: Fix documentation URL (pr #456)
  + mgr/dashboard: Adapt downstream branded navigation page (pr #454)</changelog>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit
  + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD.</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)
  + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files</changelog>
  <changelog author="tserong@suse.com" date="1658836800">- Update to 16.2.9-538-g9de83fa4064:
  + (bsc#1201604) cephfs-shell: move source to separate subdirectory</changelog>
  <changelog author="tserong@suse.com" date="1665057600">- Update to 16.2.9-539-gea74dd900cd:
  + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS</changelog>
  <changelog author="michael.fritch@suse.com" date="1674820800">- Update to 16.2.11-56-gc067055f8f5:
  + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups
  + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device
  + (bsc#1200501) cephadm: update monitoring container images
  + (bsc#1200978) mgr/dashboard: prevent alert redirect
  + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd
  + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670)
  + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info
  + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts
  + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher
  + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650)
  + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854)
  + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl</changelog>
  <changelog author="tserong@suse.com" date="1674820801">- Update to 16.2.11-57-g9be7fb44a33:
  + ceph.spec.in: Replace %usrmerged macro with regular version check
- checkin.sh: default to ses7p branch</changelog>
  <changelog author="tserong@suse.com" date="1675771200">- Update to 16.2.11-58-g38d6afd3b78:
  + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level</changelog>
</package>
<package pkgid="8535f8f96354f9a35b56f14543abd6eab87848a3230cc57bc85fa34e9721e91e" name="librsvg-2-2" arch="aarch64">
  <version epoch="0" ver="2.52.9" rel="150400.3.3.1"/>
  <changelog author="info@paolostivanin.com" date="1618315200">- Update to version 2.50.4:
  + Update dependent crates that had security vulnerabilities:
  - generic-array to 0.13.3 - RUSTSEC-2020-0146
  + Reduced stack usage
  + Add limit for too-large radiuses on the feMorphology filter
  + Properly ignore elements in an error state inside
    the "switch" element</changelog>
  <changelog author="federico@suse.com" date="1619179200">- Update to version 2.46.5 on SLE and Leap:
  + Update dependent crates that had security vulnerabilities:
    generic-array to 0.12.4 - RUSTSEC-2020-0146
    smallvec to 0.6.14      - RUSTSEC-2021-0003 - CVE-2021-25900
  + There are no changes to the library code.
  + Fix bash-isms in Makefile.am (Tin-Wei Lan).
  + Fix Visual Studio build (Chun-wei Fan).
- bsc#1183403 - CVE-2021-25900 - buffer overflow in the smallvec crate.</changelog>
  <changelog author="dimstar@opensuse.org" date="1619784000">- Update to version 2.50.5:
  + Images embedded as data: URLs didn't render if they had a MIME
    type with a charset parameter.
  + Don't allow number lists with unbounded lengths in tableValues
    attributes, for feComponentTransfer and feConvolveMatrix.
  + Negative rx/ry in rect element should be ignored.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1622116800">- Update to version 2.50.6:
  + Librsvg now requires at least Pango 1.44.
  + glgo#GNOME/librsvg#730: Incorrect text spacing when the
    transform is not 1:1. You can see this when a small font-size
    is scaled up due to a transform. It is less visible for a large
    font-size scaled down.
  + glgo#GNOME/librsvg#704: Fix circle/ellipse in paths when they
    are made out of a single Arc command.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1622894400">- Update to version 2.50.7:
  + Two cairo-related bug fixes:
  - glgo#GNOME/librsvg#745: Fix mismatched cairo_save/restore
    when running in inside the Cairo test suite.
  - glgo#GNOME/librsvg#746: Possible cairo_save() without
    cairo_restore() in render_layer().</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.52.0:
  + The biggest user-visible change is that rsvg-convert has been
    ported to Rust.
  + rsvg-convert is now aware of physical units, and fixes a bug
    where PDFs were created at the wrong size.
  + Support for Accept-Language.
  + rsvg-convert's default DPI is now 96, to better match W3C
    standards.
  + SVG2/CSS3 features:
  - Transform property from SVG2; previously librsvg only
    supported the transform attribute from SVG1.1, which has
    different syntax.
  - context-fill and context-stroke for &lt;marker&gt; and &lt;use&gt;
    elements.
  - markers now support orient="auto-start-reverse".
  - paint-order for text elements.
  - "auto" values for the width and height attributes of the
    &lt;image&gt;, &lt;rect&gt;, and &lt;svg&gt; elements.
  - All the &lt;filter-function&gt; types from the Filter Effects
    Module Level 1 specification: blur(), brightness(),
    contrast(), drop-shadow(), grayscale(), hue-rotate(),
    invert(), opacity(), sepia(), saturate().
  - The filter property now supports chains of uri() filters or
    &lt;filter-function&gt; shortcuts.
  - Support CSS selectors for attribute matching, like
    rect[attr^="prefix"]
  + New APIs: See the HTML documentation for details.
- Drop -lang package: there are no translations available anymore.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632657600">- Disable testsuite run on ix86 and arm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1633521600">- Update to version 2.52.1:
  + Fix ordering of tspan inside text elements for right-to-left
    languages.
  + Fix text-anchor positioning for right-to-left languages.
  + Fix regression in computing sizes when an SVG has only one of
    width/height and a viewBox.
  + Spec compliance - the writing-mode property applies only to
    text elements, no to individual tspan elements.
  + Fix build on big-endian platforms.
  + Clarify documentation for the rsvg_handle_write() /
    rsvg_handle_close() deprecated APIs.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634385600">- Update to version 2.52.2:
  + New features:
  - rsvg-convert now supports generating multi-page PDFs in a
    sensible way.
  - With one SVG document per page, each page with the SVG's
    natural size:
  - rsvg-convert --format=pdf -o out.pdf a.svg b.svg c.svg
  - With all pages sized as portrait US Letter, and each SVG
    scaled to fit so that there is a 1in margin around each page:
    rsvg-convert --format=pdf -o out.pdf \
  - -page-width=8.5in --page-height=11in \
  - -width=6.5in --height=8.5in --keep-aspect-ratio \
  - -top=1in --left=1in a.svg b.svg c.svg
    Please see the man page for details.
  - Support &lt;a&gt; elements inside &lt;text&gt;. Also, support the CSS
    :link pseudo-class for matching against links.
  - Support the CSS :lang() pseudo-class for matching against an
    element's xml:lang attribute.
  - Support the mask-type property from SVG2.
  + Bugs fixed:
  - Don't panic when a shorthand property is set to inherit.
  - Fix regression with the viewport size of interior &lt;svg&gt;
    elements.
  - Allow length units to be case-insensitive, per SVG2.
  + Documentation:
  - There is now a FEATURES.md in the repository, where you can
    see all the elements, attributes, and properties that librsvg
    supports. We will be adding detail to this gradually.
  - For developers, there is now devel-docs/adding-a-property.md
    with a tutorial on how to add support for new CSS properties.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635336000">- Update to version 2.52.3:
  + Bugfixes, mostly for text layout. Also, text links in PDF!
  - Support text-decoration=overline.
  - Basic support for the unicode-bidi property. Librsvg still
    considers each tspan independently of others, which is
    incorrect, but at least bidi-override works now for a single
    embedding level.
  - Fix placement of tspan that changes the text direction.
  - :lang() selector should now match lang attribute from an
    element's parent.
  - Fix the text-anchor property for right-to-left text.
  - PDF now includes links inside text elements.</changelog>
  <changelog author="william.brown@suse.com" date="1635854400">- Add cargo audit obs service</changelog>
  <changelog author="federico@suse.com" date="1636200000">- Add librsvg-s390x-cairo-has-current-point.patch for
  https://github.com/gtk-rs/gtk-rs-core/issues/335 - otherwise the
  test suite fails on s390x due to a bug in the cairo-rs bindings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636804800">- Update to version 2.52.4:
  + New features:
  - Support the isolation property from the Compositing and
    Blending Level 1 specification.
  - Support Visual Studio 2022.
  + Bug fixes:
  - The opacity and mix-blend-mode properties were not being
    applied when an element has a mask.
  - Fix panic when an empty group has a pattern fill and filters.
  - Fix the tests on Windows; the still only work when Fontconfig
    is present.
  - Work around a bug in the cairo-rs bindings in the test suite,
    that only manifests itself in s/390x due to its calling
    convention. See
    https://github.com/gtk-rs/gtk-rs-core/issues/335</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637236800">- Disable testsuite for now, let upstream figure out the issue with
  harfbuzz 3.1.1.</changelog>
  <changelog author="federico@suse.com" date="1638446400">- Remove librsvg-s390x-cairo-has-current-point.patch - it is included
  in the upstream tarball now.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1639742400">- Update to version 2.52.5:
  + Fix mangled output in rsvg-convert when redirecting output to
    a pipe on Windows.
  + When outputting to SVG, rsvg-convert now uses the width/height
    units specified in the command line; it always used pixels
    before.
  + Fix incorrect top/left margins for SVG/PS/EPS/PDF output.
  + Fix incorrect placement of glyphs when text has non-uniform
    scaling in the X/Y axes. This is not a librsvg bug, but is
    fixed by Pango 1.49.3 and later. Hopefully Pango 1.48.11 will
    be released soon with this fix as well. Note that this release
    of librsvg cannot increase the minimum Pango version to 1.48.11
    because it is not released yet.
  + Miscellaneous: Updated crate dependencies: assert_cmd, cast,
    clap cssparser, float-cmp, itertools, nalgebra, png, proptest,
    rctree, selectors, system-deps.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645099200">- Update to version 2.52.6:
  + Fix incorrect text rendering when text has different scales in
    the X/Y axes. This regressed after librsvg 2.52.5, when Pango
    had to revert its fix for the same bug. Now librsvg renders all
    text as paths, and does the scaling itself. Please file a bug
    if you have evidence that this presents a performance problem
    for you.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 2.52.7:
  + Backport a fix for the regression that was introduced in the
    last release: Output filled text as text for PDF; fixes
    regression due to outputting all text as paths.</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.52.8:
  + Catch circular references when rendering patterns.</changelog>
  <changelog author="qkzhu@suse.com" date="1654862400">- Update to version 2.52.9:
  + Fix regressions when computing element geometries.</changelog>
</package>
<package pkgid="2e8f3f9531af0b5da60bdca1bb7d082400e9e68c3427552a66326e4bda709a5e" name="librsvg-2-2" arch="x86_64">
  <version epoch="0" ver="2.52.9" rel="150400.3.3.1"/>
  <changelog author="info@paolostivanin.com" date="1618315200">- Update to version 2.50.4:
  + Update dependent crates that had security vulnerabilities:
  - generic-array to 0.13.3 - RUSTSEC-2020-0146
  + Reduced stack usage
  + Add limit for too-large radiuses on the feMorphology filter
  + Properly ignore elements in an error state inside
    the "switch" element</changelog>
  <changelog author="federico@suse.com" date="1619179200">- Update to version 2.46.5 on SLE and Leap:
  + Update dependent crates that had security vulnerabilities:
    generic-array to 0.12.4 - RUSTSEC-2020-0146
    smallvec to 0.6.14      - RUSTSEC-2021-0003 - CVE-2021-25900
  + There are no changes to the library code.
  + Fix bash-isms in Makefile.am (Tin-Wei Lan).
  + Fix Visual Studio build (Chun-wei Fan).
- bsc#1183403 - CVE-2021-25900 - buffer overflow in the smallvec crate.</changelog>
  <changelog author="dimstar@opensuse.org" date="1619784000">- Update to version 2.50.5:
  + Images embedded as data: URLs didn't render if they had a MIME
    type with a charset parameter.
  + Don't allow number lists with unbounded lengths in tableValues
    attributes, for feComponentTransfer and feConvolveMatrix.
  + Negative rx/ry in rect element should be ignored.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1622116800">- Update to version 2.50.6:
  + Librsvg now requires at least Pango 1.44.
  + glgo#GNOME/librsvg#730: Incorrect text spacing when the
    transform is not 1:1. You can see this when a small font-size
    is scaled up due to a transform. It is less visible for a large
    font-size scaled down.
  + glgo#GNOME/librsvg#704: Fix circle/ellipse in paths when they
    are made out of a single Arc command.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1622894400">- Update to version 2.50.7:
  + Two cairo-related bug fixes:
  - glgo#GNOME/librsvg#745: Fix mismatched cairo_save/restore
    when running in inside the Cairo test suite.
  - glgo#GNOME/librsvg#746: Possible cairo_save() without
    cairo_restore() in render_layer().</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.52.0:
  + The biggest user-visible change is that rsvg-convert has been
    ported to Rust.
  + rsvg-convert is now aware of physical units, and fixes a bug
    where PDFs were created at the wrong size.
  + Support for Accept-Language.
  + rsvg-convert's default DPI is now 96, to better match W3C
    standards.
  + SVG2/CSS3 features:
  - Transform property from SVG2; previously librsvg only
    supported the transform attribute from SVG1.1, which has
    different syntax.
  - context-fill and context-stroke for &lt;marker&gt; and &lt;use&gt;
    elements.
  - markers now support orient="auto-start-reverse".
  - paint-order for text elements.
  - "auto" values for the width and height attributes of the
    &lt;image&gt;, &lt;rect&gt;, and &lt;svg&gt; elements.
  - All the &lt;filter-function&gt; types from the Filter Effects
    Module Level 1 specification: blur(), brightness(),
    contrast(), drop-shadow(), grayscale(), hue-rotate(),
    invert(), opacity(), sepia(), saturate().
  - The filter property now supports chains of uri() filters or
    &lt;filter-function&gt; shortcuts.
  - Support CSS selectors for attribute matching, like
    rect[attr^="prefix"]
  + New APIs: See the HTML documentation for details.
- Drop -lang package: there are no translations available anymore.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632657600">- Disable testsuite run on ix86 and arm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1633521600">- Update to version 2.52.1:
  + Fix ordering of tspan inside text elements for right-to-left
    languages.
  + Fix text-anchor positioning for right-to-left languages.
  + Fix regression in computing sizes when an SVG has only one of
    width/height and a viewBox.
  + Spec compliance - the writing-mode property applies only to
    text elements, no to individual tspan elements.
  + Fix build on big-endian platforms.
  + Clarify documentation for the rsvg_handle_write() /
    rsvg_handle_close() deprecated APIs.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634385600">- Update to version 2.52.2:
  + New features:
  - rsvg-convert now supports generating multi-page PDFs in a
    sensible way.
  - With one SVG document per page, each page with the SVG's
    natural size:
  - rsvg-convert --format=pdf -o out.pdf a.svg b.svg c.svg
  - With all pages sized as portrait US Letter, and each SVG
    scaled to fit so that there is a 1in margin around each page:
    rsvg-convert --format=pdf -o out.pdf \
  - -page-width=8.5in --page-height=11in \
  - -width=6.5in --height=8.5in --keep-aspect-ratio \
  - -top=1in --left=1in a.svg b.svg c.svg
    Please see the man page for details.
  - Support &lt;a&gt; elements inside &lt;text&gt;. Also, support the CSS
    :link pseudo-class for matching against links.
  - Support the CSS :lang() pseudo-class for matching against an
    element's xml:lang attribute.
  - Support the mask-type property from SVG2.
  + Bugs fixed:
  - Don't panic when a shorthand property is set to inherit.
  - Fix regression with the viewport size of interior &lt;svg&gt;
    elements.
  - Allow length units to be case-insensitive, per SVG2.
  + Documentation:
  - There is now a FEATURES.md in the repository, where you can
    see all the elements, attributes, and properties that librsvg
    supports. We will be adding detail to this gradually.
  - For developers, there is now devel-docs/adding-a-property.md
    with a tutorial on how to add support for new CSS properties.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635336000">- Update to version 2.52.3:
  + Bugfixes, mostly for text layout. Also, text links in PDF!
  - Support text-decoration=overline.
  - Basic support for the unicode-bidi property. Librsvg still
    considers each tspan independently of others, which is
    incorrect, but at least bidi-override works now for a single
    embedding level.
  - Fix placement of tspan that changes the text direction.
  - :lang() selector should now match lang attribute from an
    element's parent.
  - Fix the text-anchor property for right-to-left text.
  - PDF now includes links inside text elements.</changelog>
  <changelog author="william.brown@suse.com" date="1635854400">- Add cargo audit obs service</changelog>
  <changelog author="federico@suse.com" date="1636200000">- Add librsvg-s390x-cairo-has-current-point.patch for
  https://github.com/gtk-rs/gtk-rs-core/issues/335 - otherwise the
  test suite fails on s390x due to a bug in the cairo-rs bindings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636804800">- Update to version 2.52.4:
  + New features:
  - Support the isolation property from the Compositing and
    Blending Level 1 specification.
  - Support Visual Studio 2022.
  + Bug fixes:
  - The opacity and mix-blend-mode properties were not being
    applied when an element has a mask.
  - Fix panic when an empty group has a pattern fill and filters.
  - Fix the tests on Windows; the still only work when Fontconfig
    is present.
  - Work around a bug in the cairo-rs bindings in the test suite,
    that only manifests itself in s/390x due to its calling
    convention. See
    https://github.com/gtk-rs/gtk-rs-core/issues/335</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637236800">- Disable testsuite for now, let upstream figure out the issue with
  harfbuzz 3.1.1.</changelog>
  <changelog author="federico@suse.com" date="1638446400">- Remove librsvg-s390x-cairo-has-current-point.patch - it is included
  in the upstream tarball now.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1639742400">- Update to version 2.52.5:
  + Fix mangled output in rsvg-convert when redirecting output to
    a pipe on Windows.
  + When outputting to SVG, rsvg-convert now uses the width/height
    units specified in the command line; it always used pixels
    before.
  + Fix incorrect top/left margins for SVG/PS/EPS/PDF output.
  + Fix incorrect placement of glyphs when text has non-uniform
    scaling in the X/Y axes. This is not a librsvg bug, but is
    fixed by Pango 1.49.3 and later. Hopefully Pango 1.48.11 will
    be released soon with this fix as well. Note that this release
    of librsvg cannot increase the minimum Pango version to 1.48.11
    because it is not released yet.
  + Miscellaneous: Updated crate dependencies: assert_cmd, cast,
    clap cssparser, float-cmp, itertools, nalgebra, png, proptest,
    rctree, selectors, system-deps.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645099200">- Update to version 2.52.6:
  + Fix incorrect text rendering when text has different scales in
    the X/Y axes. This regressed after librsvg 2.52.5, when Pango
    had to revert its fix for the same bug. Now librsvg renders all
    text as paths, and does the scaling itself. Please file a bug
    if you have evidence that this presents a performance problem
    for you.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 2.52.7:
  + Backport a fix for the regression that was introduced in the
    last release: Output filled text as text for PDF; fixes
    regression due to outputting all text as paths.</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.52.8:
  + Catch circular references when rendering patterns.</changelog>
  <changelog author="qkzhu@suse.com" date="1654862400">- Update to version 2.52.9:
  + Fix regressions when computing element geometries.</changelog>
</package>
<package pkgid="12b07d471bbb3cfd33709a41be456b66145dd8b3fae3920cb80be3e5bfb4fe37" name="librsvg" arch="src">
  <version epoch="0" ver="2.52.9" rel="150400.3.3.1"/>
  <changelog author="info@paolostivanin.com" date="1618315200">- Update to version 2.50.4:
  + Update dependent crates that had security vulnerabilities:
  - generic-array to 0.13.3 - RUSTSEC-2020-0146
  + Reduced stack usage
  + Add limit for too-large radiuses on the feMorphology filter
  + Properly ignore elements in an error state inside
    the "switch" element</changelog>
  <changelog author="federico@suse.com" date="1619179200">- Update to version 2.46.5 on SLE and Leap:
  + Update dependent crates that had security vulnerabilities:
    generic-array to 0.12.4 - RUSTSEC-2020-0146
    smallvec to 0.6.14      - RUSTSEC-2021-0003 - CVE-2021-25900
  + There are no changes to the library code.
  + Fix bash-isms in Makefile.am (Tin-Wei Lan).
  + Fix Visual Studio build (Chun-wei Fan).
- bsc#1183403 - CVE-2021-25900 - buffer overflow in the smallvec crate.</changelog>
  <changelog author="dimstar@opensuse.org" date="1619784000">- Update to version 2.50.5:
  + Images embedded as data: URLs didn't render if they had a MIME
    type with a charset parameter.
  + Don't allow number lists with unbounded lengths in tableValues
    attributes, for feComponentTransfer and feConvolveMatrix.
  + Negative rx/ry in rect element should be ignored.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1622116800">- Update to version 2.50.6:
  + Librsvg now requires at least Pango 1.44.
  + glgo#GNOME/librsvg#730: Incorrect text spacing when the
    transform is not 1:1. You can see this when a small font-size
    is scaled up due to a transform. It is less visible for a large
    font-size scaled down.
  + glgo#GNOME/librsvg#704: Fix circle/ellipse in paths when they
    are made out of a single Arc command.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1622894400">- Update to version 2.50.7:
  + Two cairo-related bug fixes:
  - glgo#GNOME/librsvg#745: Fix mismatched cairo_save/restore
    when running in inside the Cairo test suite.
  - glgo#GNOME/librsvg#746: Possible cairo_save() without
    cairo_restore() in render_layer().</changelog>
  <changelog author="dimstar@opensuse.org" date="1631880000">- Update to version 2.52.0:
  + The biggest user-visible change is that rsvg-convert has been
    ported to Rust.
  + rsvg-convert is now aware of physical units, and fixes a bug
    where PDFs were created at the wrong size.
  + Support for Accept-Language.
  + rsvg-convert's default DPI is now 96, to better match W3C
    standards.
  + SVG2/CSS3 features:
  - Transform property from SVG2; previously librsvg only
    supported the transform attribute from SVG1.1, which has
    different syntax.
  - context-fill and context-stroke for &lt;marker&gt; and &lt;use&gt;
    elements.
  - markers now support orient="auto-start-reverse".
  - paint-order for text elements.
  - "auto" values for the width and height attributes of the
    &lt;image&gt;, &lt;rect&gt;, and &lt;svg&gt; elements.
  - All the &lt;filter-function&gt; types from the Filter Effects
    Module Level 1 specification: blur(), brightness(),
    contrast(), drop-shadow(), grayscale(), hue-rotate(),
    invert(), opacity(), sepia(), saturate().
  - The filter property now supports chains of uri() filters or
    &lt;filter-function&gt; shortcuts.
  - Support CSS selectors for attribute matching, like
    rect[attr^="prefix"]
  + New APIs: See the HTML documentation for details.
- Drop -lang package: there are no translations available anymore.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632657600">- Disable testsuite run on ix86 and arm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1633521600">- Update to version 2.52.1:
  + Fix ordering of tspan inside text elements for right-to-left
    languages.
  + Fix text-anchor positioning for right-to-left languages.
  + Fix regression in computing sizes when an SVG has only one of
    width/height and a viewBox.
  + Spec compliance - the writing-mode property applies only to
    text elements, no to individual tspan elements.
  + Fix build on big-endian platforms.
  + Clarify documentation for the rsvg_handle_write() /
    rsvg_handle_close() deprecated APIs.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634385600">- Update to version 2.52.2:
  + New features:
  - rsvg-convert now supports generating multi-page PDFs in a
    sensible way.
  - With one SVG document per page, each page with the SVG's
    natural size:
  - rsvg-convert --format=pdf -o out.pdf a.svg b.svg c.svg
  - With all pages sized as portrait US Letter, and each SVG
    scaled to fit so that there is a 1in margin around each page:
    rsvg-convert --format=pdf -o out.pdf \
  - -page-width=8.5in --page-height=11in \
  - -width=6.5in --height=8.5in --keep-aspect-ratio \
  - -top=1in --left=1in a.svg b.svg c.svg
    Please see the man page for details.
  - Support &lt;a&gt; elements inside &lt;text&gt;. Also, support the CSS
    :link pseudo-class for matching against links.
  - Support the CSS :lang() pseudo-class for matching against an
    element's xml:lang attribute.
  - Support the mask-type property from SVG2.
  + Bugs fixed:
  - Don't panic when a shorthand property is set to inherit.
  - Fix regression with the viewport size of interior &lt;svg&gt;
    elements.
  - Allow length units to be case-insensitive, per SVG2.
  + Documentation:
  - There is now a FEATURES.md in the repository, where you can
    see all the elements, attributes, and properties that librsvg
    supports. We will be adding detail to this gradually.
  - For developers, there is now devel-docs/adding-a-property.md
    with a tutorial on how to add support for new CSS properties.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1635336000">- Update to version 2.52.3:
  + Bugfixes, mostly for text layout. Also, text links in PDF!
  - Support text-decoration=overline.
  - Basic support for the unicode-bidi property. Librsvg still
    considers each tspan independently of others, which is
    incorrect, but at least bidi-override works now for a single
    embedding level.
  - Fix placement of tspan that changes the text direction.
  - :lang() selector should now match lang attribute from an
    element's parent.
  - Fix the text-anchor property for right-to-left text.
  - PDF now includes links inside text elements.</changelog>
  <changelog author="william.brown@suse.com" date="1635854400">- Add cargo audit obs service</changelog>
  <changelog author="federico@suse.com" date="1636200000">- Add librsvg-s390x-cairo-has-current-point.patch for
  https://github.com/gtk-rs/gtk-rs-core/issues/335 - otherwise the
  test suite fails on s390x due to a bug in the cairo-rs bindings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636804800">- Update to version 2.52.4:
  + New features:
  - Support the isolation property from the Compositing and
    Blending Level 1 specification.
  - Support Visual Studio 2022.
  + Bug fixes:
  - The opacity and mix-blend-mode properties were not being
    applied when an element has a mask.
  - Fix panic when an empty group has a pattern fill and filters.
  - Fix the tests on Windows; the still only work when Fontconfig
    is present.
  - Work around a bug in the cairo-rs bindings in the test suite,
    that only manifests itself in s/390x due to its calling
    convention. See
    https://github.com/gtk-rs/gtk-rs-core/issues/335</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637236800">- Disable testsuite for now, let upstream figure out the issue with
  harfbuzz 3.1.1.</changelog>
  <changelog author="federico@suse.com" date="1638446400">- Remove librsvg-s390x-cairo-has-current-point.patch - it is included
  in the upstream tarball now.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1639742400">- Update to version 2.52.5:
  + Fix mangled output in rsvg-convert when redirecting output to
    a pipe on Windows.
  + When outputting to SVG, rsvg-convert now uses the width/height
    units specified in the command line; it always used pixels
    before.
  + Fix incorrect top/left margins for SVG/PS/EPS/PDF output.
  + Fix incorrect placement of glyphs when text has non-uniform
    scaling in the X/Y axes. This is not a librsvg bug, but is
    fixed by Pango 1.49.3 and later. Hopefully Pango 1.48.11 will
    be released soon with this fix as well. Note that this release
    of librsvg cannot increase the minimum Pango version to 1.48.11
    because it is not released yet.
  + Miscellaneous: Updated crate dependencies: assert_cmd, cast,
    clap cssparser, float-cmp, itertools, nalgebra, png, proptest,
    rctree, selectors, system-deps.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645099200">- Update to version 2.52.6:
  + Fix incorrect text rendering when text has different scales in
    the X/Y axes. This regressed after librsvg 2.52.5, when Pango
    had to revert its fix for the same bug. Now librsvg renders all
    text as paths, and does the scaling itself. Please file a bug
    if you have evidence that this presents a performance problem
    for you.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 2.52.7:
  + Backport a fix for the regression that was introduced in the
    last release: Output filled text as text for PDF; fixes
    regression due to outputting all text as paths.</changelog>
  <changelog author="yu.daike@suse.com" date="1651233600">- Update to version 2.52.8:
  + Catch circular references when rendering patterns.</changelog>
  <changelog author="qkzhu@suse.com" date="1654862400">- Update to version 2.52.9:
  + Fix regressions when computing element geometries.</changelog>
</package>
<package pkgid="0510c16d5c147fd10ed1c4c902597097872a28c02bf72d71b341262aec65149e" name="libsgutils2-1_47-2" arch="aarch64">
  <version epoch="0" ver="1.47+13.75d23ac" rel="150400.3.6.1"/>
  <changelog author="hare@suse.de" date="1502452800">- Drop patch merged with git repository
  * drop add-lunsearch-filter-to-searchexisting.patch
- Drop rules included in git repository
  * drop 40-usb-blacklist.rules
- Update to latest svn snapshot:
  * sg_rdac: add sanity checks for -f=lun value
  * sg_vpd improvements
  * sg_ses: fix uninitialized struct
  * sg_luns: resync with SAM and SPC drafts
  * sg_vpd: fix struct misalignment introduced by --force
  * sg_logs: add --vendor and fixup enumeration
- Port patches from SLES:
  * Add systemd service files for LUN masking (bsc#954600)
  * 55-scsi-sg3_id.rules: handle VPD page 0x80 correctly (bsc#1006469)
  * scripts: added udev rules for legacy CCISS (bsc#1006175)
  * rescan-scsi-bus.sh: Add lunsearch filter to findresized()
  (bsc#1027176)
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063)
  * 55-scsi-sg3_id.rules: allow to override sysfs inquiry
  (bsc#1012523)
  * sg_inq: export all NAA values (bsc#1050767)
  * Silence gcc warnings</changelog>
  <changelog author="hare@suse.de" date="1507896000">- Update to svn r721:
  * Merge SUSE-specific patches with upstream svn
  * sg_write_atomic: add new program for WRITE ATOMIC
  * sg_bg_ctl: new background control command
  * sg_ses: Improve output and option handling
  * sg_logs: Add --vendor and decode more pages
  * sg_get_lba_status: add new program
  * Install rescan-scsi-bus.sh and scsi_logging_level per default</changelog>
  <changelog author="hare@suse.de" date="1511956800">- Update to svn r730:
  * Move testing utilities to 'testing' directory
  * sg_opcode: check resid and trim response
  * sg_rep_zones: expand --help option
  * sg_mode: Add Out-of-band management control page
  * sg_ses: filer join output on dpage element presence
  * documentation cleanup
- rescan-scsi-bus.sh: Add '--ignore-rev' option
- Supplement SCSI modaliases (bsc#1065212)</changelog>
  <changelog author="hare@suse.de" date="1513598400">- sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431)
- rescan-scsi-bus.sh: new option for ignore rev change
- rescan-scsi-bus.sh: Remove white space
- Add 'coreutils' to Requires (bsc#1072744)
- Add 'posttrans' to rpm spec (bsc#1071972)</changelog>
  <changelog author="hare@suse.de" date="1513944000">- sg_inq: check VPD page 0x0 before reading serial number
  (bsc#1067839)
- sg_inq: add option '-o/--only' to skip reading VPD pages
  (bsc#1067839)
- Revert 'postun' rpm spec changes after review</changelog>
  <changelog author="hare@suse.de" date="1518004800">- Update to svn r744:
  * sg_write_x: new command for normal/atomic/orwrite etc
    SCSI WRITE variants
  * sg_ses: add NVMe support
  * sg_inq: decode NVMe controller / NSIDs
- rescan_scsi_bus.sh: Fix manpage for --forcerescan
- 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873)
- 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873)</changelog>
  <changelog author="hare@suse.de" date="1518091200">- Merge local patch with git repository
  * Delete sgut-libversioning.diff</changelog>
  <changelog author="hare@suse.de" date="1518177600">- Update to svn r751:
  * NVMe bugfixes
  * sg_seek: new utility
  * sg_stream_ctl: new utility program
- 54-before-scsi-sg3_id.rules: compability rule for systemd
  (bsc#1079873)
- Add dracut.conf to install new rule with dracut</changelog>
  <changelog author="mwilck@suse.com" date="1518436800">- dracut.conf: add whitespace at end of line (bsc#1080562)</changelog>
  <changelog author="hare@suse.de" date="1523016000">- Update to svn r763:
  * More NVMe bugfixes
  * sg_vpd: add device constituents vpd
  * sg_raw: add --raw option
  * sg_turs: add --low option
  * sg_ses: decoding dpage fixes; add --quiet option
- rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008)
- rescan-scsi-bus.sh: Fixes from shellcheck</changelog>
  <changelog author="mwilck@suse.com" date="1553601600">- Spec file:
  * add fc_wwpn_id (bsc#1005063)
  * add lun masking service (bsc#954600)
  * drop BuildRequires on udev
  * replace unversioned "Provides: scsi" with versioned
- Update to version sg3_utils-1.45~803+31.564be3d:
  * New versioning scheme for upstream pre-release:
    1.45 - upstream release target, 803 - upstream svn id,
    +31: SUSE commits on top of svn, 564be3d - git hash
  * rescan-scsi-bus.sh: terminate scanning if last lun got removed
  (bsc#1087008)
  * 58-scsi-sg3_symlink.rules: don't skip multipath members
  (bsc#1085212)
  * Add scsi-enable-target-scan.sh (bsc#954600)
- Update to svn r803:
  * sg_opcodes: expand MLU (18-102r0)
  * sg_format: add --dcrt used twice (FOV=1 DCRT=0)
  * rescan-scsi-bus: widen LUN 0 only scanning
  (bsc#1069384)
- Earlier SUSE fixes included in 1.45:
  * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384)
  [svn: r795]
  * sg_ses: fixup page decoding (bsc#1077787) [svn: r795]
  * sg_ses: allow to decode raw data instead of reading from a device
  (bsc#1050943) [svn: r795]
- Update to sg3_utils-1.44 [20180912] [svn: r791]
  * rescan-scsi-bus.sh: harden code
  - bump version to 20180615
  - add --ignore-rev to ignore revision change
  * introduce SG3_UTILS_DSENSE environment variable
  * sginfo: don't open /dev/snapshot
  * sg_timestamp: add '--no-timestamp' option
  - add --elapsed and --hex options
  * sg_wr_mode: add --rtd option for RTD bi
  * sg_unmap: add --all=ST,RN[,LA] option
  * sgm_dd, sg_dd: add --dry-run and --verbose options
  * sg_inq+sg_vpd: update Extended inquiry data vpd page
  * sg_ses: add 'hw_reset' and 'sw_reset' to enclosure services
    controller electronics element type (18-047r1)
  * sg_decode sense: add --cdb and --err=ES options
  * sg_format: add --dry-run option
  - extend --wait timeout for &gt; 4TB disks
  * sg_sanitize: add --dry-run option
- Earlier SUSE fixes included in 1.44:
  * sg_inq: decode standard INQUIRY for CD-ROMs correctly
  (bsc#1065448, bsc#1070431) [svn: r742]
  * sg_inq: export all NAA values (bsc#1050767) [svn: r715]
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063) (svn@715)
  * sg_vpd: struct opts_t misaligment (bsc#1050943) [svn: r707]</changelog>
  <changelog author="jengelh@inai.de" date="1555588800">- Replace old $RPM_* shell vars.</changelog>
  <changelog author="mwilck@suse.com" date="1556193600">- Update to version 1.45~815+5.6aa67ed:
  * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418)
- Update to svn r815:
  * sg_opcodes: expand MLU (spc5r20)
  * sg_inq: update version descriptors to spc5r21
  * sg_vpd: 3pc VPD page add copy group descriptor
  * sg_xcopy: add --fco (fast copy only) (spc5r20) and --app=1
  * add nanosecond durations with SG3_UTILS_LINUX_NANO
- Earlier SUSE fixes now included upstream:
  * 58-scsi-sg3_symlink.rules: don't skip multipath members
  (bsc#1085212) [r815]
  * rescan-scsi-bus.sh: terminate scanning if last lun got removed
  (bsc#1087008) [r815]
  * Add scsi-enable-target-scan.sh (bsc#954600) [r814]
  * shellcheck cleanups for rescan-scsi-bus.sh [r814]</changelog>
  <changelog author="info@paolostivanin.com" date="1618920000">- Update to version 1.46:
  * sg_rep_pip: new utility: report provisioning initialization
    pattern command
  * sg_turs: estimated time-to-ready [spc6r03]
  - add --delay=MS option
  * sg_requests: substantial cleanup
  * sg_vpd: add Format presets and Concurrent positioning ranges
  - add hot-pluggable field in standard Inquiry [spc6r05]
  - fix vendor struct opts_t alignment
  * sg_inq: add hot-pluggable field in standard Inquiry
  * sg_dd: --verify : separate category for miscompare errors
  - --verify : oflag=coe continue on miscompares, counts them
  - add cdl= operand for command duration limit indexes
  - add oflag=nocreat and conv=nocreat : OFILE must exist
  - add iflag=00, ff, random flags
  - setup conditional auto rule for getrandom()
  - add command timeout after comma in time= operand
  * sg_get_elem_status: add ralwd bit sbc4r20a
  * sg_write_x: add dld bits to write(32) [sbc4r19a]
  * sg_rep_zones: print invalid write pointer LBA as -1 rather
    than 16 "f"s
  * sg_opcodes: improve handling of RWCDLP field
  * sg_ses: use fan speed factor field for calculation [ses4r04]
  - add --all (-a) option, same action as --join
  * sg_compare_and_write: add examples section to its manpage
  * sg_modes: document '-s' option (same as '-6')
  * sg_sanitize + sg_format: when --verbose given once report
    probable success; without --verbose 'no news is good news'
  * sg_zone: add Remove element and modify zones command
  * sg_raw: increase maximum data-in and data-out buffer size
    from 64 KB to 1 MB
  - fix --cmdfile= handling
  - add --nvm option to send commands from the NVM command set
  - add --cmdset option to bypass cdb heuristic
  - add --scan= first_opcode,last_opcode
  * sg_pt_freebsd: allow device names without leading /dev/
    thus fix for regression introduced in rev 731 (ver: 1.43)
  * sg_pt_solaris+sg_pt_osf1: fix problem with clear_scsi_pt_obj()
    which needs to remember is_nvme and dev_fd values
  * sg_lib: add ZBC (2020) feature set entries
  * sg_lib: restore elements and rebuild command added
  * sg_lib,sg_pt: add partial_clear_scsi_pt_obj(),
    get_scsi_pt_cdb_len() and get_scsi_pt_cdb_buf()
  - add do_nvm_pt() for the NVM (sub-)command set
  - tweak transport error handling in Linux
  * sg_lib: Linux NVMe SNTL: add read, write and verify;
    synchronize cache and write same translations
  - add dummy start stop unit and test unit ready commands
  - wire cache mpage's WCE to nvme 'volatile write cache'
  - fix crash in sg_f2hex_arr() when fname not found
  * sg_lib: reprint cdb with illegal request sense key
  - asc/ascq match asc-num.txt @t10 20200708 [spc6r02]
  * gcc-10: suppress warnings
  * autoconf: upgrade version 2.69 to 2.70
  * remove space from end of source lines for git-svn
  * testing/sg_mrq_testing: new, for blocking mrq usage
  * testing/sgs_dd: add evfd flags and eventfd processing
  * testing: remove master-slave terminology for sgv4
  * examples: add nvme_read_ctl.hex and nvme_write_ctl.hex
- Earlier SUSE fixes included in 1.46:
  * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY
    (bsc#840054, bsc#1131482)</changelog>
  <changelog author="mwilck@suse.com" date="1636632000">- Update to version 1.47:
  * sg_rep_zones: add support for REPORT ZONE DOMAINS and
    REPORT REALMS in this utility
  * sg_raw: fix prints of NVMe NVM command names
  * sg_logs: additions to Volume statistics lpage [ssc5r05c]
  - additions to Command duration limits statistics log
    page [spc6r06]
  * sg_vpd: fix do_hex type on some recent pages
  - zoned block dev char vpd: add zone alignment mode and
    zone starting LBA granularity [zbc2r11]
  * sg_read_buffer: fix --length= problem
  * sg_dd, sgm_dd, sgp_dd: don't close negative file descriptors
  * sg_dd: srand48_r() and mrand48_r() are GNU libc specific,
    put conditional in so non-reentrant version used otherwise
  - 'iflag=00,ff' places the 32 bit block address (big endian)
    into each block
  * sgp_dd: major rework, fix issue with error being ignored
  - new: --chkaddr which checks for block address in each block
  - add check for stdatomic.h presence in configure.ac
  * sg_xcopy: tweak CSCD identification descriptor
  * sg_get_elem_status: fix issue with '--maxlen=' option
  - add 2 depopulation revocation health attributes [sbc5r01]
  * transport error handling improved. To fix report of a
    BAD_TARGET transport error but the utility still continued.
  - introduce SG_LIB_TRANSPORT_ERROR [35] exit status
  * several utilities: override '--maxlen=LEN' when LEN
    is &lt; 16 (or 4), take default (or 4) instead
  * scripts: 55-scsi-sg3_id.rules remove outdated rule (bsc#1189297)
  * sg_lib: add sg_scsi_status_is_good(),
    sg_scsi_status_is_bad() and sg_get_zone_type_str()
  * pt_linux: fix verify(BytChk=0) which Linux SNTL translated
    to write, other SNTL cleanups
  * pt_linux_nvme: fix fua setting
  * pt: check_pt_file_handle() add return value of 5 for
- _service updates:
  * re-enable service, hadn't been used for 1.46 release
  * use upstream author's git repository, simplify versioning scheme
  * use obscpio format</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 1.47+2.388b767:
  * rescan-scsi-bus.sh: apply fix for '-r' (boo#1194293)
  * _service: use openSUSE github repo again (with cherry-picks
    from upstream)
  * spec file: suppress commit ID in library version</changelog>
  <changelog author="mwilck@suse.com" date="1644321600">- Update to version 1.47+3.adb7276:
  * rescan-scsi-bus.sh: fix garbled output (bsc#1195621)</changelog>
  <changelog author="mwilck@suse.com" date="1645444800">- Update to version 1.47+4.82fb156:
  * rescan_scsi_bus.sh: restore numeric ordering of hosts (bsc#1196244)</changelog>
  <changelog author="mwilck@suse.com" date="1654084800">- Update to version 1.47+5.d13bc56:
  * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248)</changelog>
  <changelog author="mwilck@suse.com" date="1674820800">- Update to version 1.47+13.75d23ac:
  * rescan-scsi-bus: speed large multipath scans (bsc#1207706)
  * rescan-scsi-bus.sh speed testonline()
  * rescan-scsi-bus.sh: add option --no-lip-scan
  * rescan-scsi-bus: sgdevice26: do not traverse sg class if scsi_device isnot added
  * rescan-scsi-bus.sh: fix handling of '-I &lt;secs&gt;' option</changelog>
</package>
<package pkgid="343e0aa49daae62516a57f6dd6b0e1ca0719fb51b3042bc2396567b26238390b" name="libsgutils2-1_47-2" arch="x86_64">
  <version epoch="0" ver="1.47+13.75d23ac" rel="150400.3.6.1"/>
  <changelog author="hare@suse.de" date="1502452800">- Drop patch merged with git repository
  * drop add-lunsearch-filter-to-searchexisting.patch
- Drop rules included in git repository
  * drop 40-usb-blacklist.rules
- Update to latest svn snapshot:
  * sg_rdac: add sanity checks for -f=lun value
  * sg_vpd improvements
  * sg_ses: fix uninitialized struct
  * sg_luns: resync with SAM and SPC drafts
  * sg_vpd: fix struct misalignment introduced by --force
  * sg_logs: add --vendor and fixup enumeration
- Port patches from SLES:
  * Add systemd service files for LUN masking (bsc#954600)
  * 55-scsi-sg3_id.rules: handle VPD page 0x80 correctly (bsc#1006469)
  * scripts: added udev rules for legacy CCISS (bsc#1006175)
  * rescan-scsi-bus.sh: Add lunsearch filter to findresized()
  (bsc#1027176)
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063)
  * 55-scsi-sg3_id.rules: allow to override sysfs inquiry
  (bsc#1012523)
  * sg_inq: export all NAA values (bsc#1050767)
  * Silence gcc warnings</changelog>
  <changelog author="hare@suse.de" date="1507896000">- Update to svn r721:
  * Merge SUSE-specific patches with upstream svn
  * sg_write_atomic: add new program for WRITE ATOMIC
  * sg_bg_ctl: new background control command
  * sg_ses: Improve output and option handling
  * sg_logs: Add --vendor and decode more pages
  * sg_get_lba_status: add new program
  * Install rescan-scsi-bus.sh and scsi_logging_level per default</changelog>
  <changelog author="hare@suse.de" date="1511956800">- Update to svn r730:
  * Move testing utilities to 'testing' directory
  * sg_opcode: check resid and trim response
  * sg_rep_zones: expand --help option
  * sg_mode: Add Out-of-band management control page
  * sg_ses: filer join output on dpage element presence
  * documentation cleanup
- rescan-scsi-bus.sh: Add '--ignore-rev' option
- Supplement SCSI modaliases (bsc#1065212)</changelog>
  <changelog author="hare@suse.de" date="1513598400">- sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431)
- rescan-scsi-bus.sh: new option for ignore rev change
- rescan-scsi-bus.sh: Remove white space
- Add 'coreutils' to Requires (bsc#1072744)
- Add 'posttrans' to rpm spec (bsc#1071972)</changelog>
  <changelog author="hare@suse.de" date="1513944000">- sg_inq: check VPD page 0x0 before reading serial number
  (bsc#1067839)
- sg_inq: add option '-o/--only' to skip reading VPD pages
  (bsc#1067839)
- Revert 'postun' rpm spec changes after review</changelog>
  <changelog author="hare@suse.de" date="1518004800">- Update to svn r744:
  * sg_write_x: new command for normal/atomic/orwrite etc
    SCSI WRITE variants
  * sg_ses: add NVMe support
  * sg_inq: decode NVMe controller / NSIDs
- rescan_scsi_bus.sh: Fix manpage for --forcerescan
- 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873)
- 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873)</changelog>
  <changelog author="hare@suse.de" date="1518091200">- Merge local patch with git repository
  * Delete sgut-libversioning.diff</changelog>
  <changelog author="hare@suse.de" date="1518177600">- Update to svn r751:
  * NVMe bugfixes
  * sg_seek: new utility
  * sg_stream_ctl: new utility program
- 54-before-scsi-sg3_id.rules: compability rule for systemd
  (bsc#1079873)
- Add dracut.conf to install new rule with dracut</changelog>
  <changelog author="mwilck@suse.com" date="1518436800">- dracut.conf: add whitespace at end of line (bsc#1080562)</changelog>
  <changelog author="hare@suse.de" date="1523016000">- Update to svn r763:
  * More NVMe bugfixes
  * sg_vpd: add device constituents vpd
  * sg_raw: add --raw option
  * sg_turs: add --low option
  * sg_ses: decoding dpage fixes; add --quiet option
- rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008)
- rescan-scsi-bus.sh: Fixes from shellcheck</changelog>
  <changelog author="mwilck@suse.com" date="1553601600">- Spec file:
  * add fc_wwpn_id (bsc#1005063)
  * add lun masking service (bsc#954600)
  * drop BuildRequires on udev
  * replace unversioned "Provides: scsi" with versioned
- Update to version sg3_utils-1.45~803+31.564be3d:
  * New versioning scheme for upstream pre-release:
    1.45 - upstream release target, 803 - upstream svn id,
    +31: SUSE commits on top of svn, 564be3d - git hash
  * rescan-scsi-bus.sh: terminate scanning if last lun got removed
  (bsc#1087008)
  * 58-scsi-sg3_symlink.rules: don't skip multipath members
  (bsc#1085212)
  * Add scsi-enable-target-scan.sh (bsc#954600)
- Update to svn r803:
  * sg_opcodes: expand MLU (18-102r0)
  * sg_format: add --dcrt used twice (FOV=1 DCRT=0)
  * rescan-scsi-bus: widen LUN 0 only scanning
  (bsc#1069384)
- Earlier SUSE fixes included in 1.45:
  * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384)
  [svn: r795]
  * sg_ses: fixup page decoding (bsc#1077787) [svn: r795]
  * sg_ses: allow to decode raw data instead of reading from a device
  (bsc#1050943) [svn: r795]
- Update to sg3_utils-1.44 [20180912] [svn: r791]
  * rescan-scsi-bus.sh: harden code
  - bump version to 20180615
  - add --ignore-rev to ignore revision change
  * introduce SG3_UTILS_DSENSE environment variable
  * sginfo: don't open /dev/snapshot
  * sg_timestamp: add '--no-timestamp' option
  - add --elapsed and --hex options
  * sg_wr_mode: add --rtd option for RTD bi
  * sg_unmap: add --all=ST,RN[,LA] option
  * sgm_dd, sg_dd: add --dry-run and --verbose options
  * sg_inq+sg_vpd: update Extended inquiry data vpd page
  * sg_ses: add 'hw_reset' and 'sw_reset' to enclosure services
    controller electronics element type (18-047r1)
  * sg_decode sense: add --cdb and --err=ES options
  * sg_format: add --dry-run option
  - extend --wait timeout for &gt; 4TB disks
  * sg_sanitize: add --dry-run option
- Earlier SUSE fixes included in 1.44:
  * sg_inq: decode standard INQUIRY for CD-ROMs correctly
  (bsc#1065448, bsc#1070431) [svn: r742]
  * sg_inq: export all NAA values (bsc#1050767) [svn: r715]
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063) (svn@715)
  * sg_vpd: struct opts_t misaligment (bsc#1050943) [svn: r707]</changelog>
  <changelog author="jengelh@inai.de" date="1555588800">- Replace old $RPM_* shell vars.</changelog>
  <changelog author="mwilck@suse.com" date="1556193600">- Update to version 1.45~815+5.6aa67ed:
  * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418)
- Update to svn r815:
  * sg_opcodes: expand MLU (spc5r20)
  * sg_inq: update version descriptors to spc5r21
  * sg_vpd: 3pc VPD page add copy group descriptor
  * sg_xcopy: add --fco (fast copy only) (spc5r20) and --app=1
  * add nanosecond durations with SG3_UTILS_LINUX_NANO
- Earlier SUSE fixes now included upstream:
  * 58-scsi-sg3_symlink.rules: don't skip multipath members
  (bsc#1085212) [r815]
  * rescan-scsi-bus.sh: terminate scanning if last lun got removed
  (bsc#1087008) [r815]
  * Add scsi-enable-target-scan.sh (bsc#954600) [r814]
  * shellcheck cleanups for rescan-scsi-bus.sh [r814]</changelog>
  <changelog author="info@paolostivanin.com" date="1618920000">- Update to version 1.46:
  * sg_rep_pip: new utility: report provisioning initialization
    pattern command
  * sg_turs: estimated time-to-ready [spc6r03]
  - add --delay=MS option
  * sg_requests: substantial cleanup
  * sg_vpd: add Format presets and Concurrent positioning ranges
  - add hot-pluggable field in standard Inquiry [spc6r05]
  - fix vendor struct opts_t alignment
  * sg_inq: add hot-pluggable field in standard Inquiry
  * sg_dd: --verify : separate category for miscompare errors
  - --verify : oflag=coe continue on miscompares, counts them
  - add cdl= operand for command duration limit indexes
  - add oflag=nocreat and conv=nocreat : OFILE must exist
  - add iflag=00, ff, random flags
  - setup conditional auto rule for getrandom()
  - add command timeout after comma in time= operand
  * sg_get_elem_status: add ralwd bit sbc4r20a
  * sg_write_x: add dld bits to write(32) [sbc4r19a]
  * sg_rep_zones: print invalid write pointer LBA as -1 rather
    than 16 "f"s
  * sg_opcodes: improve handling of RWCDLP field
  * sg_ses: use fan speed factor field for calculation [ses4r04]
  - add --all (-a) option, same action as --join
  * sg_compare_and_write: add examples section to its manpage
  * sg_modes: document '-s' option (same as '-6')
  * sg_sanitize + sg_format: when --verbose given once report
    probable success; without --verbose 'no news is good news'
  * sg_zone: add Remove element and modify zones command
  * sg_raw: increase maximum data-in and data-out buffer size
    from 64 KB to 1 MB
  - fix --cmdfile= handling
  - add --nvm option to send commands from the NVM command set
  - add --cmdset option to bypass cdb heuristic
  - add --scan= first_opcode,last_opcode
  * sg_pt_freebsd: allow device names without leading /dev/
    thus fix for regression introduced in rev 731 (ver: 1.43)
  * sg_pt_solaris+sg_pt_osf1: fix problem with clear_scsi_pt_obj()
    which needs to remember is_nvme and dev_fd values
  * sg_lib: add ZBC (2020) feature set entries
  * sg_lib: restore elements and rebuild command added
  * sg_lib,sg_pt: add partial_clear_scsi_pt_obj(),
    get_scsi_pt_cdb_len() and get_scsi_pt_cdb_buf()
  - add do_nvm_pt() for the NVM (sub-)command set
  - tweak transport error handling in Linux
  * sg_lib: Linux NVMe SNTL: add read, write and verify;
    synchronize cache and write same translations
  - add dummy start stop unit and test unit ready commands
  - wire cache mpage's WCE to nvme 'volatile write cache'
  - fix crash in sg_f2hex_arr() when fname not found
  * sg_lib: reprint cdb with illegal request sense key
  - asc/ascq match asc-num.txt @t10 20200708 [spc6r02]
  * gcc-10: suppress warnings
  * autoconf: upgrade version 2.69 to 2.70
  * remove space from end of source lines for git-svn
  * testing/sg_mrq_testing: new, for blocking mrq usage
  * testing/sgs_dd: add evfd flags and eventfd processing
  * testing: remove master-slave terminology for sgv4
  * examples: add nvme_read_ctl.hex and nvme_write_ctl.hex
- Earlier SUSE fixes included in 1.46:
  * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY
    (bsc#840054, bsc#1131482)</changelog>
  <changelog author="mwilck@suse.com" date="1636632000">- Update to version 1.47:
  * sg_rep_zones: add support for REPORT ZONE DOMAINS and
    REPORT REALMS in this utility
  * sg_raw: fix prints of NVMe NVM command names
  * sg_logs: additions to Volume statistics lpage [ssc5r05c]
  - additions to Command duration limits statistics log
    page [spc6r06]
  * sg_vpd: fix do_hex type on some recent pages
  - zoned block dev char vpd: add zone alignment mode and
    zone starting LBA granularity [zbc2r11]
  * sg_read_buffer: fix --length= problem
  * sg_dd, sgm_dd, sgp_dd: don't close negative file descriptors
  * sg_dd: srand48_r() and mrand48_r() are GNU libc specific,
    put conditional in so non-reentrant version used otherwise
  - 'iflag=00,ff' places the 32 bit block address (big endian)
    into each block
  * sgp_dd: major rework, fix issue with error being ignored
  - new: --chkaddr which checks for block address in each block
  - add check for stdatomic.h presence in configure.ac
  * sg_xcopy: tweak CSCD identification descriptor
  * sg_get_elem_status: fix issue with '--maxlen=' option
  - add 2 depopulation revocation health attributes [sbc5r01]
  * transport error handling improved. To fix report of a
    BAD_TARGET transport error but the utility still continued.
  - introduce SG_LIB_TRANSPORT_ERROR [35] exit status
  * several utilities: override '--maxlen=LEN' when LEN
    is &lt; 16 (or 4), take default (or 4) instead
  * scripts: 55-scsi-sg3_id.rules remove outdated rule (bsc#1189297)
  * sg_lib: add sg_scsi_status_is_good(),
    sg_scsi_status_is_bad() and sg_get_zone_type_str()
  * pt_linux: fix verify(BytChk=0) which Linux SNTL translated
    to write, other SNTL cleanups
  * pt_linux_nvme: fix fua setting
  * pt: check_pt_file_handle() add return value of 5 for
- _service updates:
  * re-enable service, hadn't been used for 1.46 release
  * use upstream author's git repository, simplify versioning scheme
  * use obscpio format</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 1.47+2.388b767:
  * rescan-scsi-bus.sh: apply fix for '-r' (boo#1194293)
  * _service: use openSUSE github repo again (with cherry-picks
    from upstream)
  * spec file: suppress commit ID in library version</changelog>
  <changelog author="mwilck@suse.com" date="1644321600">- Update to version 1.47+3.adb7276:
  * rescan-scsi-bus.sh: fix garbled output (bsc#1195621)</changelog>
  <changelog author="mwilck@suse.com" date="1645444800">- Update to version 1.47+4.82fb156:
  * rescan_scsi_bus.sh: restore numeric ordering of hosts (bsc#1196244)</changelog>
  <changelog author="mwilck@suse.com" date="1654084800">- Update to version 1.47+5.d13bc56:
  * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248)</changelog>
  <changelog author="mwilck@suse.com" date="1674820800">- Update to version 1.47+13.75d23ac:
  * rescan-scsi-bus: speed large multipath scans (bsc#1207706)
  * rescan-scsi-bus.sh speed testonline()
  * rescan-scsi-bus.sh: add option --no-lip-scan
  * rescan-scsi-bus: sgdevice26: do not traverse sg class if scsi_device isnot added
  * rescan-scsi-bus.sh: fix handling of '-I &lt;secs&gt;' option</changelog>
</package>
<package pkgid="f6247d1568104a7bfc3d8e86f7a5c8c9cc7944ac32c2fd4b6c81170d6b3ec8bc" name="libsmartcols1" arch="aarch64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="232362b783141992d91ba7a14e222627c876008db4dcdbb23c5d34f355f56e0b" name="libsmartcols1" arch="x86_64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="4d24db477e0140a5a8bc13ff857ec7e714062a408cd6276266ae3929800b715b" name="libsnmp40" arch="aarch64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="0afe4b8fb009f6d22470cf3964ed42aa978609f70846a3c015fe9982201fb493" name="libsnmp40" arch="x86_64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="7ef61146ad2103364e674d93851afd9bd0c1ef1b170493319f0085191faf5d47" name="libsnmp40" arch="aarch64">
  <version epoch="0" ver="5.9.3" rel="150300.15.8.1"/>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
  <changelog author="abergmann@suse.com" date="1672920000">- Fixed NULL pointer exception issue when handling ipDefaultTTL or
  pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792).
  add:
  * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch
- Enable AES-192 and AES-256 privacy protocol (bsc#1206828).</changelog>
  <changelog author="abergmann@suse.com" date="1673265600">- Hardening systemd services setting "ProtectHome=true" caused home directory
  size and allocation to be listed incorrectly (bsc#1206044).
  add:
  * net-snmp-5.9.3-harden_snmpd.service.patch
  * net-snmp-5.9.3-harden_snmptrapd.service.patch
  delete:
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch</changelog>
</package>
<package pkgid="ae84199f61cfa3fd52360bdd77c4170ec4b762b8d38f381e6a3a116f697b39cb" name="libsnmp40" arch="x86_64">
  <version epoch="0" ver="5.9.3" rel="150300.15.8.1"/>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
  <changelog author="abergmann@suse.com" date="1672920000">- Fixed NULL pointer exception issue when handling ipDefaultTTL or
  pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792).
  add:
  * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch
- Enable AES-192 and AES-256 privacy protocol (bsc#1206828).</changelog>
  <changelog author="abergmann@suse.com" date="1673265600">- Hardening systemd services setting "ProtectHome=true" caused home directory
  size and allocation to be listed incorrectly (bsc#1206044).
  add:
  * net-snmp-5.9.3-harden_snmpd.service.patch
  * net-snmp-5.9.3-harden_snmptrapd.service.patch
  delete:
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch</changelog>
</package>
<package pkgid="706ce647f50b35abc53046f59888c857d76fdd967d25e5376d3929d0bda38ef3" name="libsoftokn3" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="20e4a2c1578df58032c789a5dcd66800ecc3905c8fceb93bdffd9ed8340faf06" name="libsoftokn3" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="2e5a261498fbcf82a19a98f2bbf10930fc48105af7fbae747d7a60eb7f25bdfe" name="libsoftokn3" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="7425c51da3a4cf1280cffddb8def1a4963cf885d81bbdfa627e8cf5630b0915c" name="libsoftokn3" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="2fbcb6b6646249c16dd8e2bfcff8a596133c87d5c6a1925c202aa304c2071532" name="libsoftokn3" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="2188a3218e9015d81675497c012b86c2a57a5378e38ffbc56199d9d742c8afa6" name="libsoftokn3" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="6d2cc0ceaa11d9c3921df4813ee0498e0302a99436b19e27945c91478bdf4a4f" name="libsoftokn3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="1ab345e74b6e9f147cee112ab1c4cdb5ac7293c97d08cee6dd9e934b669c9081" name="libsoftokn3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="8cbebcbcb04aaef11d426b7864b37c638e2a3789aa85457091b78d4163e69603" name="libsoftokn3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="a8d97b94c6a41b872fb34a10b0ed1d2c477c3fecc1660d8fdb53096bccb444e5" name="libsoftokn3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="ac5d8fc057fe35e06bd83edb1e3125df1ff394711f4c18e8ff443a0a9fe9bf97" name="libsoftokn3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="9aa79e5706b3fea74ef07b7ac64373138d972f719fda4b7474ee31d7c992325f" name="libsoftokn3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="0cd9340e0052b8e69bee2ee63626ced66df5e30651697c77c2bdf53ec9657eb2" name="libsolv" arch="src">
  <version epoch="0" ver="0.7.23" rel="150400.3.3.1"/>
  <changelog author="mls@suse.de" date="1575979200">- added two new function to make libzypp independent of the rpm
  database format
- bump version to 0.7.10</changelog>
  <changelog author="mls@suse.de" date="1575979201">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
</package>
<package pkgid="cc5dd5d29bf807780abac37eee2e7a8c927c357b533bf385b8be15dbbb1e099e" name="libsolv-tools" arch="aarch64">
  <version epoch="0" ver="0.7.23" rel="150400.3.3.1"/>
  <changelog author="mls@suse.de" date="1575979200">- added two new function to make libzypp independent of the rpm
  database format
- bump version to 0.7.10</changelog>
  <changelog author="mls@suse.de" date="1575979201">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
</package>
<package pkgid="de2a58f833251cf859a6095ea92296d8778a337ef5ee4dc509ec285de1d966a6" name="libsolv-tools" arch="x86_64">
  <version epoch="0" ver="0.7.23" rel="150400.3.3.1"/>
  <changelog author="mls@suse.de" date="1575979200">- added two new function to make libzypp independent of the rpm
  database format
- bump version to 0.7.10</changelog>
  <changelog author="mls@suse.de" date="1575979201">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
  <changelog author="mls@suse.de" date="1670932800">- fix "keep installed" jobs not disabling "best update" rules
- do not autouninstall suse ptf packages
- ensure duplinvolvedmap_all is reset when a solver is reused
- special case file dependencies in the testcase writer
- support stringification of multiple solvables
- new weakdep introspection interface similar to ruleinfos
- support decision reason queries
- support merging of related decissions
- support stringification of ruleinfo, decisioninfo and decision reasons
- support better info about alternatives
- new '-P' and '-W' options for testsolv
- bump version to 0.7.23</changelog>
</package>
<package pkgid="49127c76cee5a1ab716cef66765fea53e3bdf408db27da954c5ef4d073b2cc69" name="libsqlite3-0" arch="aarch64">
  <version epoch="0" ver="3.39.3" rel="150000.3.20.1"/>
  <changelog author="astieger@suse.com" date="1522670400">- update to 3.23.0:
  * Add the sqlite3_serialize() and sqlite3_deserialize()
    interfaces when the SQLITE_ENABLE_DESERIALIZE compile-time
    option is used.
  * Recognize TRUE and FALSE as constants. (For compatibility, if
    there exist columns named "true" or "false", then the
    identifiers refer to the columns rather than Boolean constants.)
  * Support operators IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE.
  * Added the SQLITE_DBSTATUS_CACHE_SPILL option to
    sqlite3_db_status() for reporting the number of cache spills
    that have occurred.
  * The "alternate-form-2" flag ("!") on the built-in printf
    implementation now causes string substitutions to measure the
    width and precision in characters instead of bytes.
  * If the xColumn method in a virtual table implementation returns
    an error message using sqlite3_result_error() then give that
    error message preference over internally-generated messages.
  * Added the -A command-line option to the CLI to make it easier to
    manage SQLite Archive files.
  * Add support for INSERT OR REPLACE, INSERT OR IGNORE, and UPDATE
    OR REPLACE in the Zipfile virtual table.
  * Enhance the sqlite3changeset_apply() interface so that it is
    hardened against attacks from deliberately corrupted changeset
    objects.
  * Added the sqlite3_normalize() extension function.
  * Query optimizer enhancements
  * Various bug fixes
  * Fix various issues reported by fuzzers, including:
    + CVE-2018-8740: NULL pointer dereference on CREATE TABLE as
    (bsc#1085790)</changelog>
  <changelog author="astieger@suse.com" date="1523448000">- update to 3.23.1:
  * Fix two problems in the new LEFT JOIN strength reduction
    optimization
  * Fix misbehavior of the FTS5 xBestIndex method
  * Fix a harmless reference to an uninitialized virtual machine
    register
  * Fix the eval.c extension so that it works with PRAGMA
    empty_result_callbacks=ON
  * Fix the generate_series virtual table so that it correctly
    returns no rows if any of its constraints are NULL
  * Performance enhancements in the parser</changelog>
  <changelog author="max@suse.com" date="1552996800">- CVE-2018-20346, bsc#1119687: Upgrade to the most recent version
  to fix a remote code execution vulnerability in FTS3 (Magellan).
- Drop sqlite-fts5-link.patch and do it in the spec file instead.
- Version 3.27.2:
  * Add the VACUUM INTO command
  * Issue an SQLITE_WARNING message on the error log if a
    double-quoted string literal is used
  * Add the remove_diacritics=2 option to FTS3 and FTS5.
  * Add  the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3().
    Use that option to prevent circular references to shadow tables
    from causing resource leaks.
  * Enhancements to the sqlite3_deserialize() interface
  * Enhancements to the CLI, mostly to support testing and debugging
    of the SQLite library itself
  * Increased robustness against malicious SQL that is run against
    a maliciously corrupted database
- Version 3.26.0:
  * Optimization: When doing an UPDATE on a table with indexes on
    expressions, do not update the expression indexes if they do
    not refer to any of the columns of the table being updated.
  * Allow the xBestIndex() method of virtual table implementations
    to return SQLITE_CONSTRAINT to indicate that the proposed query
    plan is unusable and should not be given further consideration.
  * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the
    ability to create corrupt database files using ordinary SQL.
  * Added support for read-only shadow tables when the
    SQLITE_DBCONFIG_DEFENSIVE option is enabled.
  * Added the PRAGMA legacy_alter_table command, which if enabled
    causes the ALTER TABLE command to behave like older version of
    SQLite (prior to version 3.25.0) for compatibility.
  * Added PRAGMA table_xinfo that works just like PRAGMA table_info
    except that it also shows hidden columns in virtual tables.
  * Added the explain virtual table as a run-time loadable
    extension.
  * Add a limit counter to the query planner to prevent excessive
    sqlite3_prepare() times for certain pathological SQL inputs.
  * Added support for the sqlite3_normalized_sql() interface, when
    compiling with SQLITE_ENABLE_NORMALIZE.
  * Enhanced triggers so that they can use table-valued functions
    that exist in schemas other than the schema where the trigger
    is defined.
  * Improvements to the ".help" command in the CLI.
  * The SQLITE_HISTORY environment variable, if it exists,
    specifies the name of the command-line editing history file.
  * The --deserialize option associated with opening a new database
    in the CLI cause the database file to be read into memory and
    accessed using the sqlite3_deserialize() API. This simplifies
    running tests on a database without modifying the file on disk.
- Version 3.25.2:
  * Add the PRAGMA legacy_alter_table=ON command that causes the
    "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier
  * Fix issue with some expressions with windows functions in views
- Version 3.25.1:
  * Avoid false-positive error checks on ALTER TABLE
  * Further ORDER BY LIMIT optimization fixes for window functions
- Version 3.25.0:
  * Add support for window functions
  * Add support for renaming columns within a table
  * Query optimizer improvements
  * slightly better concurrency in multi-threaded environments
  * The ORDER BY LIMIT optimization might have caused an infinite
    loop in the byte code of the prepared statement under very
    obscure circumstances, due to a confluence of minor defects in
    the query optimizer
- Version 3.24.0:
  * Add support for PostgreSQL-style UPSERT
  * Add support for auxiliary columns in r-tree tables
  * Add C-language APIs for discovering SQL keywords used by SQLite
  * Add C-language APIs for dynamic strings based on sqlite3_str
  * Enhance ALTER TABLE so that it recognizes "true" and "false" as
    valid arguments to DEFAULT
  * Add the sorter-reference optimization as a compile-time option
  * Improve the format of the EXPLAIN QUERY PLAN raw output, so that
  it gives better information about the query plan and about the
    relationships between the various components of the plan
  * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the
    sqlite3_db_config() API.
  * Automatically intercept the raw EXPLAIN QUERY PLAN output an
    reformat it into an ASCII-art graph.
  * Lines that begin with "#" and that are not in the middle of an
    SQL statement are interpreted as comments
  * Add the --append option to the ".backup" command
  * Add the ".dbconfig" command
  * various performance improvements
  * various bug fixes</changelog>
  <changelog author="max@suse.com" date="1555502400">- Upgrade to 3.28.0:
  * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside
    a transaction could trigger a heap-based buffer over-read.
  * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a
    single transaction with an fts5 virtual table will lead to a
    NULL Pointer Dereference.
  * Enhanced window functions
  * Enhanced VACUUM INTO so that it works for read-only databases.
  * New query optimizations.
  * Added the sqlite3_value_frombind() API for determining if the
    argument to an SQL function is from a bound parameter.
  * Security and compatibilities enhancements to fts3_tokenizer().
  * Improved robustness against corrupt database files.</changelog>
  <changelog author="max@suse.com" date="1568116800">- bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch:
  Improper validation of qlite_stat1 sz field leads to division by
  zero.</changelog>
  <changelog author="max@suse.com" date="1625054400">- Sync version 3.36.0 from Factory to implement jsc#SLE-16032.
- Obsoletes sqlite3-CVE-2019-16168.patch.
- The following CVEs have been fixed in upstream releases up to
  this point, but were not mentioned in the change log so far:
  * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in
    multiSelectOrderBy due to mishandling of query-flattener
    optimization
  * bsc#1164719, CVE-2020-9327: NULL pointer dereference and
    segmentation fault because of generated column optimizations in
    isAuxiliaryVtabOperator
  * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds
    with WITH stack unwinding even after a parsing error
  * bsc#1160438, CVE-2019-19959: memory-management error via
    ext/misc/zipfile.c involving embedded '\0' input
  * bsc#1160309, CVE-2019-19923: improper handling  of  certain uses
    of SELECT DISTINCT in flattenSubquery may lead to null pointer
    dereference
  * bsc#1159850, CVE-2019-19924: improper error handling in
    sqlite3WindowRewrite()
  * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname
    during an update of a ZIP archive
  * bsc#1159715, CVE-2019-19926: improper handling  of certain
    errors during parsing  multiSelect in select.c
  * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c
    allows attackers to trigger an invalid pointer dereference
  * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE
    and CREATE VIEW statements, does not consider confusion with
    a shadow table name
  * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an
    integrity_check PRAGMA command in certain cases of generated
    columns
  * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger
    infinite recursion via certain types of self-referential views
    in conjunction with ALTER TABLE statements
  * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits
    from the colUsed bitmask in the case of a generated column,
    which allows attackers to cause a denial of service
  * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The
    function sqlite3Select in select.c allows a crash if a
    sub-select uses both DISTINCT and window functions, and also
    has certain ORDER BY usage
  * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator
    vulnerability
  * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of
    collation-sequence names
  * CVE-2020-13434 boo#1172115: integer overflow in
    sqlite3_str_vappendf
  * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow
  * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed
    to one of its shadow tables
  * CVE-2020-13632 boo#1172240: NULL pointer dereference via
    crafted matchinfo() query
  * CVE-2020-13435: Malicious SQL statements could have crashed the
    process that is running SQLite (boo#1172091)</changelog>
  <changelog author="max@suse.com" date="1638273600">- SQLite3 3.37.0:
  * STRICT tables provide a prescriptive style of data type
    management, for developers who prefer that kind of thing.
  * When adding columns that contain a CHECK constraint or a
    generated column containing a NOT NULL constraint, the
    ALTER TABLE ADD COLUMN now checks new constraints against
    preexisting rows in the database and will only proceed if no
    constraints are violated.
  * Added the PRAGMA table_list statement.
  * Add the .connection command, allowing the CLI to keep multiple
    database connections open at the same time.
  * Add the --safe command-line option that disables dot-commands
    and SQL statements that might cause side-effects that extend
    beyond the single database file named on the command-line.
  * CLI: Performance improvements when reading SQL statements that
    span many lines.
  * Added the sqlite3_autovacuum_pages() interface.
  * The sqlite3_deserialize() does not and has never worked
    for the TEMP database. That limitation is now noted in the
    documentation.
  * The query planner now omits ORDER BY clauses on subqueries and
    views if removing those clauses does not change the semantics
    of the query.
  * The generate_series table-valued function extension is modified
    so that the first parameter ("START") is now required. This is
    done as a way to demonstrate how to write table-valued
    functions with required parameters. The legacy behavior is
    available using the -DZERO_ARGUMENT_GENERATE_SERIES
    compile-time option.
  * Added new sqlite3_changes64() and sqlite3_total_changes64()
    interfaces.
  * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
  * Use less memory to hold the database schema.
  * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert
    extension when a column has no collating sequence.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641124800">- update to 3.37.1:
  * Fix a bug introduced by the UPSERT enhancements of version
    3.35.0 that can cause incorrect byte-code to be generated for
    some obscure but valid SQL, possibly resulting in a NULL-
    pointer dereference.
  * Fix an OOB read that can occur in FTS5 when reading corrupt
    database files.
  * Improved robustness of the --safe option in the CLI.
  * Other minor fixes to assert() statements and test cases.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641988800">- update to 3.37.2:
  * Fix a bug introduced in version 3.35.0 (2021-03-12) that can
    cause database corruption if a SAVEPOINT is rolled back while
    in PRAGMA temp_store=MEMORY mode, and other changes are made,
    and then the outer transaction commits
  * Fix a long-standing problem with ON DELETE CASCADE and ON
    UPDATE CASCADE in which a cache of the bytecode used to
    implement the cascading change was not being reset following a
    local DDL change</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1645876800">- update to 3.38.0
  * Add the -&gt; and -&gt;&gt; operators for easier processing of JSON
  * The JSON functions are now built-ins
  * Enhancements to date and time functions
  * Rename the printf() SQL function to format() for better
    compatibility, with alias for backwards compatibility.
  * Add the sqlite3_error_offset() interface for helping localize
    an SQL error to a specific character in the input SQL text
  * Enhance the interface to virtual tables
  * CLI columnar output modes are enhanced to correctly handle tabs
    and newlines embedded in text, and add options like "--wrap N",
    "--wordwrap on", and "--quote" to the columnar output modes.
  * Query planner enhancements using a Bloom filter to speed up
    large analytic queries, and a balanced merge tree to evaluate
    UNION or UNION ALL compound SELECT statements that have an
    ORDER BY clause.
  * The ALTER TABLE statement is changed to silently ignores
    entries in the sqlite_schema table that do not parse when
    PRAGMA writable_schema=ON</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1647172800">- update to 3.38.1:
  * Fix problems with the new Bloom filter optimization that might
    cause some obscure queries to get an incorrect answer.
  * Fix the localtime modifier of the date and time functions so
    that it preserves fractional seconds.
  * Fix the sqlite_offset SQL function so that it works correctly
    even in corner cases such as when the argument is a virtual
    column or the column of a view.
  * Fix row value IN operator constraints on virtual tables so that
    they work correctly even if the virtual table implementation
    relies on bytecode to filter rows that do not satisfy the
    constraint.
  * Other minor fixes to assert() statements, test cases, and
    documentation. See the source code timeline for details.
- add upstream patch to run atof1 tests only on x86_64
  sqlite-src-3380100-atof1.patch</changelog>
  <changelog author="max@suse.com" date="1647432000">- Remove obsolete configure flags
- Package the Tcl bindings here again so that we only ship one copy
  of SQLite (bsc#1195773).</changelog>
  <changelog author="max@suse.com" date="1648555200">- update to 3.38.2:
  * Fix a problem with the Bloom filter optimization that might
    cause an incorrect answer when doing a LEFT JOIN with a WHERE
    clause constraint that says that one of the columns on the
    right table of the LEFT JOIN is NULL.
  * Other minor patches.</changelog>
  <changelog author="info@paolostivanin.com" date="1651147200">- update to 3.38.3:
  * Fix a case of the query planner be overly aggressive with
    optimizing automatic-index and Bloom-filter construction,
    using inappropriate ON clause terms to restrict the size of the
    automatic-index or Bloom filter, and resulting in missing rows
    in the output.
  * Other minor patches. See the timeline for details.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652011200">- update to 3.38.5:
  * Fix a blunder in the CLI of the 3.38.4 release
- includes changes from 3.38.4:
  * fix a byte-code problem in the Bloom filter pull-down
    optimization added by release 3.38.0 in which an error in the
    byte code causes the byte code engine to enter an infinite loop
    when the pull-down optimization encounters a NULL key</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1656676800">- update to 3.39.0:
  * Add (long overdue) support for RIGHT and FULL OUTER JOIN
  * Add new binary comparison operators IS NOT DISTINCT FROM and
    IS DISTINCT FROM that are equivalent to IS and IS NOT,
    respective, for compatibility with PostgreSQL and SQL standards
  * Add a new return code (value "3") from the sqlite3_vtab_distinct()
    interface that indicates a query that has both DISTINCT and
    ORDER BY clauses
  * Added the sqlite3_db_name() interface
  * The unix os interface resolves all symbolic links in database
    filenames to create a canonical name for the database before
    the file is opened
  * Defer materializing views until the materialization is actually
    needed, thus avoiding unnecessary work if the materialization
    turns out to never be used
  * The HAVING clause of a SELECT statement is now allowed on any
    aggregate query, even queries that do not have a GROUP BY
    clause
  * Many microoptimizations collectively reduce CPU cycles by about
    2.3%.
- drop sqlite-src-3380100-atof1.patch, included upstream
- add sqlite-src-3390000-func7-pg-181.patch to skip float precision
  related test failures on 32 bit</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1657886400">- update to 3.39.1:
  * Fix an incorrect result from a query that uses a view that
    contains a compound SELECT in which only one arm contains a
    RIGHT JOIN and where the view is not the first FROM clause term
    of the query that contains the view
  * Fix a long-standing problem with ALTER TABLE RENAME that can
    only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set
    to a very small value.
  * Fix a long-standing problem in FTS3 that can only arise when
    compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time
    option.
  * Fix the initial-prefix optimization for the REGEXP extension so
    that it works correctly even if the prefix contains characters
    that require a 3-byte UTF8 encoding.
  * Enhance the sqlite_stmt virtual table so that it buffers all of
    its output.</changelog>
  <changelog author="max@suse.com" date="1658404800">- update to 3.39.2:
  * Fix a performance regression in the query planner associated
    with rearranging the order of FROM clause terms in the
    presences of a LEFT JOIN.
  * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and
    1345947, forum post 3607259d3c, and other minor problems
    discovered by internal testing. [boo#1201783]</changelog>
  <changelog author="max@suse.com" date="1662379200">- update to 3.39.3:
  * Use a statement journal on DML statement affecting two or more
    database rows if the statement makes use of a SQL functions
    that might abort.
  * Use a mutex to protect the PRAGMA temp_store_directory and
    PRAGMA data_store_directory statements, even though they are
    decremented and documented as not being threadsafe.</changelog>
  <changelog author="max@suse.com" date="1670932800">- bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch:
  relying on --safe for execution of an untrusted CLI script</changelog>
</package>
<package pkgid="080705e1063195761109850ea4f8e30bb24e92906e5c9cec76399cb898f4eb96" name="libsqlite3-0" arch="x86_64">
  <version epoch="0" ver="3.39.3" rel="150000.3.20.1"/>
  <changelog author="astieger@suse.com" date="1522670400">- update to 3.23.0:
  * Add the sqlite3_serialize() and sqlite3_deserialize()
    interfaces when the SQLITE_ENABLE_DESERIALIZE compile-time
    option is used.
  * Recognize TRUE and FALSE as constants. (For compatibility, if
    there exist columns named "true" or "false", then the
    identifiers refer to the columns rather than Boolean constants.)
  * Support operators IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE.
  * Added the SQLITE_DBSTATUS_CACHE_SPILL option to
    sqlite3_db_status() for reporting the number of cache spills
    that have occurred.
  * The "alternate-form-2" flag ("!") on the built-in printf
    implementation now causes string substitutions to measure the
    width and precision in characters instead of bytes.
  * If the xColumn method in a virtual table implementation returns
    an error message using sqlite3_result_error() then give that
    error message preference over internally-generated messages.
  * Added the -A command-line option to the CLI to make it easier to
    manage SQLite Archive files.
  * Add support for INSERT OR REPLACE, INSERT OR IGNORE, and UPDATE
    OR REPLACE in the Zipfile virtual table.
  * Enhance the sqlite3changeset_apply() interface so that it is
    hardened against attacks from deliberately corrupted changeset
    objects.
  * Added the sqlite3_normalize() extension function.
  * Query optimizer enhancements
  * Various bug fixes
  * Fix various issues reported by fuzzers, including:
    + CVE-2018-8740: NULL pointer dereference on CREATE TABLE as
    (bsc#1085790)</changelog>
  <changelog author="astieger@suse.com" date="1523448000">- update to 3.23.1:
  * Fix two problems in the new LEFT JOIN strength reduction
    optimization
  * Fix misbehavior of the FTS5 xBestIndex method
  * Fix a harmless reference to an uninitialized virtual machine
    register
  * Fix the eval.c extension so that it works with PRAGMA
    empty_result_callbacks=ON
  * Fix the generate_series virtual table so that it correctly
    returns no rows if any of its constraints are NULL
  * Performance enhancements in the parser</changelog>
  <changelog author="max@suse.com" date="1552996800">- CVE-2018-20346, bsc#1119687: Upgrade to the most recent version
  to fix a remote code execution vulnerability in FTS3 (Magellan).
- Drop sqlite-fts5-link.patch and do it in the spec file instead.
- Version 3.27.2:
  * Add the VACUUM INTO command
  * Issue an SQLITE_WARNING message on the error log if a
    double-quoted string literal is used
  * Add the remove_diacritics=2 option to FTS3 and FTS5.
  * Add  the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3().
    Use that option to prevent circular references to shadow tables
    from causing resource leaks.
  * Enhancements to the sqlite3_deserialize() interface
  * Enhancements to the CLI, mostly to support testing and debugging
    of the SQLite library itself
  * Increased robustness against malicious SQL that is run against
    a maliciously corrupted database
- Version 3.26.0:
  * Optimization: When doing an UPDATE on a table with indexes on
    expressions, do not update the expression indexes if they do
    not refer to any of the columns of the table being updated.
  * Allow the xBestIndex() method of virtual table implementations
    to return SQLITE_CONSTRAINT to indicate that the proposed query
    plan is unusable and should not be given further consideration.
  * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the
    ability to create corrupt database files using ordinary SQL.
  * Added support for read-only shadow tables when the
    SQLITE_DBCONFIG_DEFENSIVE option is enabled.
  * Added the PRAGMA legacy_alter_table command, which if enabled
    causes the ALTER TABLE command to behave like older version of
    SQLite (prior to version 3.25.0) for compatibility.
  * Added PRAGMA table_xinfo that works just like PRAGMA table_info
    except that it also shows hidden columns in virtual tables.
  * Added the explain virtual table as a run-time loadable
    extension.
  * Add a limit counter to the query planner to prevent excessive
    sqlite3_prepare() times for certain pathological SQL inputs.
  * Added support for the sqlite3_normalized_sql() interface, when
    compiling with SQLITE_ENABLE_NORMALIZE.
  * Enhanced triggers so that they can use table-valued functions
    that exist in schemas other than the schema where the trigger
    is defined.
  * Improvements to the ".help" command in the CLI.
  * The SQLITE_HISTORY environment variable, if it exists,
    specifies the name of the command-line editing history file.
  * The --deserialize option associated with opening a new database
    in the CLI cause the database file to be read into memory and
    accessed using the sqlite3_deserialize() API. This simplifies
    running tests on a database without modifying the file on disk.
- Version 3.25.2:
  * Add the PRAGMA legacy_alter_table=ON command that causes the
    "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier
  * Fix issue with some expressions with windows functions in views
- Version 3.25.1:
  * Avoid false-positive error checks on ALTER TABLE
  * Further ORDER BY LIMIT optimization fixes for window functions
- Version 3.25.0:
  * Add support for window functions
  * Add support for renaming columns within a table
  * Query optimizer improvements
  * slightly better concurrency in multi-threaded environments
  * The ORDER BY LIMIT optimization might have caused an infinite
    loop in the byte code of the prepared statement under very
    obscure circumstances, due to a confluence of minor defects in
    the query optimizer
- Version 3.24.0:
  * Add support for PostgreSQL-style UPSERT
  * Add support for auxiliary columns in r-tree tables
  * Add C-language APIs for discovering SQL keywords used by SQLite
  * Add C-language APIs for dynamic strings based on sqlite3_str
  * Enhance ALTER TABLE so that it recognizes "true" and "false" as
    valid arguments to DEFAULT
  * Add the sorter-reference optimization as a compile-time option
  * Improve the format of the EXPLAIN QUERY PLAN raw output, so that
  it gives better information about the query plan and about the
    relationships between the various components of the plan
  * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the
    sqlite3_db_config() API.
  * Automatically intercept the raw EXPLAIN QUERY PLAN output an
    reformat it into an ASCII-art graph.
  * Lines that begin with "#" and that are not in the middle of an
    SQL statement are interpreted as comments
  * Add the --append option to the ".backup" command
  * Add the ".dbconfig" command
  * various performance improvements
  * various bug fixes</changelog>
  <changelog author="max@suse.com" date="1555502400">- Upgrade to 3.28.0:
  * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside
    a transaction could trigger a heap-based buffer over-read.
  * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a
    single transaction with an fts5 virtual table will lead to a
    NULL Pointer Dereference.
  * Enhanced window functions
  * Enhanced VACUUM INTO so that it works for read-only databases.
  * New query optimizations.
  * Added the sqlite3_value_frombind() API for determining if the
    argument to an SQL function is from a bound parameter.
  * Security and compatibilities enhancements to fts3_tokenizer().
  * Improved robustness against corrupt database files.</changelog>
  <changelog author="max@suse.com" date="1568116800">- bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch:
  Improper validation of qlite_stat1 sz field leads to division by
  zero.</changelog>
  <changelog author="max@suse.com" date="1625054400">- Sync version 3.36.0 from Factory to implement jsc#SLE-16032.
- Obsoletes sqlite3-CVE-2019-16168.patch.
- The following CVEs have been fixed in upstream releases up to
  this point, but were not mentioned in the change log so far:
  * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in
    multiSelectOrderBy due to mishandling of query-flattener
    optimization
  * bsc#1164719, CVE-2020-9327: NULL pointer dereference and
    segmentation fault because of generated column optimizations in
    isAuxiliaryVtabOperator
  * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds
    with WITH stack unwinding even after a parsing error
  * bsc#1160438, CVE-2019-19959: memory-management error via
    ext/misc/zipfile.c involving embedded '\0' input
  * bsc#1160309, CVE-2019-19923: improper handling  of  certain uses
    of SELECT DISTINCT in flattenSubquery may lead to null pointer
    dereference
  * bsc#1159850, CVE-2019-19924: improper error handling in
    sqlite3WindowRewrite()
  * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname
    during an update of a ZIP archive
  * bsc#1159715, CVE-2019-19926: improper handling  of certain
    errors during parsing  multiSelect in select.c
  * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c
    allows attackers to trigger an invalid pointer dereference
  * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE
    and CREATE VIEW statements, does not consider confusion with
    a shadow table name
  * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an
    integrity_check PRAGMA command in certain cases of generated
    columns
  * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger
    infinite recursion via certain types of self-referential views
    in conjunction with ALTER TABLE statements
  * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits
    from the colUsed bitmask in the case of a generated column,
    which allows attackers to cause a denial of service
  * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The
    function sqlite3Select in select.c allows a crash if a
    sub-select uses both DISTINCT and window functions, and also
    has certain ORDER BY usage
  * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator
    vulnerability
  * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of
    collation-sequence names
  * CVE-2020-13434 boo#1172115: integer overflow in
    sqlite3_str_vappendf
  * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow
  * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed
    to one of its shadow tables
  * CVE-2020-13632 boo#1172240: NULL pointer dereference via
    crafted matchinfo() query
  * CVE-2020-13435: Malicious SQL statements could have crashed the
    process that is running SQLite (boo#1172091)</changelog>
  <changelog author="max@suse.com" date="1638273600">- SQLite3 3.37.0:
  * STRICT tables provide a prescriptive style of data type
    management, for developers who prefer that kind of thing.
  * When adding columns that contain a CHECK constraint or a
    generated column containing a NOT NULL constraint, the
    ALTER TABLE ADD COLUMN now checks new constraints against
    preexisting rows in the database and will only proceed if no
    constraints are violated.
  * Added the PRAGMA table_list statement.
  * Add the .connection command, allowing the CLI to keep multiple
    database connections open at the same time.
  * Add the --safe command-line option that disables dot-commands
    and SQL statements that might cause side-effects that extend
    beyond the single database file named on the command-line.
  * CLI: Performance improvements when reading SQL statements that
    span many lines.
  * Added the sqlite3_autovacuum_pages() interface.
  * The sqlite3_deserialize() does not and has never worked
    for the TEMP database. That limitation is now noted in the
    documentation.
  * The query planner now omits ORDER BY clauses on subqueries and
    views if removing those clauses does not change the semantics
    of the query.
  * The generate_series table-valued function extension is modified
    so that the first parameter ("START") is now required. This is
    done as a way to demonstrate how to write table-valued
    functions with required parameters. The legacy behavior is
    available using the -DZERO_ARGUMENT_GENERATE_SERIES
    compile-time option.
  * Added new sqlite3_changes64() and sqlite3_total_changes64()
    interfaces.
  * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
  * Use less memory to hold the database schema.
  * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert
    extension when a column has no collating sequence.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641124800">- update to 3.37.1:
  * Fix a bug introduced by the UPSERT enhancements of version
    3.35.0 that can cause incorrect byte-code to be generated for
    some obscure but valid SQL, possibly resulting in a NULL-
    pointer dereference.
  * Fix an OOB read that can occur in FTS5 when reading corrupt
    database files.
  * Improved robustness of the --safe option in the CLI.
  * Other minor fixes to assert() statements and test cases.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641988800">- update to 3.37.2:
  * Fix a bug introduced in version 3.35.0 (2021-03-12) that can
    cause database corruption if a SAVEPOINT is rolled back while
    in PRAGMA temp_store=MEMORY mode, and other changes are made,
    and then the outer transaction commits
  * Fix a long-standing problem with ON DELETE CASCADE and ON
    UPDATE CASCADE in which a cache of the bytecode used to
    implement the cascading change was not being reset following a
    local DDL change</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1645876800">- update to 3.38.0
  * Add the -&gt; and -&gt;&gt; operators for easier processing of JSON
  * The JSON functions are now built-ins
  * Enhancements to date and time functions
  * Rename the printf() SQL function to format() for better
    compatibility, with alias for backwards compatibility.
  * Add the sqlite3_error_offset() interface for helping localize
    an SQL error to a specific character in the input SQL text
  * Enhance the interface to virtual tables
  * CLI columnar output modes are enhanced to correctly handle tabs
    and newlines embedded in text, and add options like "--wrap N",
    "--wordwrap on", and "--quote" to the columnar output modes.
  * Query planner enhancements using a Bloom filter to speed up
    large analytic queries, and a balanced merge tree to evaluate
    UNION or UNION ALL compound SELECT statements that have an
    ORDER BY clause.
  * The ALTER TABLE statement is changed to silently ignores
    entries in the sqlite_schema table that do not parse when
    PRAGMA writable_schema=ON</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1647172800">- update to 3.38.1:
  * Fix problems with the new Bloom filter optimization that might
    cause some obscure queries to get an incorrect answer.
  * Fix the localtime modifier of the date and time functions so
    that it preserves fractional seconds.
  * Fix the sqlite_offset SQL function so that it works correctly
    even in corner cases such as when the argument is a virtual
    column or the column of a view.
  * Fix row value IN operator constraints on virtual tables so that
    they work correctly even if the virtual table implementation
    relies on bytecode to filter rows that do not satisfy the
    constraint.
  * Other minor fixes to assert() statements, test cases, and
    documentation. See the source code timeline for details.
- add upstream patch to run atof1 tests only on x86_64
  sqlite-src-3380100-atof1.patch</changelog>
  <changelog author="max@suse.com" date="1647432000">- Remove obsolete configure flags
- Package the Tcl bindings here again so that we only ship one copy
  of SQLite (bsc#1195773).</changelog>
  <changelog author="max@suse.com" date="1648555200">- update to 3.38.2:
  * Fix a problem with the Bloom filter optimization that might
    cause an incorrect answer when doing a LEFT JOIN with a WHERE
    clause constraint that says that one of the columns on the
    right table of the LEFT JOIN is NULL.
  * Other minor patches.</changelog>
  <changelog author="info@paolostivanin.com" date="1651147200">- update to 3.38.3:
  * Fix a case of the query planner be overly aggressive with
    optimizing automatic-index and Bloom-filter construction,
    using inappropriate ON clause terms to restrict the size of the
    automatic-index or Bloom filter, and resulting in missing rows
    in the output.
  * Other minor patches. See the timeline for details.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652011200">- update to 3.38.5:
  * Fix a blunder in the CLI of the 3.38.4 release
- includes changes from 3.38.4:
  * fix a byte-code problem in the Bloom filter pull-down
    optimization added by release 3.38.0 in which an error in the
    byte code causes the byte code engine to enter an infinite loop
    when the pull-down optimization encounters a NULL key</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1656676800">- update to 3.39.0:
  * Add (long overdue) support for RIGHT and FULL OUTER JOIN
  * Add new binary comparison operators IS NOT DISTINCT FROM and
    IS DISTINCT FROM that are equivalent to IS and IS NOT,
    respective, for compatibility with PostgreSQL and SQL standards
  * Add a new return code (value "3") from the sqlite3_vtab_distinct()
    interface that indicates a query that has both DISTINCT and
    ORDER BY clauses
  * Added the sqlite3_db_name() interface
  * The unix os interface resolves all symbolic links in database
    filenames to create a canonical name for the database before
    the file is opened
  * Defer materializing views until the materialization is actually
    needed, thus avoiding unnecessary work if the materialization
    turns out to never be used
  * The HAVING clause of a SELECT statement is now allowed on any
    aggregate query, even queries that do not have a GROUP BY
    clause
  * Many microoptimizations collectively reduce CPU cycles by about
    2.3%.
- drop sqlite-src-3380100-atof1.patch, included upstream
- add sqlite-src-3390000-func7-pg-181.patch to skip float precision
  related test failures on 32 bit</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1657886400">- update to 3.39.1:
  * Fix an incorrect result from a query that uses a view that
    contains a compound SELECT in which only one arm contains a
    RIGHT JOIN and where the view is not the first FROM clause term
    of the query that contains the view
  * Fix a long-standing problem with ALTER TABLE RENAME that can
    only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set
    to a very small value.
  * Fix a long-standing problem in FTS3 that can only arise when
    compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time
    option.
  * Fix the initial-prefix optimization for the REGEXP extension so
    that it works correctly even if the prefix contains characters
    that require a 3-byte UTF8 encoding.
  * Enhance the sqlite_stmt virtual table so that it buffers all of
    its output.</changelog>
  <changelog author="max@suse.com" date="1658404800">- update to 3.39.2:
  * Fix a performance regression in the query planner associated
    with rearranging the order of FROM clause terms in the
    presences of a LEFT JOIN.
  * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and
    1345947, forum post 3607259d3c, and other minor problems
    discovered by internal testing. [boo#1201783]</changelog>
  <changelog author="max@suse.com" date="1662379200">- update to 3.39.3:
  * Use a statement journal on DML statement affecting two or more
    database rows if the statement makes use of a SQL functions
    that might abort.
  * Use a mutex to protect the PRAGMA temp_store_directory and
    PRAGMA data_store_directory statements, even though they are
    decremented and documented as not being threadsafe.</changelog>
  <changelog author="max@suse.com" date="1670932800">- bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch:
  relying on --safe for execution of an untrusted CLI script</changelog>
</package>
<package pkgid="18595e81cfb9405bbecc25003bb613a45f004daf3718de179b69ee6ebb86f19f" name="libstdc++6" arch="aarch64">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.5.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="197c563089dffd20d5b42ea8272f3f8ee5ebcad40de443745061607ba236e355" name="libstdc++6" arch="x86_64">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.5.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="f6c2b1f256b48d1f7829ecd91edbd2492c8ea70d4b93a6b4fa437e2c6e669905" name="libstdc++6" arch="aarch64">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.7.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="3a3c8d9c704a1e2bdea9766c068bdb555235249bbcffb14580ac0284ed2fbbee" name="libstdc++6" arch="x86_64">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.7.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="c2b28cf19a53f905bb9022af17f642ed3790f0d19d27b9c07eda9a84ed22b9b9" name="libsystemd0" arch="aarch64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="63558012a441485cc7d65753896bcc8a0fa5f47d5293e8813be2bf46fbc8cb90" name="libsystemd0" arch="x86_64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="992f4d84cb3ea90217f8bfa727333af21db8eb0c6f51165a253b37a9293d267b" name="libsystemd0" arch="aarch64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="b8938c16bb55dc68f6e37cc47e25ba11ac763fa580e2a9a7a266de7552b8a13c" name="libsystemd0" arch="x86_64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="216e78c778bcb874f507d387b07e1d2f90c345e7154aea077d301b6fdd8c69b2" name="libsystemd0" arch="aarch64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="25e7926a410787e92af0028f6c17363e386ca03da20991e3e82f5e18281bc806" name="libsystemd0" arch="x86_64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="29b6e4d3fb850f1a0a3a441a81ca49efa270fd9aafa4b3077ddd0f2c92d6b51a" name="libtiff5" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="150000.45.19.1"/>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
</package>
<package pkgid="15ca697a53b40d8403ecd6f1230ddea99163f4acbf072d17cb1e17fcc2e5ff0b" name="libtiff5" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.19.1"/>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
</package>
<package pkgid="e682e0ec3f1bdfc5a43dedb08ddb4d9d6eff9331056bad0eaa1c061c2a6fa4b0" name="libtiff5" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="150000.45.22.1"/>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
</package>
<package pkgid="8c28d4c6ec19ca117886157c99f63be6b1d483a143d5235044a7a5165200cb69" name="libtiff5" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.22.1"/>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
</package>
<package pkgid="37f1749cba1a0270a391c3cd3091d8337808b4e5a9a8509a4f5121d098958050" name="libtiff5" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="150000.45.25.1"/>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
</package>
<package pkgid="8757222bff38b9319b0d0f9183d197016315a98101a1a209dbf582c765007d6b" name="libtiff5" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.25.1"/>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
</package>
<package pkgid="6fd6c074da7f3c357a85a3685c6937bacfd8c5cd5af1348863113f659b3a44f0" name="libtirpc" arch="src">
  <version epoch="0" ver="1.2.6" rel="150300.3.17.1"/>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
</package>
<package pkgid="105e678db838d5add05bf4c831841859aec7944f6d3f107f4da05326d295a63a" name="libtirpc-netconfig" arch="aarch64">
  <version epoch="0" ver="1.2.6" rel="150300.3.17.1"/>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
</package>
<package pkgid="b24b3035cc721837279c19e5317b8fb35e9cac47ece226a44d85899d12c0eb94" name="libtirpc-netconfig" arch="x86_64">
  <version epoch="0" ver="1.2.6" rel="150300.3.17.1"/>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
</package>
<package pkgid="2cc7f5d3bdb3c1ac57bcd5647390d0a79c4a4beadfdcd0b2b35fee8b936a07bf" name="libtirpc3" arch="aarch64">
  <version epoch="0" ver="1.2.6" rel="150300.3.17.1"/>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
</package>
<package pkgid="2015c0025645729a0ead8fc6880954c055b6200258ca230ea3fdae46f645eb08" name="libtirpc3" arch="x86_64">
  <version epoch="0" ver="1.2.6" rel="150300.3.17.1"/>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
</package>
<package pkgid="32f9ba07a6790b307b81307b10a5f82f56da6903010bb45d53ccec3efda39f3f" name="libtpms" arch="src">
  <version epoch="0" ver="0.8.2" rel="150300.3.6.1"/>
  <changelog author="meissner@suse.com" date="1389700800">- import 0.5.1
  - software TPM driver library for hooking into QEMU</changelog>
  <changelog author="p.drouand@gmail.com" date="1426939200">- Update to version 0.5.2
  * No entry for this release
- Update project home and download Urls
- Add autoconf, automake and libtool build require; the tarball
  comes from git and configure script has to be generated</changelog>
  <changelog author="vcizek@suse.com" date="1516190400">- Update to version 0.6.0-dev1
  * no upstream changelog
  * fix build with openssl 1.1 (bsc#1074801)
- fix rpm group</changelog>
  <changelog author="glin@suse.com" date="1548676800">- Update to version 0.6.0
  * Introduce TPM2 support
- Use %license tag for LICENSE</changelog>
  <changelog author="glin@suse.com" date="1567684800">- Update to version 0.7.0
  * fixes for TPM2
- Add gcc-c++ to BuildRequires</changelog>
  <changelog author="kai.liu@suse.com" date="1595505600">- Update to version 0.7.3
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest `swtpm` (master, stable branches) for test cases to
    succeed there.
- Changes since version 0.7.2
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rathern than
    max. possible
  * Fixes to symmetric decrytion related to input size check, defer
    padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)] and to
    always use a temporary malloc'ed buffer for decryption
- Changes since version 0.7.1
  * tpm2: Fix TDES key creation by adding missing un-/marshalling
    functions
  * tpm2: Fix a bug in CheckAuthSession
  * compilation fixes for TPM 1.2 &amp; TPM 2 and various architectures
    and gcc versions
  * Fix support for NIST curves P{192,224,521} and SM2 P256 and
    BNP648 that would not work;
  * Runtime filter elliptic curves (that OpenSSL does not support)
    and do not advertise those curves as capabilities
  * Removed unnecessary space in MANUFACTURER "IBM " -&gt; "IBM"</changelog>
  <changelog author="glin@suse.com" date="1606132800">- Update to version 0.7.4
  * Addressed potential constant-time related issues in TPM 1.2 and
    TPM 2 code
    TPM 1.2: RSA decryption
    TPM 2: EcSchnorr and EcSM2 signatures; Ecsda is handled by OpenSSL
  * Fixed some compilation issues</changelog>
  <changelog author="glin@suse.com" date="1616155200">- Update to version 0.7.7
  * CryptSym: fix AES output IV (bsc#1183729, CVE-2021-3446)
  * tpm2: Fix public key context save due to ANY_OBJECT_Marshal usage
  * tpm2: Address some Coverity issues (false positives)
  * tpm1.2: Backported ASAN/UBSAN related fixes
  * tpm2: Return properly sized array for b parameter for NIST P521
    (HLK)
  * tpm2: Addressed issues detected by UBSAN
  * tpm2: Addressed issues detected by cppcheck (false positives)</changelog>
  <changelog author="glin@suse.com" date="1618833600">- Update to version 0.8.2
  * NOTE: Downgrade to 0.7.x or below is not possible.
    Due to fixes in the TPM 2 prime number generation code in
    rev155 it is not possible to downgrade from libtpms version
    0.8.0 to some previous version. The seeds are now associated
    with an age so that older seeds use the old TPM 2 prime number
    generation code while newer seed use the newer code.
  * tpm2: rev155: Add new RsaAdjustPrimeCandidate code but do
    not use (bsc#1184939 CVE-2021-3505)
  * tpm2: Activate SEED_COMPAT_LEVEL_RSA_PRIME_ADJUST_FIX
    (bsc#1184939 CVE-2021-3505)
  * Update to TPM 2 code release 159
  - X509 support is enabled
    + SM2 signing of ceritificates is NOT supported
  - Authenticated timers are disabled
  * Update to TPM 2 code relase 162
  - ECC encryption / decryption is disabled
  * Fix support for elliptic curve due to missing unmarshalling
    code
  * Runtime filter supported elliptic curves supported by OpenSSL
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rather than
    max
  * Fixes to symmetric decryption related to input size check,
    defer padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)]
    and to always use a temporary malloc'ed buffer for decryption
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest swtpm for test cases to succeed there.</changelog>
  <changelog author="pgajdos@suse.com" date="1630411200">- security update
- added patches
  fix CVE-2021-3746 [bsc#1189935], out-of-bounds access via specially crafted TPM 2 command packets
  + libtpms-CVE-2021-3746.patch</changelog>
  <changelog author="meissner@suse.com" date="1666353600">- Added patches:
  0001-tpm2-Reset-TPM2B-buffer-sizes-after-test-fails-for-v.patch
  0002-tpm2-Add-maxSize-parameter-to-TPM2B_Marshal-for-sani.patch
  0003-tpm2-Restore-original-value-if-unmarsalled-value-was.patch
- CVE-2021-3623: Fixed out-of-bounds access when trying to resume the
  state of the vTPM (bsc#1187767)</changelog>
  <changelog author="pgajdos@suse.com" date="1669377600">- fix build for ppc64le: use -Wl,--no-as-needed in check-local
  [bsc#1204556]</changelog>
</package>
<package pkgid="5791a3b01b09994e8d4d63a6d73602c4ddb843e731599c921fb5c1f678449116" name="libtpms0" arch="aarch64">
  <version epoch="0" ver="0.8.2" rel="150300.3.6.1"/>
  <changelog author="p.drouand@gmail.com" date="1426939200">- Update to version 0.5.2
  * No entry for this release
- Update project home and download Urls
- Add autoconf, automake and libtool build require; the tarball
  comes from git and configure script has to be generated</changelog>
  <changelog author="vcizek@suse.com" date="1516190400">- Update to version 0.6.0-dev1
  * no upstream changelog
  * fix build with openssl 1.1 (bsc#1074801)
- fix rpm group</changelog>
  <changelog author="glin@suse.com" date="1548676800">- Update to version 0.6.0
  * Introduce TPM2 support
- Use %license tag for LICENSE</changelog>
  <changelog author="glin@suse.com" date="1567684800">- Update to version 0.7.0
  * fixes for TPM2
- Add gcc-c++ to BuildRequires</changelog>
  <changelog author="kai.liu@suse.com" date="1595505600">- Update to version 0.7.3
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest `swtpm` (master, stable branches) for test cases to
    succeed there.
- Changes since version 0.7.2
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rathern than
    max. possible
  * Fixes to symmetric decrytion related to input size check, defer
    padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)] and to
    always use a temporary malloc'ed buffer for decryption
- Changes since version 0.7.1
  * tpm2: Fix TDES key creation by adding missing un-/marshalling
    functions
  * tpm2: Fix a bug in CheckAuthSession
  * compilation fixes for TPM 1.2 &amp; TPM 2 and various architectures
    and gcc versions
  * Fix support for NIST curves P{192,224,521} and SM2 P256 and
    BNP648 that would not work;
  * Runtime filter elliptic curves (that OpenSSL does not support)
    and do not advertise those curves as capabilities
  * Removed unnecessary space in MANUFACTURER "IBM " -&gt; "IBM"</changelog>
  <changelog author="glin@suse.com" date="1606132800">- Update to version 0.7.4
  * Addressed potential constant-time related issues in TPM 1.2 and
    TPM 2 code
    TPM 1.2: RSA decryption
    TPM 2: EcSchnorr and EcSM2 signatures; Ecsda is handled by OpenSSL
  * Fixed some compilation issues</changelog>
  <changelog author="glin@suse.com" date="1616155200">- Update to version 0.7.7
  * CryptSym: fix AES output IV (bsc#1183729, CVE-2021-3446)
  * tpm2: Fix public key context save due to ANY_OBJECT_Marshal usage
  * tpm2: Address some Coverity issues (false positives)
  * tpm1.2: Backported ASAN/UBSAN related fixes
  * tpm2: Return properly sized array for b parameter for NIST P521
    (HLK)
  * tpm2: Addressed issues detected by UBSAN
  * tpm2: Addressed issues detected by cppcheck (false positives)</changelog>
  <changelog author="glin@suse.com" date="1618833600">- Update to version 0.8.2
  * NOTE: Downgrade to 0.7.x or below is not possible.
    Due to fixes in the TPM 2 prime number generation code in
    rev155 it is not possible to downgrade from libtpms version
    0.8.0 to some previous version. The seeds are now associated
    with an age so that older seeds use the old TPM 2 prime number
    generation code while newer seed use the newer code.
  * tpm2: rev155: Add new RsaAdjustPrimeCandidate code but do
    not use (bsc#1184939 CVE-2021-3505)
  * tpm2: Activate SEED_COMPAT_LEVEL_RSA_PRIME_ADJUST_FIX
    (bsc#1184939 CVE-2021-3505)
  * Update to TPM 2 code release 159
  - X509 support is enabled
    + SM2 signing of ceritificates is NOT supported
  - Authenticated timers are disabled
  * Update to TPM 2 code relase 162
  - ECC encryption / decryption is disabled
  * Fix support for elliptic curve due to missing unmarshalling
    code
  * Runtime filter supported elliptic curves supported by OpenSSL
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rather than
    max
  * Fixes to symmetric decryption related to input size check,
    defer padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)]
    and to always use a temporary malloc'ed buffer for decryption
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest swtpm for test cases to succeed there.</changelog>
  <changelog author="pgajdos@suse.com" date="1630411200">- security update
- added patches
  fix CVE-2021-3746 [bsc#1189935], out-of-bounds access via specially crafted TPM 2 command packets
  + libtpms-CVE-2021-3746.patch</changelog>
  <changelog author="meissner@suse.com" date="1666353600">- Added patches:
  0001-tpm2-Reset-TPM2B-buffer-sizes-after-test-fails-for-v.patch
  0002-tpm2-Add-maxSize-parameter-to-TPM2B_Marshal-for-sani.patch
  0003-tpm2-Restore-original-value-if-unmarsalled-value-was.patch
- CVE-2021-3623: Fixed out-of-bounds access when trying to resume the
  state of the vTPM (bsc#1187767)</changelog>
  <changelog author="pgajdos@suse.com" date="1669377600">- fix build for ppc64le: use -Wl,--no-as-needed in check-local
  [bsc#1204556]</changelog>
</package>
<package pkgid="3f5ecfba3a28cdfa8d9147a4d00cdfb5f479b741486569c7a55ca6193b464312" name="libtpms0" arch="x86_64">
  <version epoch="0" ver="0.8.2" rel="150300.3.6.1"/>
  <changelog author="p.drouand@gmail.com" date="1426939200">- Update to version 0.5.2
  * No entry for this release
- Update project home and download Urls
- Add autoconf, automake and libtool build require; the tarball
  comes from git and configure script has to be generated</changelog>
  <changelog author="vcizek@suse.com" date="1516190400">- Update to version 0.6.0-dev1
  * no upstream changelog
  * fix build with openssl 1.1 (bsc#1074801)
- fix rpm group</changelog>
  <changelog author="glin@suse.com" date="1548676800">- Update to version 0.6.0
  * Introduce TPM2 support
- Use %license tag for LICENSE</changelog>
  <changelog author="glin@suse.com" date="1567684800">- Update to version 0.7.0
  * fixes for TPM2
- Add gcc-c++ to BuildRequires</changelog>
  <changelog author="kai.liu@suse.com" date="1595505600">- Update to version 0.7.3
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest `swtpm` (master, stable branches) for test cases to
    succeed there.
- Changes since version 0.7.2
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rathern than
    max. possible
  * Fixes to symmetric decrytion related to input size check, defer
    padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)] and to
    always use a temporary malloc'ed buffer for decryption
- Changes since version 0.7.1
  * tpm2: Fix TDES key creation by adding missing un-/marshalling
    functions
  * tpm2: Fix a bug in CheckAuthSession
  * compilation fixes for TPM 1.2 &amp; TPM 2 and various architectures
    and gcc versions
  * Fix support for NIST curves P{192,224,521} and SM2 P256 and
    BNP648 that would not work;
  * Runtime filter elliptic curves (that OpenSSL does not support)
    and do not advertise those curves as capabilities
  * Removed unnecessary space in MANUFACTURER "IBM " -&gt; "IBM"</changelog>
  <changelog author="glin@suse.com" date="1606132800">- Update to version 0.7.4
  * Addressed potential constant-time related issues in TPM 1.2 and
    TPM 2 code
    TPM 1.2: RSA decryption
    TPM 2: EcSchnorr and EcSM2 signatures; Ecsda is handled by OpenSSL
  * Fixed some compilation issues</changelog>
  <changelog author="glin@suse.com" date="1616155200">- Update to version 0.7.7
  * CryptSym: fix AES output IV (bsc#1183729, CVE-2021-3446)
  * tpm2: Fix public key context save due to ANY_OBJECT_Marshal usage
  * tpm2: Address some Coverity issues (false positives)
  * tpm1.2: Backported ASAN/UBSAN related fixes
  * tpm2: Return properly sized array for b parameter for NIST P521
    (HLK)
  * tpm2: Addressed issues detected by UBSAN
  * tpm2: Addressed issues detected by cppcheck (false positives)</changelog>
  <changelog author="glin@suse.com" date="1618833600">- Update to version 0.8.2
  * NOTE: Downgrade to 0.7.x or below is not possible.
    Due to fixes in the TPM 2 prime number generation code in
    rev155 it is not possible to downgrade from libtpms version
    0.8.0 to some previous version. The seeds are now associated
    with an age so that older seeds use the old TPM 2 prime number
    generation code while newer seed use the newer code.
  * tpm2: rev155: Add new RsaAdjustPrimeCandidate code but do
    not use (bsc#1184939 CVE-2021-3505)
  * tpm2: Activate SEED_COMPAT_LEVEL_RSA_PRIME_ADJUST_FIX
    (bsc#1184939 CVE-2021-3505)
  * Update to TPM 2 code release 159
  - X509 support is enabled
    + SM2 signing of ceritificates is NOT supported
  - Authenticated timers are disabled
  * Update to TPM 2 code relase 162
  - ECC encryption / decryption is disabled
  * Fix support for elliptic curve due to missing unmarshalling
    code
  * Runtime filter supported elliptic curves supported by OpenSSL
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rather than
    max
  * Fixes to symmetric decryption related to input size check,
    defer padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)]
    and to always use a temporary malloc'ed buffer for decryption
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest swtpm for test cases to succeed there.</changelog>
  <changelog author="pgajdos@suse.com" date="1630411200">- security update
- added patches
  fix CVE-2021-3746 [bsc#1189935], out-of-bounds access via specially crafted TPM 2 command packets
  + libtpms-CVE-2021-3746.patch</changelog>
  <changelog author="meissner@suse.com" date="1666353600">- Added patches:
  0001-tpm2-Reset-TPM2B-buffer-sizes-after-test-fails-for-v.patch
  0002-tpm2-Add-maxSize-parameter-to-TPM2B_Marshal-for-sani.patch
  0003-tpm2-Restore-original-value-if-unmarsalled-value-was.patch
- CVE-2021-3623: Fixed out-of-bounds access when trying to resume the
  state of the vTPM (bsc#1187767)</changelog>
  <changelog author="pgajdos@suse.com" date="1669377600">- fix build for ppc64le: use -Wl,--no-as-needed in check-local
  [bsc#1204556]</changelog>
</package>
<package pkgid="915dea35ee1551c327212daf75ada2bd9e58cf45710f427bf65109c772a06eca" name="libtss2-esys0" arch="aarch64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="4eef6318b9a4e0484da1b1f511cc9791506202c2232636d77d0b87724ca5189f" name="libtss2-esys0" arch="x86_64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="4d67794a3c360b4be3be89d6c1a8e356624d4a7012871b9e7296c64c4790d2d1" name="libtss2-fapi1" arch="aarch64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="05a624eeca14a6e7d5c8cce1dc45d68d7f60162d81ef1817cdaea26ee741f09b" name="libtss2-fapi1" arch="x86_64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="690f82d3e3e9b1f059dad427871fd0fededf5bfe75c7f8aef720cb227e78df56" name="libtss2-mu0" arch="aarch64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="babf0cef0359ec2cb965c18090e8176efddcc5ae37989967bd73756b0e73749e" name="libtss2-mu0" arch="x86_64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="e4a78e92ff2c36d024aa4bdad3ab9a4241b180f7783b2fa6e46def96d1ed574c" name="libtss2-rc0" arch="aarch64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="3f905239a7e540c70148c1843f99c2916bb907262c86dd9d7f97d3aaf5c33649" name="libtss2-rc0" arch="x86_64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="5eddb2f7d2c6ed36febf160175aa40489d71378706d360e147bb5df5f5954a40" name="libtss2-sys1" arch="aarch64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="8eedc128e7b588f8d3896af18acfcc07da55c46441a64d8ffd35caef4248e19c" name="libtss2-sys1" arch="x86_64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="df3225b69fa9de23d5abc37991036ae8e86eade417dc64aef02a317acc1fe94b" name="libtss2-tcti-device0" arch="aarch64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="3ffc019227abbaa30dfe5c1a9c92e64ef0c4988df0edbdafe4523840dcba55f9" name="libtss2-tcti-device0" arch="x86_64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="11c194e32bf5d48d92315af9924b70b2be67a58b629cf12f1fe8f82ba1906f9c" name="libtss2-tctildr0" arch="aarch64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="6875658d503e8c6c115f4ea8b9a7f792aaf17276abd525185b97eea6fde9cd83" name="libtss2-tctildr0" arch="x86_64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="319af367a980b3675cf89d9a2f0f160910da9979459f104d6ff23d9aa153eab2" name="libudev1" arch="aarch64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="47434f3c14363d305f2b03490558e25d23ed51a21f8c572f43ff31491b212bb4" name="libudev1" arch="x86_64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="a13486ac888ae7d547874184e58e129eb44948a9d3efd3b641bb9d32cf9b9651" name="libudev1" arch="aarch64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="8aaa0ad7fdbf6f84c0838abe6812eae745cd6dd91c4b89e2759a4841da8d9987" name="libudev1" arch="x86_64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="a7c36383893b503718d202249733f207e660bb9c9060c6f354504de207e5a501" name="libudev1" arch="aarch64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="8c643fcd6ba896f28be8d9b451ec0b496a989ae37631cbd3668a1183013d921a" name="libudev1" arch="x86_64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="652953435cc055fbda527eb383a1c353da64334770b31a2ec5c1f04774517fea" name="libuuid1" arch="aarch64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="3ee84335d4e475ec42de6867042990beb77d828b97897e06c85539b125fde9f7" name="libuuid1" arch="x86_64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="80e694c9dcc8f03f9b1a2c64effae79ce04c43f43d8a9b875d60dbee4297ab1f" name="libvmtools0" arch="x86_64">
  <version epoch="0" ver="12.1.0" rel="150300.21.2"/>
  <changelog author="kallan@suse.com" date="1583496000">- Update to 11.0.5 (build 15389592) (boo#1165955)
  + DNS server is reported incorrectly as '127.0.0.53' when using
    systemd-resolved. DNS server is reported incorrectly in GuestInfo as
    '127.0.0.53' , when the OS uses systemd-resolved. This issue is fixed
    in this release.
- Conditionalized the use of systemd_ordering.  Use systemd_ordering
  for factory, openSUSE &gt;= 15, and SLE &gt;= 15.  Use systemd_requires
  for older openSUSE and SLE releases.
- Conditionalize out the use of %license COPYING for SLE 12 SP2 and older.
- Added patches
  + gcc10-warning.patch (boo#1160408)
  + diskinfo-debug-logging-1162435.patch (boo#1162435 and bsc#1162119)
  - Changed g_warning to g_debug
  + app_info_plugin.patch (boo#1165955)
- Drop unnecessary patch:
  - fix-leaks-Aliases-MappedAliases.patch</changelog>
  <changelog author="kallan@suse.com" date="1583755200">- Simplified the conditional around systemd_ordering to just use
  suse_version &gt;= 1500.</changelog>
  <changelog author="kallan@suse.com" date="1589544000">- Update to 11.1.0 (build 16036546) (boo#1171764, boo#1171765)
  + open-vm-tools 11.1.0 includes a new 'Service Discovery' plugin, which
    connects with the vRealize Operations Manager product.  For more
    information and details on configuring this plugin, refer to Configuring
    Service Discovery.
  + In this release, a new tools.conf switch is added to enable and disable
    the guest customization in the guest virtual machine. By default, the
    guest customization is enabled. For more details, refer KB 78903.
- Spec file changes to remove the is_opensuse macros where possible.
- Remoed the mv vm-support line from the spec file.  vm-support is now
  automatically placed in the /usr/bin directory.
- Added version number to Requires: libxmlsec1-openssl1 to help with vgauth
  version checking.
- Added patches
  + pam-vmtoolsd.patch (boo#1171003)
- Drop unnecessary patch:
  - app_info_plugin.patch
  - diskinfo-debug-logging-1162435.patch
  - gcc9-static-inline.patch</changelog>
  <changelog author="kallan@suse.com" date="1590667200">- While updating to 11.1.0 (build 16036546) (boo#1171764) hold off on
  producing the open-vm-tools-sdmp (boo#1171765 Service Discover plugin)
  until it has gone through the ECO process.  Once approved, will resubmit
  to include the plugin.</changelog>
  <changelog author="kallan@suse.com" date="1591185600">- VMware has now asked that in updating to 11.1.0 (build 16036546) (boo#1171764)
  to hold off on producing the open-vm-tools-sdmp service discovery plugin
  (boo#1171765) for all SUSE versions due to the plugin's dependency on
  netstat.  Once they have removed the netstat dependency we will need to go
  through the ECO process to get the plugin added.</changelog>
  <changelog author="kallan@suse.com" date="1592395200">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
- Fixed bug (bsc#1172693) by removing the 'pam_securetty.so' line from
  pam-vmtoolsd.patch as instructed by vmware (boo#1171003).
  This should fix both (boo#1171003) and (bsc#1172693).</changelog>
  <changelog author="kallan@suse.com" date="1592481600">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
  with new 'Service Discovery' plugin (boo#1171765).
- Reenabled building sdmp in the spec file.
- Added patches (boo#1171765)
  + sdmp-get-version.patch
  + sdmp-netstat-to-ss.patch
  + sdmp-warnings.patch</changelog>
  <changelog author="kallan@suse.com" date="1598616000">- Update to 11.1.5 (build 16724464) (boo#1175573)
  + This source release rolls up the SDMP fixes release post 11.1.0.
  + Fix serveral Coverity reported issues.
  + Address github issues:
    https://github.com/vmware/open-vm-tools/issues/451
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/issues/428
- Drop unnecessary patch:
  - gcc10-warning.patch
  - sdmp-get-version.patch
  - sdmp-netstat-to-ss.patch
  - sdmp-warnings.patch</changelog>
  <changelog author="schwab@suse.de" date="1599480000">- Use libtirpc also in SLE-15-SP3</changelog>
  <changelog author="kallan@suse.com" date="1603281600">- Update to 11.2.0 (build 16938113) (boo#1177987)
  + Fixed memory leak occurs in disk device mapping information for IDE,
    SATA or SAS (LSI Logic SAS) disks configured in the guest.
  + The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/pull/431
    https://github.com/vmware/open-vm-tools/pull/432
    https://github.com/vmware/open-vm-tools/issues/452
  + A number of Coverity reported errors and false positives have been
    addressed.
  + A complete list of the granular changes that are in the open-vm-tools
    11.2.0 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.0/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch (boo#1177987): removed the pam_securetty.so line
  from the new suse file.  Modified the Makefile.am to copy the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1604923200">- Add explicit pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: used
  to be pulled in (as part of gdk-pixbuf) by GTK3 in the past. But
  as configure explicitly looks for it, it is our own duty to
  ensure its presence.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1606910400">- Enable build on aarch64</changelog>
  <changelog author="kallan@suse.com" date="1611230400">- Update to 11.2.5 (build 17337674) (boo#1180997)
  + Resolved issues:
  - The SUSE specific vmtoolsd PAM configuration file incorrectly referenced
    pam_securetty.so.
  - The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/467
    https://github.com/vmware/open-vm-tools/issues/468
    https://github.com/vmware/open-vm-tools/pull/469
  - A number of Coverity reported errors and false positives have been
    addressed.
  - A complete list of the granular changes that are in the
    open-vm-tools 11.2.5 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.5/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch: With the pam_securetty.so entry fixed, only need
  the modified Makefile.am portion of the patch which copies the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="lnussel@suse.de" date="1615809600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="dimstar@opensuse.org" date="1616760000">- Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67.
  Patch has been borrowed by Fedora, upstream is still busy working
  out a patch (I'd not be surprised if they end up merging this
  finally.
  https://github.com/vmware/open-vm-tools/issues/500</changelog>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
</package>
<package pkgid="13ccdef28f08aa7c0643c4dcc71f024e8fa4e162645b109ae655f941cb2ef359" name="libxml2-2" arch="aarch64">
  <version epoch="0" ver="2.9.14" rel="150400.5.13.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1584360000">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Revert upstream commit 5a02583c7e683896d84878bd90641d8d9b0d0549
  * Add patch libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="code@bnavigator.de" date="1603454400">- Make python subpackage ready for multiple python3 flavors
  gh#openSUSE/python-rpm-macros#66</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1608206400">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="wicked@iki.fi" date="1614081600">- Fails to build against Python 3.9:
  * Add upstream commit that fixes the issue
    https://github.com/GNOME/libxml2/commit/e4fb36841800038c289997432ca547c9bfef9db1
- Add patch libxml2-python39.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="2f7a36a5d6319c7edb216c44be3e136d9b032a146fd6bd800ecb18c82d70a65a" name="libxml2-2" arch="x86_64">
  <version epoch="0" ver="2.9.14" rel="150400.5.13.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1584360000">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Revert upstream commit 5a02583c7e683896d84878bd90641d8d9b0d0549
  * Add patch libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="code@bnavigator.de" date="1603454400">- Make python subpackage ready for multiple python3 flavors
  gh#openSUSE/python-rpm-macros#66</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1608206400">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="wicked@iki.fi" date="1614081600">- Fails to build against Python 3.9:
  * Add upstream commit that fixes the issue
    https://github.com/GNOME/libxml2/commit/e4fb36841800038c289997432ca547c9bfef9db1
- Add patch libxml2-python39.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="68f0b7f8feb2fba9fdc120ae812f0708763d955efc13178a03c64ed3c4eb638b" name="libxml2" arch="src">
  <version epoch="0" ver="2.9.14" rel="150400.5.13.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1584360000">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Revert upstream commit 5a02583c7e683896d84878bd90641d8d9b0d0549
  * Add patch libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="code@bnavigator.de" date="1603454400">- Make python subpackage ready for multiple python3 flavors
  gh#openSUSE/python-rpm-macros#66</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1608206400">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="wicked@iki.fi" date="1614081600">- Fails to build against Python 3.9:
  * Add upstream commit that fixes the issue
    https://github.com/GNOME/libxml2/commit/e4fb36841800038c289997432ca547c9bfef9db1
- Add patch libxml2-python39.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="061dedb26f11f80e4fd1cc7f3dc52c01c895e8cffef7de64fdcc2157b660ab2d" name="libxml2-python" arch="src">
  <version epoch="0" ver="2.9.14" rel="150400.5.13.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1584360000">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Revert upstream commit 5a02583c7e683896d84878bd90641d8d9b0d0549
  * Add patch libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="code@bnavigator.de" date="1603454400">- Make python subpackage ready for multiple python3 flavors
  gh#openSUSE/python-rpm-macros#66</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1608206400">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="wicked@iki.fi" date="1614081600">- Fails to build against Python 3.9:
  * Add upstream commit that fixes the issue
    https://github.com/GNOME/libxml2/commit/e4fb36841800038c289997432ca547c9bfef9db1
- Add patch libxml2-python39.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="044965eb3a55a6851955cd409a708b38561feeade38f2a9bf3b340d27445ca05" name="libxml2-tools" arch="aarch64">
  <version epoch="0" ver="2.9.14" rel="150400.5.13.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1584360000">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Revert upstream commit 5a02583c7e683896d84878bd90641d8d9b0d0549
  * Add patch libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="code@bnavigator.de" date="1603454400">- Make python subpackage ready for multiple python3 flavors
  gh#openSUSE/python-rpm-macros#66</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1608206400">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="wicked@iki.fi" date="1614081600">- Fails to build against Python 3.9:
  * Add upstream commit that fixes the issue
    https://github.com/GNOME/libxml2/commit/e4fb36841800038c289997432ca547c9bfef9db1
- Add patch libxml2-python39.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="e412f74c2b48fe756d980ed041ab0505a4363220564d78098a23df4d431578dc" name="libxml2-tools" arch="x86_64">
  <version epoch="0" ver="2.9.14" rel="150400.5.13.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1584360000">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Revert upstream commit 5a02583c7e683896d84878bd90641d8d9b0d0549
  * Add patch libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="code@bnavigator.de" date="1603454400">- Make python subpackage ready for multiple python3 flavors
  gh#openSUSE/python-rpm-macros#66</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1608206400">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="wicked@iki.fi" date="1614081600">- Fails to build against Python 3.9:
  * Add upstream commit that fixes the issue
    https://github.com/GNOME/libxml2/commit/e4fb36841800038c289997432ca547c9bfef9db1
- Add patch libxml2-python39.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="d522789f727f7ab79a2d1b482ac5cf9785f2d5af933bfa8fe32129836e272c91" name="libxslt" arch="src">
  <version epoch="0" ver="1.1.34" rel="150400.3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1465646400">- Update to 1.1.29:
  * new release after 4 years with few bugfies all around
- Refresh patch 0009-Make-generate-id-deterministic.patch to apply
- Remove cve patch that was integrated upstream:
  libxslt-1.1.28-type_confusion_preprocess_attr.patch
- Unpack the manpage as the compression is set by buildbot not always gz</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1489406400">- Added patch libxslt-CVE-2016-4738.patch
  * Fix heap overread in xsltFormatNumberConversion: An empty
    decimal-separator could cause a heap overread. This can be
    exploited to leak a couple of bytes after the buffer that holds
    the pattern string.
  * bsc#1005591 CVE-2016-4738</changelog>
  <changelog author="pgajdos@suse.com" date="1491393600">- security update: initialize random generator, CVE-2015-9019
  [bsc#934119]
  + libxslt-random-seed.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493121600">- Fixed CVE-2017-5029 bcs#1035905
  * Limit buffer size in xsltAddTextString to INT_MAX
- Added patch libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1501243200">- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Fix RPM groups. Drop ineffective --with-pic.
  Trim conjecture from description.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1508414400">- Update to version 1.1.30 [bsc#1063934]
  * Documentation:
  - Misc doc fixes
  * Portability:
  - Look for libxml2 via pkg-config first
  * Bug Fixes:
  - Also fix memory hazards in exsltFuncResultElem
  - Fix NULL deref in xsltDefaultSortFunction
  - Fix memory hazards in exsltFuncFunctionFunction
  - Fix memory leaks in EXSLT error paths
  - Fix memory leak in str:concat with empty node-set
  - Fix memory leaks in error paths
  - Switch to xmlUTF8Strsize in numbers.c
  - Fix NULL pointer deref in xsltFormatNumberFunction
  - Fix UTF-8 check in str:padding
  - Fix xmlStrPrintf argument
  - Check for overflow in _exsltDateParseGYear
  - Fix double to int conversion
  - Check for overflow in exsltDateParseDuration
  - Change version of xsltMaxVars back to 1.0.24
  - Disable xsltCopyTextString optimization for extensions
  - Create DOCTYPE for HTML version 5
  - Make xsl:decimal-format work with namespaces
  - Remove norm:localTime extension function
  - Check for integer overflow in xsltAddTextString
  - Detect infinite recursion when evaluating function arguments
  - Fix memory leak in xsltElementAvailableFunction
  - Fix for pattern predicates calling functions
  - Fix cmd.exe invocations in Makefile.mingw
  - Don't try to install index.sgml
  - Fix symbols.xml
  - Fix heap overread in xsltFormatNumberConversion
  - Fix &lt;xsl:number level="any"/&gt; for non-element nodes
  - Fix unreachable code in xsltAddChild
  - Change version number in xsl:version warning
  - Avoid infinite recursion after failed param evaluation
  - Stop if potential recursion is detected
  - Consider built-in templates in apply-imports
  - Fix precedence with multiple attribute sets
  - Rework attribute set resolution
  * Improvements:
  - Silence tests a little
  - Set LIBXML_SRC to absolute path
  - Add missing #include
  - Adjust expected error messages in tests
  - Make xsltDebug more quiet
  - New-line terminate error message that missed this convention
  - Use xmlBuffers in EXSLT string functions
  - Switch to xmlUTF8Strsize in EXSLT string functions
  - Check for return value of xmlUTF8Strlen
  - Avoid double/long round trip in FORMAT_ITEM
  - Separate date and duration structs
  - Check for overflow in _exsltDateDifference
  - Clamp seconds field of durations
  - Change _exsltDateAddDurCalc parameter types
  - Fix date:difference with time zones
  - Rework division/remainder arithmetic in date.c
  - Remove exsltDateCastDateToNumber
  - Change internal representation of years
  - Optimize IS_LEAP
  - Link libraries with libm
  - Rename xsltCopyTreeInternal to xsltCopyTree
  - Update linker version script
  - Add local wildcard to version script
  - Make some symbols static
  - Remove redundant NULL check in xsltNumberComp
  - Fix forwards compatibility for imported stylesheets
  - Reduce warnings in forwards-compatible mode
  - Precompute XSLT elements after preprocessing
  - Fix whitespace in xsltParseStylesheetTop
  - Consolidate recursion checks
  - Treat XSLT_STATE_STOPPED same as errors
  - Make sure that XSLT_STATE_STOPPED isn't overwritten
  - Add comment regarding built-in templates and params
  - Rewrite memory management of local RVTs
  - Validate QNames of attribute sets
  - Add xsl:attribute-set regression tests
  - Ignore imported stylesheets in xsltApplyAttributeSet
- Dropped patches fixed upstream
  * libxslt-CVE-2016-4738.patch
  * libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="vcizek@suse.com" date="1510142400">- Update to version 1.1.32
  * fixes xml-config detection regression (boo#1066525)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1551700800">- Update to version 1.1.33
  * Portability:
  - Variables need 'extern' in static lib on Cygwin
  - Really declare dllexport/dllimport for Cygwin
  - Fix callback signatures in Python bindings
  - Fix transform callback signatures
  - Fix extension callback signatures
  - Fix deallocator signatures
  - Fix XPath callback signatures
  - Fix hash callback signatures
  * Bug Fixes:
  - Don't cache direct evaluation of patterns with variables
  - Move function result RVTs to context variable
  - Fix EXSLT functions returning RVTs from outer scopes
  - Fix handling of RVTs returned from nested EXSLT functions
  - Fix typos
  * Improvements:
  - Run Travis ASan tests with "sudo: required"
  * Cleanups:
  - Remove doc/libxslt-decl.txt
  - Docs for 1.1.32 release
- Cleaned with spec-cleaner</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554984000">- Security fix: [bsc#1132160, CVE-2019-11068]
  * Bypass of a protection mechanism because callers of xsltCheckRead
    and xsltCheckWrite permit access even upon receiving a -1 error
    code. xsltCheckRead can return -1 for a crafted URL that is not
    actually invalid and is subsequently loaded.
  * Added libxslt-CVE-2019-11068.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix: [bsc#1140095, CVE-2019-13117]
  * Fix uninitialized read of xsl:number token. An xsl number with
    certain format strings could lead to a uninitialized read in
    xsltNumberFormatInsertNumbers
  * Added libxslt-CVE-2019-13117.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068801">- Security fix: [bsc#1140101, CVE-2019-13118]
  * Fix uninitialized read with UTF-8 grouping chars. Read of
    uninitialized stack data due to too narrow xsl:number
    instruction and an invalid character
  * Added libxslt-CVE-2019-13118.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1569931200">- Drop out lilbxslt-python package as it is just py2 based and
  upstream yet didn't bother to port it to python3.
  When there is python3 compatible code it should be enabled as
  multibuild here
  * Drop now unused libxslt-1.1.24-linkflags.patch and
    libxslt-do_not_build_doc_nor_xsltproc.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571659200">- Security fix [bsc#1154609, CVE-2019-18197]
  * Fix dangling pointer in xsltCopyText
  * Add libxslt-CVE-2019-18197.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1574251200">- Update to 1.1.34: Oct 30 2019
  * Documentation:
  - Fix EXSLT web pages, Regenerate web pages
  - Fix Git link in news.html
  - Minor documentation fixes after recent changes
  - Regenerate symbols and API docs
  - Regenerate EXSLT website
  * Portability:
  - Remove stubs when compiling without debugger or profiler
  - configure.ac: Invoke PKG_CHECK_MODULES for building shared libraries
  - configure.ac: Conditionally determine whether xml2-config should pass
    shared libraries or static libraries
  - xslt-config.in: Fix broken --prefix=DIR support
  - libexslt.pc.in: Do not expose private library dependencies unless invoked
  - libxslt.pc.in: Do not expose private library dependencies unless invoked
  - Fix -Wformat-overflow warning (GCC 9)
  - Stop including ansidecl.h
  - Remove WIN32_EXTRA_* variables
  - Build without winsock
  * Bug Fixes:
  - xsl:template without name and match attributes should not be allowed
  - Make sure that Python tests exit with error code
  - Improve handling of invalid UTF-8 in format-number
  - Fix dangling pointer in xsltCopyText
  - Fix memory leak in pattern compilation error path
  - Fix uninitialized read with UTF-8 grouping chars
  - Fix integer overflow in FORMAT_GYEAR
  - Fix performance regression with xsl:number
  - Backup XPath context node in xsltInitCtxtKey
  - Fix unsigned integer overflow in date.c
  - Fix insertion of xsl:fallback content
  - Avoid quadratic behavior in xsltSaveResultTo
  - Fix numbering in non-Latin scripts
  - Fix uninitialized read of xsl:number token
  - Fix integer overflow in _exsltDateDayInWeek
  - Rework xsltAttrVT allocation
  - Fix check of xsltTestCompMatch return value
  - Fix security framework bypass
  - Use xmlNewTextChild in EXSLT dyn:map
  - Fix float casts in exsltDateDuration
  - Always set context node before calling XPath iterators
  - Fix attribute precedence with xsl:use-attribute-sets
  - Backup context node in exsltFuncFunctionFunction
  - Initialize ctxt-&gt;output before evaluating global vars
  - Fix memory leak in EXSLT functions error path
  * Improvements:
  - Fix -Wimplicit-fallthrough warnings
  - Adjust number of API index pages
  - Make xsltCompileRelativePathPattern non-recursive
  - Check that crypto:rc4_decrypt produces valid UTF-8
  - Avoid recursion in keys.c:skipPredicate
  - xslt-config.in: Simply handling of $all_flags
  - xslt-config.in: Add a --dynamic option to --libs
  - xslt-config.in: Simplify basic library handling
  - xslt-config.in: Remove unused variable
  - xslt-config: Simply handling of --cflags
  - Improve fuzzers
  - Always reuse XPath context
  - Compile with -Wextra
  - Make profiler support optional
  - Hide unused code when compiling without debugger
  - Reorganize fuzzing code
  - Optional operation limit
  - Improve seed corpus and dictionary
  - Reuse XPath context when compiling stylesheets
  - Reuse XPath context in dyn:map
  - Reuse XPath context in saxon:expression
  - Add libFuzzer targets
  - Adjust error message in expected test output
  - Change bug tracker URL
  - Change git repo URL
  - Regenerate NEWS
  - Fix misleading indentation in security.c
  * Cleanups:
  - Remove empty TODO file
  - Remove generated file libxsltclass.txt from version control
  - Rebuild docs
- Rebase patch libxslt-config-fixes.patch
- Remove patches fixed upstream:
  * libxslt-CVE-2019-11068.patch
  * libxslt-CVE-2019-13117.patch
  * libxslt-CVE-2019-13118.patch
  * libxslt-CVE-2019-18197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Fix build with libxml2 2.9.12 that removes maxParserDepth XPath limit
- Add upstream patches:
  * libxslt-Stop-using-maxParserDepth-XPath-limit.patch
  * libxslt-Do-not-set-maxDepth-in-XPath-contexts.patch</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Move the Copyright file to %_defaultlicensedir
  Configure.ac replaces the COPYING file with a symlink.</changelog>
  <changelog author="schwab@suse.de" date="1623067200">- Don't disable testsuite under QEMU</changelog>
  <changelog author="pvorel@suse.cz" date="1623326400">- Backport upstream xsltproc manpage fix
  f165525f Recreate xsltproc man page with old Docbook stylesheet URL
  Recreate-xsltproc-man-page-with-old-Docbook-styleshe.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1677067200">- Security Fix: [bsc#1208574, CVE-2021-30560]
  * Use after free in Blink XSLT
  * Add libxslt-CVE-2021-30560.patch</changelog>
</package>
<package pkgid="486e8798a851025dccb0d3d6e07e2eb3129a99eb5b9273c272e3b43f8624108e" name="libxslt1" arch="aarch64">
  <version epoch="0" ver="1.1.34" rel="150400.3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1465646400">- Update to 1.1.29:
  * new release after 4 years with few bugfies all around
- Refresh patch 0009-Make-generate-id-deterministic.patch to apply
- Remove cve patch that was integrated upstream:
  libxslt-1.1.28-type_confusion_preprocess_attr.patch
- Unpack the manpage as the compression is set by buildbot not always gz</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1489406400">- Added patch libxslt-CVE-2016-4738.patch
  * Fix heap overread in xsltFormatNumberConversion: An empty
    decimal-separator could cause a heap overread. This can be
    exploited to leak a couple of bytes after the buffer that holds
    the pattern string.
  * bsc#1005591 CVE-2016-4738</changelog>
  <changelog author="pgajdos@suse.com" date="1491393600">- security update: initialize random generator, CVE-2015-9019
  [bsc#934119]
  + libxslt-random-seed.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493121600">- Fixed CVE-2017-5029 bcs#1035905
  * Limit buffer size in xsltAddTextString to INT_MAX
- Added patch libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1501243200">- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Fix RPM groups. Drop ineffective --with-pic.
  Trim conjecture from description.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1508414400">- Update to version 1.1.30 [bsc#1063934]
  * Documentation:
  - Misc doc fixes
  * Portability:
  - Look for libxml2 via pkg-config first
  * Bug Fixes:
  - Also fix memory hazards in exsltFuncResultElem
  - Fix NULL deref in xsltDefaultSortFunction
  - Fix memory hazards in exsltFuncFunctionFunction
  - Fix memory leaks in EXSLT error paths
  - Fix memory leak in str:concat with empty node-set
  - Fix memory leaks in error paths
  - Switch to xmlUTF8Strsize in numbers.c
  - Fix NULL pointer deref in xsltFormatNumberFunction
  - Fix UTF-8 check in str:padding
  - Fix xmlStrPrintf argument
  - Check for overflow in _exsltDateParseGYear
  - Fix double to int conversion
  - Check for overflow in exsltDateParseDuration
  - Change version of xsltMaxVars back to 1.0.24
  - Disable xsltCopyTextString optimization for extensions
  - Create DOCTYPE for HTML version 5
  - Make xsl:decimal-format work with namespaces
  - Remove norm:localTime extension function
  - Check for integer overflow in xsltAddTextString
  - Detect infinite recursion when evaluating function arguments
  - Fix memory leak in xsltElementAvailableFunction
  - Fix for pattern predicates calling functions
  - Fix cmd.exe invocations in Makefile.mingw
  - Don't try to install index.sgml
  - Fix symbols.xml
  - Fix heap overread in xsltFormatNumberConversion
  - Fix &lt;xsl:number level="any"/&gt; for non-element nodes
  - Fix unreachable code in xsltAddChild
  - Change version number in xsl:version warning
  - Avoid infinite recursion after failed param evaluation
  - Stop if potential recursion is detected
  - Consider built-in templates in apply-imports
  - Fix precedence with multiple attribute sets
  - Rework attribute set resolution
  * Improvements:
  - Silence tests a little
  - Set LIBXML_SRC to absolute path
  - Add missing #include
  - Adjust expected error messages in tests
  - Make xsltDebug more quiet
  - New-line terminate error message that missed this convention
  - Use xmlBuffers in EXSLT string functions
  - Switch to xmlUTF8Strsize in EXSLT string functions
  - Check for return value of xmlUTF8Strlen
  - Avoid double/long round trip in FORMAT_ITEM
  - Separate date and duration structs
  - Check for overflow in _exsltDateDifference
  - Clamp seconds field of durations
  - Change _exsltDateAddDurCalc parameter types
  - Fix date:difference with time zones
  - Rework division/remainder arithmetic in date.c
  - Remove exsltDateCastDateToNumber
  - Change internal representation of years
  - Optimize IS_LEAP
  - Link libraries with libm
  - Rename xsltCopyTreeInternal to xsltCopyTree
  - Update linker version script
  - Add local wildcard to version script
  - Make some symbols static
  - Remove redundant NULL check in xsltNumberComp
  - Fix forwards compatibility for imported stylesheets
  - Reduce warnings in forwards-compatible mode
  - Precompute XSLT elements after preprocessing
  - Fix whitespace in xsltParseStylesheetTop
  - Consolidate recursion checks
  - Treat XSLT_STATE_STOPPED same as errors
  - Make sure that XSLT_STATE_STOPPED isn't overwritten
  - Add comment regarding built-in templates and params
  - Rewrite memory management of local RVTs
  - Validate QNames of attribute sets
  - Add xsl:attribute-set regression tests
  - Ignore imported stylesheets in xsltApplyAttributeSet
- Dropped patches fixed upstream
  * libxslt-CVE-2016-4738.patch
  * libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="vcizek@suse.com" date="1510142400">- Update to version 1.1.32
  * fixes xml-config detection regression (boo#1066525)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1551700800">- Update to version 1.1.33
  * Portability:
  - Variables need 'extern' in static lib on Cygwin
  - Really declare dllexport/dllimport for Cygwin
  - Fix callback signatures in Python bindings
  - Fix transform callback signatures
  - Fix extension callback signatures
  - Fix deallocator signatures
  - Fix XPath callback signatures
  - Fix hash callback signatures
  * Bug Fixes:
  - Don't cache direct evaluation of patterns with variables
  - Move function result RVTs to context variable
  - Fix EXSLT functions returning RVTs from outer scopes
  - Fix handling of RVTs returned from nested EXSLT functions
  - Fix typos
  * Improvements:
  - Run Travis ASan tests with "sudo: required"
  * Cleanups:
  - Remove doc/libxslt-decl.txt
  - Docs for 1.1.32 release
- Cleaned with spec-cleaner</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554984000">- Security fix: [bsc#1132160, CVE-2019-11068]
  * Bypass of a protection mechanism because callers of xsltCheckRead
    and xsltCheckWrite permit access even upon receiving a -1 error
    code. xsltCheckRead can return -1 for a crafted URL that is not
    actually invalid and is subsequently loaded.
  * Added libxslt-CVE-2019-11068.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix: [bsc#1140095, CVE-2019-13117]
  * Fix uninitialized read of xsl:number token. An xsl number with
    certain format strings could lead to a uninitialized read in
    xsltNumberFormatInsertNumbers
  * Added libxslt-CVE-2019-13117.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068801">- Security fix: [bsc#1140101, CVE-2019-13118]
  * Fix uninitialized read with UTF-8 grouping chars. Read of
    uninitialized stack data due to too narrow xsl:number
    instruction and an invalid character
  * Added libxslt-CVE-2019-13118.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1569931200">- Drop out lilbxslt-python package as it is just py2 based and
  upstream yet didn't bother to port it to python3.
  When there is python3 compatible code it should be enabled as
  multibuild here
  * Drop now unused libxslt-1.1.24-linkflags.patch and
    libxslt-do_not_build_doc_nor_xsltproc.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571659200">- Security fix [bsc#1154609, CVE-2019-18197]
  * Fix dangling pointer in xsltCopyText
  * Add libxslt-CVE-2019-18197.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1574251200">- Update to 1.1.34: Oct 30 2019
  * Documentation:
  - Fix EXSLT web pages, Regenerate web pages
  - Fix Git link in news.html
  - Minor documentation fixes after recent changes
  - Regenerate symbols and API docs
  - Regenerate EXSLT website
  * Portability:
  - Remove stubs when compiling without debugger or profiler
  - configure.ac: Invoke PKG_CHECK_MODULES for building shared libraries
  - configure.ac: Conditionally determine whether xml2-config should pass
    shared libraries or static libraries
  - xslt-config.in: Fix broken --prefix=DIR support
  - libexslt.pc.in: Do not expose private library dependencies unless invoked
  - libxslt.pc.in: Do not expose private library dependencies unless invoked
  - Fix -Wformat-overflow warning (GCC 9)
  - Stop including ansidecl.h
  - Remove WIN32_EXTRA_* variables
  - Build without winsock
  * Bug Fixes:
  - xsl:template without name and match attributes should not be allowed
  - Make sure that Python tests exit with error code
  - Improve handling of invalid UTF-8 in format-number
  - Fix dangling pointer in xsltCopyText
  - Fix memory leak in pattern compilation error path
  - Fix uninitialized read with UTF-8 grouping chars
  - Fix integer overflow in FORMAT_GYEAR
  - Fix performance regression with xsl:number
  - Backup XPath context node in xsltInitCtxtKey
  - Fix unsigned integer overflow in date.c
  - Fix insertion of xsl:fallback content
  - Avoid quadratic behavior in xsltSaveResultTo
  - Fix numbering in non-Latin scripts
  - Fix uninitialized read of xsl:number token
  - Fix integer overflow in _exsltDateDayInWeek
  - Rework xsltAttrVT allocation
  - Fix check of xsltTestCompMatch return value
  - Fix security framework bypass
  - Use xmlNewTextChild in EXSLT dyn:map
  - Fix float casts in exsltDateDuration
  - Always set context node before calling XPath iterators
  - Fix attribute precedence with xsl:use-attribute-sets
  - Backup context node in exsltFuncFunctionFunction
  - Initialize ctxt-&gt;output before evaluating global vars
  - Fix memory leak in EXSLT functions error path
  * Improvements:
  - Fix -Wimplicit-fallthrough warnings
  - Adjust number of API index pages
  - Make xsltCompileRelativePathPattern non-recursive
  - Check that crypto:rc4_decrypt produces valid UTF-8
  - Avoid recursion in keys.c:skipPredicate
  - xslt-config.in: Simply handling of $all_flags
  - xslt-config.in: Add a --dynamic option to --libs
  - xslt-config.in: Simplify basic library handling
  - xslt-config.in: Remove unused variable
  - xslt-config: Simply handling of --cflags
  - Improve fuzzers
  - Always reuse XPath context
  - Compile with -Wextra
  - Make profiler support optional
  - Hide unused code when compiling without debugger
  - Reorganize fuzzing code
  - Optional operation limit
  - Improve seed corpus and dictionary
  - Reuse XPath context when compiling stylesheets
  - Reuse XPath context in dyn:map
  - Reuse XPath context in saxon:expression
  - Add libFuzzer targets
  - Adjust error message in expected test output
  - Change bug tracker URL
  - Change git repo URL
  - Regenerate NEWS
  - Fix misleading indentation in security.c
  * Cleanups:
  - Remove empty TODO file
  - Remove generated file libxsltclass.txt from version control
  - Rebuild docs
- Rebase patch libxslt-config-fixes.patch
- Remove patches fixed upstream:
  * libxslt-CVE-2019-11068.patch
  * libxslt-CVE-2019-13117.patch
  * libxslt-CVE-2019-13118.patch
  * libxslt-CVE-2019-18197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Fix build with libxml2 2.9.12 that removes maxParserDepth XPath limit
- Add upstream patches:
  * libxslt-Stop-using-maxParserDepth-XPath-limit.patch
  * libxslt-Do-not-set-maxDepth-in-XPath-contexts.patch</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Move the Copyright file to %_defaultlicensedir
  Configure.ac replaces the COPYING file with a symlink.</changelog>
  <changelog author="schwab@suse.de" date="1623067200">- Don't disable testsuite under QEMU</changelog>
  <changelog author="pvorel@suse.cz" date="1623326400">- Backport upstream xsltproc manpage fix
  f165525f Recreate xsltproc man page with old Docbook stylesheet URL
  Recreate-xsltproc-man-page-with-old-Docbook-styleshe.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1677067200">- Security Fix: [bsc#1208574, CVE-2021-30560]
  * Use after free in Blink XSLT
  * Add libxslt-CVE-2021-30560.patch</changelog>
</package>
<package pkgid="af7b407200073c7cc30015402a30f24f1e951f03c71b2d232f631120673e7e26" name="libxslt1" arch="x86_64">
  <version epoch="0" ver="1.1.34" rel="150400.3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1465646400">- Update to 1.1.29:
  * new release after 4 years with few bugfies all around
- Refresh patch 0009-Make-generate-id-deterministic.patch to apply
- Remove cve patch that was integrated upstream:
  libxslt-1.1.28-type_confusion_preprocess_attr.patch
- Unpack the manpage as the compression is set by buildbot not always gz</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1489406400">- Added patch libxslt-CVE-2016-4738.patch
  * Fix heap overread in xsltFormatNumberConversion: An empty
    decimal-separator could cause a heap overread. This can be
    exploited to leak a couple of bytes after the buffer that holds
    the pattern string.
  * bsc#1005591 CVE-2016-4738</changelog>
  <changelog author="pgajdos@suse.com" date="1491393600">- security update: initialize random generator, CVE-2015-9019
  [bsc#934119]
  + libxslt-random-seed.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493121600">- Fixed CVE-2017-5029 bcs#1035905
  * Limit buffer size in xsltAddTextString to INT_MAX
- Added patch libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1501243200">- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Fix RPM groups. Drop ineffective --with-pic.
  Trim conjecture from description.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1508414400">- Update to version 1.1.30 [bsc#1063934]
  * Documentation:
  - Misc doc fixes
  * Portability:
  - Look for libxml2 via pkg-config first
  * Bug Fixes:
  - Also fix memory hazards in exsltFuncResultElem
  - Fix NULL deref in xsltDefaultSortFunction
  - Fix memory hazards in exsltFuncFunctionFunction
  - Fix memory leaks in EXSLT error paths
  - Fix memory leak in str:concat with empty node-set
  - Fix memory leaks in error paths
  - Switch to xmlUTF8Strsize in numbers.c
  - Fix NULL pointer deref in xsltFormatNumberFunction
  - Fix UTF-8 check in str:padding
  - Fix xmlStrPrintf argument
  - Check for overflow in _exsltDateParseGYear
  - Fix double to int conversion
  - Check for overflow in exsltDateParseDuration
  - Change version of xsltMaxVars back to 1.0.24
  - Disable xsltCopyTextString optimization for extensions
  - Create DOCTYPE for HTML version 5
  - Make xsl:decimal-format work with namespaces
  - Remove norm:localTime extension function
  - Check for integer overflow in xsltAddTextString
  - Detect infinite recursion when evaluating function arguments
  - Fix memory leak in xsltElementAvailableFunction
  - Fix for pattern predicates calling functions
  - Fix cmd.exe invocations in Makefile.mingw
  - Don't try to install index.sgml
  - Fix symbols.xml
  - Fix heap overread in xsltFormatNumberConversion
  - Fix &lt;xsl:number level="any"/&gt; for non-element nodes
  - Fix unreachable code in xsltAddChild
  - Change version number in xsl:version warning
  - Avoid infinite recursion after failed param evaluation
  - Stop if potential recursion is detected
  - Consider built-in templates in apply-imports
  - Fix precedence with multiple attribute sets
  - Rework attribute set resolution
  * Improvements:
  - Silence tests a little
  - Set LIBXML_SRC to absolute path
  - Add missing #include
  - Adjust expected error messages in tests
  - Make xsltDebug more quiet
  - New-line terminate error message that missed this convention
  - Use xmlBuffers in EXSLT string functions
  - Switch to xmlUTF8Strsize in EXSLT string functions
  - Check for return value of xmlUTF8Strlen
  - Avoid double/long round trip in FORMAT_ITEM
  - Separate date and duration structs
  - Check for overflow in _exsltDateDifference
  - Clamp seconds field of durations
  - Change _exsltDateAddDurCalc parameter types
  - Fix date:difference with time zones
  - Rework division/remainder arithmetic in date.c
  - Remove exsltDateCastDateToNumber
  - Change internal representation of years
  - Optimize IS_LEAP
  - Link libraries with libm
  - Rename xsltCopyTreeInternal to xsltCopyTree
  - Update linker version script
  - Add local wildcard to version script
  - Make some symbols static
  - Remove redundant NULL check in xsltNumberComp
  - Fix forwards compatibility for imported stylesheets
  - Reduce warnings in forwards-compatible mode
  - Precompute XSLT elements after preprocessing
  - Fix whitespace in xsltParseStylesheetTop
  - Consolidate recursion checks
  - Treat XSLT_STATE_STOPPED same as errors
  - Make sure that XSLT_STATE_STOPPED isn't overwritten
  - Add comment regarding built-in templates and params
  - Rewrite memory management of local RVTs
  - Validate QNames of attribute sets
  - Add xsl:attribute-set regression tests
  - Ignore imported stylesheets in xsltApplyAttributeSet
- Dropped patches fixed upstream
  * libxslt-CVE-2016-4738.patch
  * libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="vcizek@suse.com" date="1510142400">- Update to version 1.1.32
  * fixes xml-config detection regression (boo#1066525)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1551700800">- Update to version 1.1.33
  * Portability:
  - Variables need 'extern' in static lib on Cygwin
  - Really declare dllexport/dllimport for Cygwin
  - Fix callback signatures in Python bindings
  - Fix transform callback signatures
  - Fix extension callback signatures
  - Fix deallocator signatures
  - Fix XPath callback signatures
  - Fix hash callback signatures
  * Bug Fixes:
  - Don't cache direct evaluation of patterns with variables
  - Move function result RVTs to context variable
  - Fix EXSLT functions returning RVTs from outer scopes
  - Fix handling of RVTs returned from nested EXSLT functions
  - Fix typos
  * Improvements:
  - Run Travis ASan tests with "sudo: required"
  * Cleanups:
  - Remove doc/libxslt-decl.txt
  - Docs for 1.1.32 release
- Cleaned with spec-cleaner</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554984000">- Security fix: [bsc#1132160, CVE-2019-11068]
  * Bypass of a protection mechanism because callers of xsltCheckRead
    and xsltCheckWrite permit access even upon receiving a -1 error
    code. xsltCheckRead can return -1 for a crafted URL that is not
    actually invalid and is subsequently loaded.
  * Added libxslt-CVE-2019-11068.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix: [bsc#1140095, CVE-2019-13117]
  * Fix uninitialized read of xsl:number token. An xsl number with
    certain format strings could lead to a uninitialized read in
    xsltNumberFormatInsertNumbers
  * Added libxslt-CVE-2019-13117.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068801">- Security fix: [bsc#1140101, CVE-2019-13118]
  * Fix uninitialized read with UTF-8 grouping chars. Read of
    uninitialized stack data due to too narrow xsl:number
    instruction and an invalid character
  * Added libxslt-CVE-2019-13118.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1569931200">- Drop out lilbxslt-python package as it is just py2 based and
  upstream yet didn't bother to port it to python3.
  When there is python3 compatible code it should be enabled as
  multibuild here
  * Drop now unused libxslt-1.1.24-linkflags.patch and
    libxslt-do_not_build_doc_nor_xsltproc.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571659200">- Security fix [bsc#1154609, CVE-2019-18197]
  * Fix dangling pointer in xsltCopyText
  * Add libxslt-CVE-2019-18197.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1574251200">- Update to 1.1.34: Oct 30 2019
  * Documentation:
  - Fix EXSLT web pages, Regenerate web pages
  - Fix Git link in news.html
  - Minor documentation fixes after recent changes
  - Regenerate symbols and API docs
  - Regenerate EXSLT website
  * Portability:
  - Remove stubs when compiling without debugger or profiler
  - configure.ac: Invoke PKG_CHECK_MODULES for building shared libraries
  - configure.ac: Conditionally determine whether xml2-config should pass
    shared libraries or static libraries
  - xslt-config.in: Fix broken --prefix=DIR support
  - libexslt.pc.in: Do not expose private library dependencies unless invoked
  - libxslt.pc.in: Do not expose private library dependencies unless invoked
  - Fix -Wformat-overflow warning (GCC 9)
  - Stop including ansidecl.h
  - Remove WIN32_EXTRA_* variables
  - Build without winsock
  * Bug Fixes:
  - xsl:template without name and match attributes should not be allowed
  - Make sure that Python tests exit with error code
  - Improve handling of invalid UTF-8 in format-number
  - Fix dangling pointer in xsltCopyText
  - Fix memory leak in pattern compilation error path
  - Fix uninitialized read with UTF-8 grouping chars
  - Fix integer overflow in FORMAT_GYEAR
  - Fix performance regression with xsl:number
  - Backup XPath context node in xsltInitCtxtKey
  - Fix unsigned integer overflow in date.c
  - Fix insertion of xsl:fallback content
  - Avoid quadratic behavior in xsltSaveResultTo
  - Fix numbering in non-Latin scripts
  - Fix uninitialized read of xsl:number token
  - Fix integer overflow in _exsltDateDayInWeek
  - Rework xsltAttrVT allocation
  - Fix check of xsltTestCompMatch return value
  - Fix security framework bypass
  - Use xmlNewTextChild in EXSLT dyn:map
  - Fix float casts in exsltDateDuration
  - Always set context node before calling XPath iterators
  - Fix attribute precedence with xsl:use-attribute-sets
  - Backup context node in exsltFuncFunctionFunction
  - Initialize ctxt-&gt;output before evaluating global vars
  - Fix memory leak in EXSLT functions error path
  * Improvements:
  - Fix -Wimplicit-fallthrough warnings
  - Adjust number of API index pages
  - Make xsltCompileRelativePathPattern non-recursive
  - Check that crypto:rc4_decrypt produces valid UTF-8
  - Avoid recursion in keys.c:skipPredicate
  - xslt-config.in: Simply handling of $all_flags
  - xslt-config.in: Add a --dynamic option to --libs
  - xslt-config.in: Simplify basic library handling
  - xslt-config.in: Remove unused variable
  - xslt-config: Simply handling of --cflags
  - Improve fuzzers
  - Always reuse XPath context
  - Compile with -Wextra
  - Make profiler support optional
  - Hide unused code when compiling without debugger
  - Reorganize fuzzing code
  - Optional operation limit
  - Improve seed corpus and dictionary
  - Reuse XPath context when compiling stylesheets
  - Reuse XPath context in dyn:map
  - Reuse XPath context in saxon:expression
  - Add libFuzzer targets
  - Adjust error message in expected test output
  - Change bug tracker URL
  - Change git repo URL
  - Regenerate NEWS
  - Fix misleading indentation in security.c
  * Cleanups:
  - Remove empty TODO file
  - Remove generated file libxsltclass.txt from version control
  - Rebuild docs
- Rebase patch libxslt-config-fixes.patch
- Remove patches fixed upstream:
  * libxslt-CVE-2019-11068.patch
  * libxslt-CVE-2019-13117.patch
  * libxslt-CVE-2019-13118.patch
  * libxslt-CVE-2019-18197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548800">- Fix build with libxml2 2.9.12 that removes maxParserDepth XPath limit
- Add upstream patches:
  * libxslt-Stop-using-maxParserDepth-XPath-limit.patch
  * libxslt-Do-not-set-maxDepth-in-XPath-contexts.patch</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Move the Copyright file to %_defaultlicensedir
  Configure.ac replaces the COPYING file with a symlink.</changelog>
  <changelog author="schwab@suse.de" date="1623067200">- Don't disable testsuite under QEMU</changelog>
  <changelog author="pvorel@suse.cz" date="1623326400">- Backport upstream xsltproc manpage fix
  f165525f Recreate xsltproc man page with old Docbook stylesheet URL
  Recreate-xsltproc-man-page-with-old-Docbook-styleshe.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1677067200">- Security Fix: [bsc#1208574, CVE-2021-30560]
  * Use after free in Blink XSLT
  * Add libxslt-CVE-2021-30560.patch</changelog>
</package>
<package pkgid="3338c12611b357bdf6e45928369913d78acdb2610b38c77019a025ae82647e89" name="libz1" arch="aarch64">
  <version epoch="0" ver="1.2.11" rel="150000.3.39.1"/>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Fix bsc#1203652, inflate() does not update strm.adler if DFLTCC is used
  * bsc1203652.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Follow up fix for bsc#1203652 due to libxml2 breakage
  * bsc1203652-2.patch</changelog>
</package>
<package pkgid="2ca875d8f93fb4732079933f8841b814954cf49c6fe976a37e2203fa175cb9a8" name="libz1" arch="x86_64">
  <version epoch="0" ver="1.2.11" rel="150000.3.39.1"/>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Fix bsc#1203652, inflate() does not update strm.adler if DFLTCC is used
  * bsc1203652.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Follow up fix for bsc#1203652 due to libxml2 breakage
  * bsc1203652-2.patch</changelog>
</package>
<package pkgid="ff012eb1aeca6df4c4f7e99fa50ccb97c7bed99a7b2a4583fbae7749e2d5d620" name="libzypp" arch="aarch64">
  <version epoch="0" ver="17.31.8" rel="150400.3.14.1"/>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
</package>
<package pkgid="af817989605dfd08b5bf27ef9ec6a5efd912e48f2d7ab1d3caae9a8290bf66de" name="libzypp" arch="src">
  <version epoch="0" ver="17.31.8" rel="150400.3.14.1"/>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
</package>
<package pkgid="494b975850adf72ebb6b9557750faf8d579f1ce0a66bdcae532fadbcadb86448" name="libzypp" arch="x86_64">
  <version epoch="0" ver="17.31.8" rel="150400.3.14.1"/>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1665748800">- Improve download of optional files (fixes #416)
- Do not use geoip rewrites if the repo has explicit country
  settings.
- Implement geoIP feature for zypp.
  This patch adds a feature to rewrite request URLs to the repo
  servers by querying a geoIP file from download.opensuse.org. This
  file can return a redirection target depending on the clients IP
  adress, this way we can directly contact a local mirror of d.o.o
  instead. The redir target stays valid for 24hrs.
  This feature can be disabled in zypp.conf by setting
  'download.use_geoip_mirror = false'.
- Use a dynamic fallback for BLKSIZE in downloads.
  When not receiving a blocklist via metalink file from the server
  MediaMultiCurl used to fallback to a fixed, relatively small
  BLKSIZE. This patch changes the fallback into a dynamic value
  based on the filesize using a similar metric as the MirrorCache
  implementation on the server side.
- Skip media.1/media download for http repo status calc.
  This patch allows zypp to skip a extra media.1/media download to
  calculate if a repository needs to be refreshed. This
  optimisation only takes place if the repo does specify only
  downloading base urls.
- version 17.31.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1666008000">- Do not clean up MediaSetAccess before using the geoip file
  (fixes #424)
- version 17.31.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Create '.no_auto_prune' in the package cache dir to prevent auto
  cleanup of orphaned repositories (bsc#1204956)
- properly reset range requests (bsc#1204548)
- version 17.31.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1669377600">- Avoid calling getsockopt when we know the info already.
  This patch hopefully fixes logging on WSL, getsockopt seems to
  not be fully supported but the code required it when accepting
  new socket connections. (for bsc#1178233)
- Enhance yaml-cpp detection (fixes #428)
- No need to redirect 'history.logfile=/dev/null' into the target.
- MultiCurl: Make sure to reset the progress function when
  falling back.
- version 17.31.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1671883200">- Hint to "zypper removeptf" to remove PTFs.
- Removing a PTF without enabled repos should always fail
  (bsc#1203248)
  Without enabled repos, the dependent PTF-packages would be
  removed (not replaced!) as well. To remove a PTF "zypper install
  - - -PTF" or a dedicated "zypper removeptf PTF" should be used.
  This will update the installed PTF packages to theit latest
  version.
- version 17.31.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1676289600">- ProgressData: enforce reporting the INIT||END state
  (bsc#1206949)
- ps: fix service detection on newer Tumbleweed systems
  (bsc#1205636)
- version 17.31.8 (22)</changelog>
</package>
<package pkgid="b8b9ea73c16e92e9c10452a961c60e7ac6ea71e6c9740a0129a56731200badea" name="login_defs" arch="noarch">
  <version epoch="0" ver="4.8.1" rel="150400.10.3.1"/>
  <changelog author="sbrabec@suse.com" date="1564142400">- Fix incorrect variable name in usermod
  (shadow-usermod-variable.patch).
- shadow-login_defs-comments.patch:
  * Drop SHA_CRYPT_*_ROUNDS that are in the upstream login.defs.
  * Add missing LASTLOG_UID_MAX.
  * Refresh shadow-login_defs-suse.patch.
- Port shadow-login_defs-check.sh to match the current spec file
  and login.defs.</changelog>
  <changelog author="kukuk@suse.de" date="1566216000">- encryption_method_nis.patch: drop, DES should really not be used
  anymore anywhere, even with NIS
- shadow-login_defs-suse.patch: remove encryption NIS entry</changelog>
  <changelog author="mvetter@suse.com" date="1567425600">- bsc#1144060: Add pam_keyinit.so to /etc/pam.d configuration files
  to support kernel keyring feature
- Update pamd.tar.bz2 with pam configuration files accordingly</changelog>
  <changelog author="kukuk@suse.de" date="1570449600">- libeconf.patch: Add support for libeconf and /usr/etc for
  login.defs.
- Move first configuration files and pam config files to /usr/etc</changelog>
  <changelog author="mvetter@suse.com" date="1576584000">- Update to 4.8:
  * Initial optional bcrypt support.
  * Make build/install of 'su' optional.
  * Fix for vipw not resuming correctly when suspended
  * Sync password field descriptions in manpages
  * Check for valid shell argument in useradd
  * Allow translation of new strings through POTFILES.in
  * Migrate to itstool for translations
  * Migrate to new SELinux api
  * Support --enable-vendordir
  * pwck: Only check homedir if set and not a system user
  * Support nonstandard usernames
  * sget{pw,gr}ent: check for data at EOL
  * Add YYY-MM-DD support in chage
  * Fix failing chmod calls for suidubins
  * Fix --sbindir and --bindir for binary installations
  * Fix LASTLOG_UID_MAX in login.defs
  * Fix configure error with dash
- Remove because upstreamed:
  * libeconf.patch
  * shadow-usermod-variable.patch
- Rebase:
  * shadow-login_defs-unused-by-pam.patch
  * chkname-regex.patch
  * shadow-util-linux.patch
  * shadow-login_defs-comments.patch
- Add shadow-4.8-selinux-include.patch
  See https://github.com/shadow-maint/shadow/pull/200</changelog>
  <changelog author="mvetter@suse.com" date="1579176000">- bsc#1160729: Make valid shell check only a warning
  * Add shadow-4.8-shell-check.patch</changelog>
  <changelog author="mvetter@suse.com" date="1579521600">- Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers,
  useradd, userdel, usermod explicitly.</changelog>
  <changelog author="mvetter@suse.com" date="1579867200">- Update to 4.8.1:
  * selinux: include stdio
  * man: don't suggest making groupmems user-writeable
  * Makefile: bail out on error in for loops
  * Adding logging of SSH_ORIGINAL_COMMAND to nologin
  * add new HOME_MODE login.defs option
  * Add tty logging to useradd
  * Useradd: make non-executable shell check only a warning
  * Update Dutch translation
  * user_busy: Do not mistake a regular user process for a namespaced one
  * Revert "Honor --sbindir and --bindir for binary installation"
- Remove shadow-4.8-shell-check.patch: included
- Remove shadow-4.8-selinux-include.patch: upstreamed</changelog>
  <changelog author="fvogt@suse.com" date="1590148800">- Use pure #!/bin/sh in:
  * useradd.local
  * userdel-post.local
  * userdel-pre.local</changelog>
  <changelog author="sbrabec@suse.com" date="1599566400">- login.defs: Add support for new util-linux-2.36 login variable
  MOTD_FIRSTONLY (shadow-util-linux.patch).
- shadow-login_defs-comments.patch: Remove duplicated
  LASTLOG_UID_MAX.
- shadow-login_defs-check.sh: Update for new build system.
- shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is
  not used in SUSE Linux.
- Refresh shadow-login_defs-suse.patch and
  shadow-login_defs-comments.patch.</changelog>
  <changelog author="sbrabec@suse.com" date="1602158400">- shadow-login_defs-check.sh: Fix the regexp to get a real variable
  list (boo#1164274).</changelog>
  <changelog author="werner@suse.de" date="1602244800">- Add support for /usr/etc/skel to useradd.local script (boo#1173321)</changelog>
  <changelog author="werner@suse.de" date="1604318400">- Change again useradd.local script to let it work even for system
  accounts and work together with SELinux (bsc#1178296)
- Change patch useradd-script.patch to support the four arguments
  used by the useradd.local script (bsc#1178296)</changelog>
  <changelog author="werner@suse.de" date="1605096000">- Add patch useradd-userkeleton.patch to extend original C code
  of useradd to handle /usr/etc/skel (boo#1173321)
- Remove /usr/etc/skel support in useradd.local script</changelog>
  <changelog author="fvogt@suse.com" date="1605096001">- Amend patches/useradd-userkeleton.patch to also write into
  existing directories and prefer files from /etc</changelog>
  <changelog author="kukuk@suse.com" date="1611230400">- Split login.defs configuration file into own sub-package, which
  allows to install util-linux or pam on small embedded/edge
  systems or container without the need to pull in the full shadow
  suite.</changelog>
  <changelog author="sbrabec@suse.com" date="1611835200">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- shadow-util-linux.patch:
  * Add support for LOGIN_KEEP_USERNAME from util-linux &gt;= 2.37.
- Refresh shadow-login_defs-suse.patch.</changelog>
  <changelog author="sbrabec@suse.com" date="1641988800">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- Added patch:
  * shadow-4.8.1-AUDIT_NO_ID.patch
    + fix bsc#1205502: useradd audit event user id field cannot
    be interpreted</changelog>
</package>
<package pkgid="8ae6a791c7cabb1790451a033c0873c9b030beb18ccaca9f45fcc1dfea23051f" name="lvm2" arch="aarch64">
  <version epoch="0" ver="2.03.05" rel="150400.185.1"/>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1647172800">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  + change lvm.conf item external_device_info_source from none to udev
  + bug-1179691_config-set-external_device_info_source-none.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1659528000">- lvm reports udev database has incomplete information on devices (bsc#1202011)
  + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1664193600">- lvmlockd is not supporting sanlock (bsc#1203482)
  - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="74f9012e08109fd625670af4d60ea9d99e1757d7096afb6a310fec3519b27769" name="lvm2" arch="src">
  <version epoch="0" ver="2.03.05" rel="150400.185.1"/>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1647172800">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  + change lvm.conf item external_device_info_source from none to udev
  + bug-1179691_config-set-external_device_info_source-none.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1659528000">- lvm reports udev database has incomplete information on devices (bsc#1202011)
  + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1664193600">- lvmlockd is not supporting sanlock (bsc#1203482)
  - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="8e5370b8d03ef244802caab1e3727473fac8522a92fa45f491b5bbe25e29ba99" name="lvm2" arch="x86_64">
  <version epoch="0" ver="2.03.05" rel="150400.185.1"/>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1647172800">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  + change lvm.conf item external_device_info_source from none to udev
  + bug-1179691_config-set-external_device_info_source-none.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1659528000">- lvm reports udev database has incomplete information on devices (bsc#1202011)
  + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1664193600">- lvmlockd is not supporting sanlock (bsc#1203482)
  - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="ad7ff70e2f8b6223d46c98d76414e67e78f31682d4d184927963e9efdec6de7d" name="lvm2-device-mapper" arch="src">
  <version epoch="0" ver="2.03.05" rel="150400.185.1"/>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1647172800">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  + change lvm.conf item external_device_info_source from none to udev
  + bug-1179691_config-set-external_device_info_source-none.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1659528000">- lvm reports udev database has incomplete information on devices (bsc#1202011)
  + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1664193600">- lvmlockd is not supporting sanlock (bsc#1203482)
  - set 1 for _supportsanlock in lvm2.spec for enabling sanlock.</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="22d7cf3c21878043ff946b0a87bda9c5469d27b350c7e3170bc67ee2dc65d869" name="microos-tools" arch="aarch64">
  <version epoch="0" ver="2.17" rel="150400.3.3.1"/>
  <changelog author="kukuk@suse.com" date="1591358400">- Update to version 2.1
  - Provide support to use tmpfs for /tmp</changelog>
  <changelog author="kukuk@suse.com" date="1596110400">- Update to version 2.2
  - tmpfs support got moved to systemd</changelog>
  <changelog author="kukuk@suse.com" date="1597233600">- Update to version 2.3
  - SELinux support [jsc#SMO-15]
  - overwrite tmp.mount options with SELinux label for /tmp
  - Add generator to label mount points if required
  - Add dracut module to relabel core system if required
  - Add locale-check to reset locale to system default if the one
    set by SSH does not exist [bsc#1156175]
  - Set TMPDIR for salt to not use /tmp (preparation for noexec)</changelog>
  <changelog author="kukuk@suse.com" date="1597406400">- Add tmp.mount for SUSE MicroOS 5.0 [jsc#SMO-2]</changelog>
  <changelog author="kukuk@suse.com" date="1597752000">- Don't install tmp.mount.d/selinux.conf on Factory [bsc#1175379]</changelog>
  <changelog author="kukuk@suse.com" date="1597752001">- Update to version 2.4
  - fixes for autorelabel in initrd
  - Use systemds tmpfiles.d/tmp.conf to relabel /tmp and cleanup
    /tmp after 10 days and /var/tmp after 30 days</changelog>
  <changelog author="kukuk@suse.com" date="1601294400">- Update to version 2.5
  - tmp.conf now part of filesystem package for Factory
- Include tmp.conf for SUSE MicroOS</changelog>
  <changelog author="kukuk@suse.com" date="1603281600">- Update to version 2.6
  - Don't delete autorelabel file in initrd</changelog>
  <changelog author="kukuk@suse.com" date="1603368000">- Fix building on SUSE MicroOS</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- Update to version 2.7
  - Add workaround if /.autorelabel is used, don't ignore it
- Rename tmp.conf to microos-tmp.conf on SUSE MicroOS</changelog>
  <changelog author="kukuk@suse.com" date="1604923200">- Update to version 2.8
  - Don't propagate umounts into the real root
  - Use content of .autorelabel only if it exists</changelog>
  <changelog author="kukuk@suse.com" date="1605009600">- Update to version 2.9
  - Use absolute path for selinuxenabled in systemd generator</changelog>
  <changelog author="kukuk@suse.com" date="1620648000">- Update to version 2.10
  - Fixes and improvements for SELinux support
  - Add devel tools
- Add new subpackage microos-devel-tools
- Add rpm as build dependency for that subpackage</changelog>
  <changelog author="iforster@suse.com" date="1623844800">- Update to version 2.11
  - Fix unwritable /var / /etc after SELinux relabel [bsc#1186563]</changelog>
  <changelog author="kukuk@suse.com" date="1631188800">- Update to version 2.12
  - Remove special MicroOS firstboot script
  - Remove locale-check, replaced by another aaa_base implementation</changelog>
  <changelog author="kukuk@suse.com" date="1661860800">- Update to version 2.13
  - 98selinux-microos: Don't rely on selinux=1 [bsc#1202449]
  - Add sysext-add-debug
  - Make sure /var/lib/overlay exists before relabeling</changelog>
  <changelog author="kukuk@suse.com" date="1661860801">- Update to version 2.14
  - Fix Makefile to install sysext-add-debug</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to version 2.15
  - 98selinux-microos: Add grep as dependency</changelog>
  <changelog author="fvogt@suse.com" date="1662379200">- Update to version 2.16:
  - 98selinux-microos: Make the btrfs subvolume writable temporarily [boo#1202395]</changelog>
  <changelog author="kukuk@suse.com" date="1663329600">- Update to version 2.17:
  - selinux-autorelabel-generator: Don't cross partition boundaries
  for /.snapshots when relabeling [issue#11]</changelog>
</package>
<package pkgid="88419e0b35bc9cdce8a55c41f2315bd2a32062fdb6289d4f764a843f917b5169" name="microos-tools" arch="src">
  <version epoch="0" ver="2.17" rel="150400.3.3.1"/>
  <changelog author="kukuk@suse.com" date="1591358400">- Update to version 2.1
  - Provide support to use tmpfs for /tmp</changelog>
  <changelog author="kukuk@suse.com" date="1596110400">- Update to version 2.2
  - tmpfs support got moved to systemd</changelog>
  <changelog author="kukuk@suse.com" date="1597233600">- Update to version 2.3
  - SELinux support [jsc#SMO-15]
  - overwrite tmp.mount options with SELinux label for /tmp
  - Add generator to label mount points if required
  - Add dracut module to relabel core system if required
  - Add locale-check to reset locale to system default if the one
    set by SSH does not exist [bsc#1156175]
  - Set TMPDIR for salt to not use /tmp (preparation for noexec)</changelog>
  <changelog author="kukuk@suse.com" date="1597406400">- Add tmp.mount for SUSE MicroOS 5.0 [jsc#SMO-2]</changelog>
  <changelog author="kukuk@suse.com" date="1597752000">- Don't install tmp.mount.d/selinux.conf on Factory [bsc#1175379]</changelog>
  <changelog author="kukuk@suse.com" date="1597752001">- Update to version 2.4
  - fixes for autorelabel in initrd
  - Use systemds tmpfiles.d/tmp.conf to relabel /tmp and cleanup
    /tmp after 10 days and /var/tmp after 30 days</changelog>
  <changelog author="kukuk@suse.com" date="1601294400">- Update to version 2.5
  - tmp.conf now part of filesystem package for Factory
- Include tmp.conf for SUSE MicroOS</changelog>
  <changelog author="kukuk@suse.com" date="1603281600">- Update to version 2.6
  - Don't delete autorelabel file in initrd</changelog>
  <changelog author="kukuk@suse.com" date="1603368000">- Fix building on SUSE MicroOS</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- Update to version 2.7
  - Add workaround if /.autorelabel is used, don't ignore it
- Rename tmp.conf to microos-tmp.conf on SUSE MicroOS</changelog>
  <changelog author="kukuk@suse.com" date="1604923200">- Update to version 2.8
  - Don't propagate umounts into the real root
  - Use content of .autorelabel only if it exists</changelog>
  <changelog author="kukuk@suse.com" date="1605009600">- Update to version 2.9
  - Use absolute path for selinuxenabled in systemd generator</changelog>
  <changelog author="kukuk@suse.com" date="1620648000">- Update to version 2.10
  - Fixes and improvements for SELinux support
  - Add devel tools
- Add new subpackage microos-devel-tools
- Add rpm as build dependency for that subpackage</changelog>
  <changelog author="iforster@suse.com" date="1623844800">- Update to version 2.11
  - Fix unwritable /var / /etc after SELinux relabel [bsc#1186563]</changelog>
  <changelog author="kukuk@suse.com" date="1631188800">- Update to version 2.12
  - Remove special MicroOS firstboot script
  - Remove locale-check, replaced by another aaa_base implementation</changelog>
  <changelog author="kukuk@suse.com" date="1661860800">- Update to version 2.13
  - 98selinux-microos: Don't rely on selinux=1 [bsc#1202449]
  - Add sysext-add-debug
  - Make sure /var/lib/overlay exists before relabeling</changelog>
  <changelog author="kukuk@suse.com" date="1661860801">- Update to version 2.14
  - Fix Makefile to install sysext-add-debug</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to version 2.15
  - 98selinux-microos: Add grep as dependency</changelog>
  <changelog author="fvogt@suse.com" date="1662379200">- Update to version 2.16:
  - 98selinux-microos: Make the btrfs subvolume writable temporarily [boo#1202395]</changelog>
  <changelog author="kukuk@suse.com" date="1663329600">- Update to version 2.17:
  - selinux-autorelabel-generator: Don't cross partition boundaries
  for /.snapshots when relabeling [issue#11]</changelog>
</package>
<package pkgid="d9e0c3b2f28d94c3bf7c1571387e1695d700fb729eac1f5b34ab8e2c19f745be" name="microos-tools" arch="x86_64">
  <version epoch="0" ver="2.17" rel="150400.3.3.1"/>
  <changelog author="kukuk@suse.com" date="1591358400">- Update to version 2.1
  - Provide support to use tmpfs for /tmp</changelog>
  <changelog author="kukuk@suse.com" date="1596110400">- Update to version 2.2
  - tmpfs support got moved to systemd</changelog>
  <changelog author="kukuk@suse.com" date="1597233600">- Update to version 2.3
  - SELinux support [jsc#SMO-15]
  - overwrite tmp.mount options with SELinux label for /tmp
  - Add generator to label mount points if required
  - Add dracut module to relabel core system if required
  - Add locale-check to reset locale to system default if the one
    set by SSH does not exist [bsc#1156175]
  - Set TMPDIR for salt to not use /tmp (preparation for noexec)</changelog>
  <changelog author="kukuk@suse.com" date="1597406400">- Add tmp.mount for SUSE MicroOS 5.0 [jsc#SMO-2]</changelog>
  <changelog author="kukuk@suse.com" date="1597752000">- Don't install tmp.mount.d/selinux.conf on Factory [bsc#1175379]</changelog>
  <changelog author="kukuk@suse.com" date="1597752001">- Update to version 2.4
  - fixes for autorelabel in initrd
  - Use systemds tmpfiles.d/tmp.conf to relabel /tmp and cleanup
    /tmp after 10 days and /var/tmp after 30 days</changelog>
  <changelog author="kukuk@suse.com" date="1601294400">- Update to version 2.5
  - tmp.conf now part of filesystem package for Factory
- Include tmp.conf for SUSE MicroOS</changelog>
  <changelog author="kukuk@suse.com" date="1603281600">- Update to version 2.6
  - Don't delete autorelabel file in initrd</changelog>
  <changelog author="kukuk@suse.com" date="1603368000">- Fix building on SUSE MicroOS</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- Update to version 2.7
  - Add workaround if /.autorelabel is used, don't ignore it
- Rename tmp.conf to microos-tmp.conf on SUSE MicroOS</changelog>
  <changelog author="kukuk@suse.com" date="1604923200">- Update to version 2.8
  - Don't propagate umounts into the real root
  - Use content of .autorelabel only if it exists</changelog>
  <changelog author="kukuk@suse.com" date="1605009600">- Update to version 2.9
  - Use absolute path for selinuxenabled in systemd generator</changelog>
  <changelog author="kukuk@suse.com" date="1620648000">- Update to version 2.10
  - Fixes and improvements for SELinux support
  - Add devel tools
- Add new subpackage microos-devel-tools
- Add rpm as build dependency for that subpackage</changelog>
  <changelog author="iforster@suse.com" date="1623844800">- Update to version 2.11
  - Fix unwritable /var / /etc after SELinux relabel [bsc#1186563]</changelog>
  <changelog author="kukuk@suse.com" date="1631188800">- Update to version 2.12
  - Remove special MicroOS firstboot script
  - Remove locale-check, replaced by another aaa_base implementation</changelog>
  <changelog author="kukuk@suse.com" date="1661860800">- Update to version 2.13
  - 98selinux-microos: Don't rely on selinux=1 [bsc#1202449]
  - Add sysext-add-debug
  - Make sure /var/lib/overlay exists before relabeling</changelog>
  <changelog author="kukuk@suse.com" date="1661860801">- Update to version 2.14
  - Fix Makefile to install sysext-add-debug</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to version 2.15
  - 98selinux-microos: Add grep as dependency</changelog>
  <changelog author="fvogt@suse.com" date="1662379200">- Update to version 2.16:
  - 98selinux-microos: Make the btrfs subvolume writable temporarily [boo#1202395]</changelog>
  <changelog author="kukuk@suse.com" date="1663329600">- Update to version 2.17:
  - selinux-autorelabel-generator: Don't cross partition boundaries
  for /.snapshots when relabeling [issue#11]</changelog>
</package>
<package pkgid="a9632da0d3142533d4bb5e778b8d66aca533f82606f69b4c0f7e21d22fee1c64" name="mozilla-nss" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="c767edd03f7f57d4e357a5ee9d3ee2ac0f21c9b79eca0239f3856486987af42b" name="mozilla-nss" arch="src">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="b5e0696591efcb4b33aa6f1971ab3fc6acf3ffb2510a963897c3fd9bf7960f61" name="mozilla-nss" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="f4ee50f8ccb00cd7e865597afe69e6bafb3c4878b503921cd5a5fd4299a199d8" name="mozilla-nss" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="4f0e52e87725710a5f125be06cddb8303fce05bf602013b0aba81960b6efc3c9" name="mozilla-nss" arch="src">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="bf9ebfc92819c99ce15c57393fd406077b191986603d76d59072ca6cb45e7073" name="mozilla-nss" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="46962d7ee66c11a723e6ceb5bcbe6c60827e9f515cc5513650368216a84935e9" name="mozilla-nss" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="cc3f685c7083a2a4e18a4e47ec37d8f8815457035b6b4ba69482ffd903be57e7" name="mozilla-nss" arch="src">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="7a654b996fc753dbb5e200e2922c5893df3b153ee5e7188be00aedbbce1b86df" name="mozilla-nss" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="f7556e39151043a40b3386c29fedc1244828270d99ff86d64d22bcedc85476f8" name="mozilla-nss-certs" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="5ece0db8f0e33a597c379b2e5b9cf27fb7c88289f22900bdc2d1edf4573db573" name="mozilla-nss-certs" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="0b690a24ac671bc8bc81c4712abcfaea01d2dac59b722479b4fc3fe4b89bf903" name="mozilla-nss-certs" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="cd20315e1a8ee7dfca2b014b76af00c9e0e98eee4d63103f33d32ece081b6d18" name="mozilla-nss-certs" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="e445a904837953530fae8d6bbd93056ddb306c665aef3c930b2a160b2eac5bab" name="mozilla-nss-certs" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="0b22e45bf7bf26a484f0275a73d41c0068898a40756608b7ff14cb7921698bd8" name="mozilla-nss-certs" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="3b1f2794bb4e7fe2a62b3ff3f6f52683ffb8f46a411340fdbed1667d1fb42e7b" name="mozilla-nss-tools" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="3f416fb15479a35d393a0daef77b285f3f8152eb576e3bf273d69294c8f4b747" name="mozilla-nss-tools" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150400.3.18.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="bfa1fd3160427e08303c0774403df42e2f9fffa8f7886deb7b61a850bb3372c0" name="mozilla-nss-tools" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="4ee5be8e1e1a6ee08f9f40b055623dd6240daaddd373af1cd03231bd510c3433" name="mozilla-nss-tools" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150400.3.23.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="d06c5d2ba3ffbb088fe07c9148277e1202b13c8d7b8ca6c76a5abdc976272b65" name="mozilla-nss-tools" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="38317d26182279e170d3295a275eb567dc7806314dfcbce3da8868f627edcd5c" name="mozilla-nss-tools" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150400.3.26.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="933703061a14787ba7c464c505aa4403dcec838e5433cddc4490ddb559896f85" name="multipath-tools" arch="aarch64">
  <version epoch="0" ver="0.9.0+62+suse.3e048d4" rel="150400.4.10.1"/>
  <changelog author="mwilck@suse.com" date="1632225600">- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1638446400">- Update to version 0.8.7+138+suse.7c9afe31:
  New upstream version (pre-0.8.8)
  * deprecate "config_dir" and "multipath_dir" config options
    (will be removed in future version)
  * remove dependency on systemd-udevd-settle.service (boo#1193336)
  * fix crash in remove_map (boo#1193334)
  * CLI: add path wildcard "%I" for init state
  * CLI: add "reconfigure all" command
  * allow multiple pending "reconfigure" commands (bsc#1189551)
  * speed up "reconfigure" by avoiding unnecessary map reloads
    (bsc#1189551)
  * rework of CLI command handler (unix socket handler) to avoid
    hanging CLI commands (bsc#1189551)
  * fix multipathd startup after stop during reconfigure (boo#1193338)
  * improve error detection and warning messages in config file parser
  * fix exit status of multipath -T (bsc#1191900)
  * fix defects reported by coverity (boo#1193342)
  - avoid sleeping with locks held
  - exit if bindings file is broken
  - set umask before mkstemp
  - add bounds and consistency checks in SCSI VPD parsing code
  * add hardware table entry for DellEMC/ME4 (PowerVault ME4)</changelog>
  <changelog author="mwilck@suse.com" date="1638532800">- Drop versioned dependency on libmpath0 again (bsc#1190622)
  * Since 0.8.6, libmultipath and libmpathpersist have got proper ABI
    versioning, and rpmbuild auto-generates dependencies on
    libmultipath.so.0(LIBMULTIPATH_13.0.0) etc.</changelog>
  <changelog author="mwilck@suse.com" date="1638792000">- Update to 0.8.8+38+suse.2bdd3a14.obscpio
  * upstream version bump. Code-wise identical to 0.8.7+138+suse.7c9afe31</changelog>
  <changelog author="mwilck@suse.com" date="1641556800">- Version 0.8.8+13+suse.79c3556f
  * code-wise identical to 0.8.8+38+suse.2bdd3a14
    (previous version number was too high by mistake)</changelog>
  <changelog author="mwilck@suse.com" date="1643803200">- Version 0.8.8+45+suse.628d603e
  * fix handling of historical-service-time path selector (bsc#1195425)
  * fix marking multipath devices as failed prematurely on startup
    (bsc#1195426)
  * multipathd.service: remove LimitCORE=infinity directive
    This should only be enabled for debugging.
  * multipathd.service: don't load scsi_dh modules (bsc#1195397)
    This is done via modules-load.d functionality on (open)SUSE
- Upstream fixes:
  * Fix claiming of paths with "find_multipaths strict"
  * Avoid unnecessary read-only reloads</changelog>
  <changelog author="mwilck@suse.com" date="1644408000">- Version 0.8.8+57+suse.dfb672fe
  * kpartx.rules: skip MD devices (bsc#1195644)
  * libmultipath: hwtable: use ALUA for all LIO targets (bsc#1195649)
  * multipathd.service: drop ExecStartPre for loading dm-multipath
    (bsc#1195397)</changelog>
  <changelog author="mwilck@suse.com" date="1644926400">- Update to version 0.8.8+60+suse.4c5922cb:
  * multipathd: add suppport for FC Fabric Performance Impact
    Notifications (FPIN) (bsc#1195506)</changelog>
  <changelog author="mwilck@suse.com" date="1645012800">- Update to version 0.8.8+64+suse.f265f7e0:
  * libmultipath: fix printing native nvme multipath topology
    (bsc#1196011)
  * libmultipath: add %L path wildcard for 64-bit hex LUN
  * libmultipath: support host adapter name lookup for s390x ccw bus</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- If multipath-tools is newly installed, load dm-multipath
  (bsc#1196898)</changelog>
  <changelog author="mwilck@suse.com" date="1649937600">- Update to version 0.8.9+42+suse.45974f11:
  * Logging improvements
  * Fix busy loop with delayed_reconfigure (bsc#1199342)
  * multipathd: use remove_map_callback for delayed reconfigure
  * multipathd: Don't keep starting TUR threads, if they always hang.
    (bsc#1199345)
  * Fix handling of path addition in read-only arrays on NVMe
  * Updates of built-in hardware database
- Update to upstream 0.8.9
  * libmultipath: only warn once about unsupported dev_loss_tmo
  * Otherwise code-identical to 0.8.8+64</changelog>
  <changelog author="mwilck@suse.com" date="1652097600">- Update to version 0.8.9+85+suse.a9da21c:
  * This is a pre-release of multipath-tools 0.9.0
  * multipath.conf: add "protocol" subsection in "overrides" section
    This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and
    "eh_deadline" on a per-protocol basis rather than per storage
  * multipath.conf: drop support for deprecated options:
    getuid_callout, pg_timeout, config_dir, multipath_dir
  * multipathd: don't switch to DAEMON_IDLE during startup
  (bsc#1199346, bsc#1197570)
  * multipathd: avoid delays during uevent processing (bsc#1199347)
  * Fixes for minor issues reported by coverity
  * Fix for memory leak with uid_attrs
  * Fix possibility to redefine -D_FORTIFY_SOURCE macro.
  * Updates for built in hardware db</changelog>
  <changelog author="mwilck@suse.com" date="1652184000">- Update to version 0.8.9+87+suse.a1eb122:
  * add ability to autodetect support for -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1652270400">- Update to version 0.8.9+90+suse.71a70fb:
  * support overriding -D_FORTIFY_SOURCE in OPTFLAGS
  * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors
    on old distros</changelog>
  <changelog author="mwilck@suse.com" date="1657713600">- Update to version 0.9.0+33+suse.fdc6686
  * multipath.conf: add support for "protocol" subsection in
    "overrides" section to set certain config options by protocol.
  * Removed the previously deprecated options getuid_callout,
    config_dir, multipath_dir, pg_timeout
  * hwable fixes and additions
  * multipath.conf(5): add disclaimer about vendor support
  * libmultipath, kpartx: fix callers of dm_get_next_target()
  * Change built-in defaults for NVMe: group by prio, and immediate
    failback
  * Allow compilation with -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1657713601">- Update to version 0.9.0+39+suse.51a2ab1:
  Upstream bug fixes:
  * libmultipath: fix find_multipaths_timeout for unknown hardware
  (boo#1201483)
  * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices
  (boo#1201483)</changelog>
  <changelog author="mwilck@suse.com" date="1661342400">- Update to version 0.9.0+55+suse.33d8854:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.9.0+62+suse.3e048d4:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="072e8df4a11e6f2ce8e4c0b060453036fad8684e947b8123a7557dce415950f7" name="multipath-tools" arch="src">
  <version epoch="0" ver="0.9.0+62+suse.3e048d4" rel="150400.4.10.1"/>
  <changelog author="mwilck@suse.com" date="1632225600">- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1638446400">- Update to version 0.8.7+138+suse.7c9afe31:
  New upstream version (pre-0.8.8)
  * deprecate "config_dir" and "multipath_dir" config options
    (will be removed in future version)
  * remove dependency on systemd-udevd-settle.service (boo#1193336)
  * fix crash in remove_map (boo#1193334)
  * CLI: add path wildcard "%I" for init state
  * CLI: add "reconfigure all" command
  * allow multiple pending "reconfigure" commands (bsc#1189551)
  * speed up "reconfigure" by avoiding unnecessary map reloads
    (bsc#1189551)
  * rework of CLI command handler (unix socket handler) to avoid
    hanging CLI commands (bsc#1189551)
  * fix multipathd startup after stop during reconfigure (boo#1193338)
  * improve error detection and warning messages in config file parser
  * fix exit status of multipath -T (bsc#1191900)
  * fix defects reported by coverity (boo#1193342)
  - avoid sleeping with locks held
  - exit if bindings file is broken
  - set umask before mkstemp
  - add bounds and consistency checks in SCSI VPD parsing code
  * add hardware table entry for DellEMC/ME4 (PowerVault ME4)</changelog>
  <changelog author="mwilck@suse.com" date="1638532800">- Drop versioned dependency on libmpath0 again (bsc#1190622)
  * Since 0.8.6, libmultipath and libmpathpersist have got proper ABI
    versioning, and rpmbuild auto-generates dependencies on
    libmultipath.so.0(LIBMULTIPATH_13.0.0) etc.</changelog>
  <changelog author="mwilck@suse.com" date="1638792000">- Update to 0.8.8+38+suse.2bdd3a14.obscpio
  * upstream version bump. Code-wise identical to 0.8.7+138+suse.7c9afe31</changelog>
  <changelog author="mwilck@suse.com" date="1641556800">- Version 0.8.8+13+suse.79c3556f
  * code-wise identical to 0.8.8+38+suse.2bdd3a14
    (previous version number was too high by mistake)</changelog>
  <changelog author="mwilck@suse.com" date="1643803200">- Version 0.8.8+45+suse.628d603e
  * fix handling of historical-service-time path selector (bsc#1195425)
  * fix marking multipath devices as failed prematurely on startup
    (bsc#1195426)
  * multipathd.service: remove LimitCORE=infinity directive
    This should only be enabled for debugging.
  * multipathd.service: don't load scsi_dh modules (bsc#1195397)
    This is done via modules-load.d functionality on (open)SUSE
- Upstream fixes:
  * Fix claiming of paths with "find_multipaths strict"
  * Avoid unnecessary read-only reloads</changelog>
  <changelog author="mwilck@suse.com" date="1644408000">- Version 0.8.8+57+suse.dfb672fe
  * kpartx.rules: skip MD devices (bsc#1195644)
  * libmultipath: hwtable: use ALUA for all LIO targets (bsc#1195649)
  * multipathd.service: drop ExecStartPre for loading dm-multipath
    (bsc#1195397)</changelog>
  <changelog author="mwilck@suse.com" date="1644926400">- Update to version 0.8.8+60+suse.4c5922cb:
  * multipathd: add suppport for FC Fabric Performance Impact
    Notifications (FPIN) (bsc#1195506)</changelog>
  <changelog author="mwilck@suse.com" date="1645012800">- Update to version 0.8.8+64+suse.f265f7e0:
  * libmultipath: fix printing native nvme multipath topology
    (bsc#1196011)
  * libmultipath: add %L path wildcard for 64-bit hex LUN
  * libmultipath: support host adapter name lookup for s390x ccw bus</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- If multipath-tools is newly installed, load dm-multipath
  (bsc#1196898)</changelog>
  <changelog author="mwilck@suse.com" date="1649937600">- Update to version 0.8.9+42+suse.45974f11:
  * Logging improvements
  * Fix busy loop with delayed_reconfigure (bsc#1199342)
  * multipathd: use remove_map_callback for delayed reconfigure
  * multipathd: Don't keep starting TUR threads, if they always hang.
    (bsc#1199345)
  * Fix handling of path addition in read-only arrays on NVMe
  * Updates of built-in hardware database
- Update to upstream 0.8.9
  * libmultipath: only warn once about unsupported dev_loss_tmo
  * Otherwise code-identical to 0.8.8+64</changelog>
  <changelog author="mwilck@suse.com" date="1652097600">- Update to version 0.8.9+85+suse.a9da21c:
  * This is a pre-release of multipath-tools 0.9.0
  * multipath.conf: add "protocol" subsection in "overrides" section
    This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and
    "eh_deadline" on a per-protocol basis rather than per storage
  * multipath.conf: drop support for deprecated options:
    getuid_callout, pg_timeout, config_dir, multipath_dir
  * multipathd: don't switch to DAEMON_IDLE during startup
  (bsc#1199346, bsc#1197570)
  * multipathd: avoid delays during uevent processing (bsc#1199347)
  * Fixes for minor issues reported by coverity
  * Fix for memory leak with uid_attrs
  * Fix possibility to redefine -D_FORTIFY_SOURCE macro.
  * Updates for built in hardware db</changelog>
  <changelog author="mwilck@suse.com" date="1652184000">- Update to version 0.8.9+87+suse.a1eb122:
  * add ability to autodetect support for -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1652270400">- Update to version 0.8.9+90+suse.71a70fb:
  * support overriding -D_FORTIFY_SOURCE in OPTFLAGS
  * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors
    on old distros</changelog>
  <changelog author="mwilck@suse.com" date="1657713600">- Update to version 0.9.0+33+suse.fdc6686
  * multipath.conf: add support for "protocol" subsection in
    "overrides" section to set certain config options by protocol.
  * Removed the previously deprecated options getuid_callout,
    config_dir, multipath_dir, pg_timeout
  * hwable fixes and additions
  * multipath.conf(5): add disclaimer about vendor support
  * libmultipath, kpartx: fix callers of dm_get_next_target()
  * Change built-in defaults for NVMe: group by prio, and immediate
    failback
  * Allow compilation with -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1657713601">- Update to version 0.9.0+39+suse.51a2ab1:
  Upstream bug fixes:
  * libmultipath: fix find_multipaths_timeout for unknown hardware
  (boo#1201483)
  * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices
  (boo#1201483)</changelog>
  <changelog author="mwilck@suse.com" date="1661342400">- Update to version 0.9.0+55+suse.33d8854:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.9.0+62+suse.3e048d4:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="973a2d0d8a1a2b9e75e1c3fda3d83b81ec44b8768cb0530d1532f9960e7c8c65" name="multipath-tools" arch="x86_64">
  <version epoch="0" ver="0.9.0+62+suse.3e048d4" rel="150400.4.10.1"/>
  <changelog author="mwilck@suse.com" date="1632225600">- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1638446400">- Update to version 0.8.7+138+suse.7c9afe31:
  New upstream version (pre-0.8.8)
  * deprecate "config_dir" and "multipath_dir" config options
    (will be removed in future version)
  * remove dependency on systemd-udevd-settle.service (boo#1193336)
  * fix crash in remove_map (boo#1193334)
  * CLI: add path wildcard "%I" for init state
  * CLI: add "reconfigure all" command
  * allow multiple pending "reconfigure" commands (bsc#1189551)
  * speed up "reconfigure" by avoiding unnecessary map reloads
    (bsc#1189551)
  * rework of CLI command handler (unix socket handler) to avoid
    hanging CLI commands (bsc#1189551)
  * fix multipathd startup after stop during reconfigure (boo#1193338)
  * improve error detection and warning messages in config file parser
  * fix exit status of multipath -T (bsc#1191900)
  * fix defects reported by coverity (boo#1193342)
  - avoid sleeping with locks held
  - exit if bindings file is broken
  - set umask before mkstemp
  - add bounds and consistency checks in SCSI VPD parsing code
  * add hardware table entry for DellEMC/ME4 (PowerVault ME4)</changelog>
  <changelog author="mwilck@suse.com" date="1638532800">- Drop versioned dependency on libmpath0 again (bsc#1190622)
  * Since 0.8.6, libmultipath and libmpathpersist have got proper ABI
    versioning, and rpmbuild auto-generates dependencies on
    libmultipath.so.0(LIBMULTIPATH_13.0.0) etc.</changelog>
  <changelog author="mwilck@suse.com" date="1638792000">- Update to 0.8.8+38+suse.2bdd3a14.obscpio
  * upstream version bump. Code-wise identical to 0.8.7+138+suse.7c9afe31</changelog>
  <changelog author="mwilck@suse.com" date="1641556800">- Version 0.8.8+13+suse.79c3556f
  * code-wise identical to 0.8.8+38+suse.2bdd3a14
    (previous version number was too high by mistake)</changelog>
  <changelog author="mwilck@suse.com" date="1643803200">- Version 0.8.8+45+suse.628d603e
  * fix handling of historical-service-time path selector (bsc#1195425)
  * fix marking multipath devices as failed prematurely on startup
    (bsc#1195426)
  * multipathd.service: remove LimitCORE=infinity directive
    This should only be enabled for debugging.
  * multipathd.service: don't load scsi_dh modules (bsc#1195397)
    This is done via modules-load.d functionality on (open)SUSE
- Upstream fixes:
  * Fix claiming of paths with "find_multipaths strict"
  * Avoid unnecessary read-only reloads</changelog>
  <changelog author="mwilck@suse.com" date="1644408000">- Version 0.8.8+57+suse.dfb672fe
  * kpartx.rules: skip MD devices (bsc#1195644)
  * libmultipath: hwtable: use ALUA for all LIO targets (bsc#1195649)
  * multipathd.service: drop ExecStartPre for loading dm-multipath
    (bsc#1195397)</changelog>
  <changelog author="mwilck@suse.com" date="1644926400">- Update to version 0.8.8+60+suse.4c5922cb:
  * multipathd: add suppport for FC Fabric Performance Impact
    Notifications (FPIN) (bsc#1195506)</changelog>
  <changelog author="mwilck@suse.com" date="1645012800">- Update to version 0.8.8+64+suse.f265f7e0:
  * libmultipath: fix printing native nvme multipath topology
    (bsc#1196011)
  * libmultipath: add %L path wildcard for 64-bit hex LUN
  * libmultipath: support host adapter name lookup for s390x ccw bus</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- If multipath-tools is newly installed, load dm-multipath
  (bsc#1196898)</changelog>
  <changelog author="mwilck@suse.com" date="1649937600">- Update to version 0.8.9+42+suse.45974f11:
  * Logging improvements
  * Fix busy loop with delayed_reconfigure (bsc#1199342)
  * multipathd: use remove_map_callback for delayed reconfigure
  * multipathd: Don't keep starting TUR threads, if they always hang.
    (bsc#1199345)
  * Fix handling of path addition in read-only arrays on NVMe
  * Updates of built-in hardware database
- Update to upstream 0.8.9
  * libmultipath: only warn once about unsupported dev_loss_tmo
  * Otherwise code-identical to 0.8.8+64</changelog>
  <changelog author="mwilck@suse.com" date="1652097600">- Update to version 0.8.9+85+suse.a9da21c:
  * This is a pre-release of multipath-tools 0.9.0
  * multipath.conf: add "protocol" subsection in "overrides" section
    This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and
    "eh_deadline" on a per-protocol basis rather than per storage
  * multipath.conf: drop support for deprecated options:
    getuid_callout, pg_timeout, config_dir, multipath_dir
  * multipathd: don't switch to DAEMON_IDLE during startup
  (bsc#1199346, bsc#1197570)
  * multipathd: avoid delays during uevent processing (bsc#1199347)
  * Fixes for minor issues reported by coverity
  * Fix for memory leak with uid_attrs
  * Fix possibility to redefine -D_FORTIFY_SOURCE macro.
  * Updates for built in hardware db</changelog>
  <changelog author="mwilck@suse.com" date="1652184000">- Update to version 0.8.9+87+suse.a1eb122:
  * add ability to autodetect support for -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1652270400">- Update to version 0.8.9+90+suse.71a70fb:
  * support overriding -D_FORTIFY_SOURCE in OPTFLAGS
  * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors
    on old distros</changelog>
  <changelog author="mwilck@suse.com" date="1657713600">- Update to version 0.9.0+33+suse.fdc6686
  * multipath.conf: add support for "protocol" subsection in
    "overrides" section to set certain config options by protocol.
  * Removed the previously deprecated options getuid_callout,
    config_dir, multipath_dir, pg_timeout
  * hwable fixes and additions
  * multipath.conf(5): add disclaimer about vendor support
  * libmultipath, kpartx: fix callers of dm_get_next_target()
  * Change built-in defaults for NVMe: group by prio, and immediate
    failback
  * Allow compilation with -D_FORTIFY_SOURCE=3</changelog>
  <changelog author="mwilck@suse.com" date="1657713601">- Update to version 0.9.0+39+suse.51a2ab1:
  Upstream bug fixes:
  * libmultipath: fix find_multipaths_timeout for unknown hardware
  (boo#1201483)
  * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices
  (boo#1201483)</changelog>
  <changelog author="mwilck@suse.com" date="1661342400">- Update to version 0.9.0+55+suse.33d8854:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.9.0+62+suse.3e048d4:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="db7a342f8caf3ecb9bffa3d8bb7977662f74f2731ab329075c3408bb26078cf4" name="ndctl" arch="src">
  <version epoch="0" ver="71.1" rel="150400.10.3.1"/>
  <changelog author="msuchanek@suse.com" date="1565956800">- ndctl/list: Introduce region capability objects (bsc#1145772 ltc#178159).
  + ndctl-list-Introduce-region-capability-objects.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1566216000">- ndctl: Use the same align value as original namespace on reconfigure (bsc#1145577 ltc#178224).
  + ndctl-Use-the-same-align-value-as-original-namespace-on-reconfigure.patch
- ndctl/lib: Fix duplicate bus detection (bsc#1145573 ltc#180249).
  + ndctl-ndctl-lib-Fix-duplicate-bus-detection.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1566216001">- ndctl/namespace: Handle 'create-namespace' in label-less mode (bsc#1145471 ltc#179886).
  + ndctl-namespace-Handle-create-namespace-in-label-less-mode.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1566388800">- Refresh patches with upstream status:
  ndctl_check_Ensure_mmap_of_BTT_sections_work_with_64K_page-sizes.patch
  ndctl-namespace-Handle-create-namespace-in-label-less-mode.patch
  ndctl-list-Introduce-region-capability-objects.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1571400000">- Refresh patches with upstream status:
  ndctl-Use-the-same-align-value-as-original-namespace-on-reconfigure.patch
  ndctl-ndctl-lib-Fix-duplicate-bus-detection.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1573214400">- ndctl/dimm: Fix init-labels success reporting (bsc#1156308 ltc#181441).
  + ndctl-dimm-Fix-init-labels-success-reporting.patch
- Refresh patches with upstream status:
  ndctl-Use-the-same-align-value-as-original-namespace-on-reconfigure.patch
  ndctl-ndctl-lib-Fix-duplicate-bus-detection.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1583236800">- ndctl/test: Relax dax_pmem_compat requirement (bsc#1159523)
  + ndctl-test-Relax-dax_pmem_compat-requirement.patch
- Add -fcommon flag on Tumbleweed (boo#1160286).
- Fix 'ndctl enable-namespace all' fails trying to enable idle namespaces
  (bsc#1165509 ltc#182068).
  + ndctl-namespace-Fix-enable-namespace-error-for-seed-.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1585915200">- ndctl/namespace: Skip zero namespaces when processing all namespaces
  (bsc#1167861, bsc#1165509, ltc#182068).
  + ndctl-namespace-skip-zero-namespaces-when-processing.patch
- Refresh patch to upstream version:
  ndctl-test-Relax-dax_pmem_compat-requirement.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1589544000">- Update to v68:
  * zero-labels: display an error if regions are active
  * destroy-namespace: fix seed namespace accounting
  * list: drop named list objects from verbose listing
  * *-namespace: emit better errors on failure
  * read-infoblock: new command to read an infoblock
  * write-infoblock: new command to create and write an infoblock
  * create-namespace: add --continue option
  * daxctl-reconfigure-device: add --no-movable option
  * daxctl-reconfigure-device: display movable state in listings
  * daxctl-reconfigure-device: detect races in memory onlining
  * security: support for 'security frozen' attribute
  * daxctl-reconfigure-device: new command for device mode management
  * daxctl-{on,off}line-memory: new commands for devices in system-ram mode
  * monitor: logging improvements, allow sending to background
  * inject-error: refuse to operate on activew BTT namespaces
  * *-labels: improvements to minimize data transfer
  * create-namespace: usability improvements around region search
- Removed ndctl-Use-the-same-align-value-as-original-namespace-on-reconfigure.patch
- Removed ndctl-dimm-Fix-init-labels-success-reporting.patch
- Removed ndctl-list-Introduce-region-capability-objects.patch
- Removed ndctl-namespace-Fix-enable-namespace-error-for-seed-.patch
- Removed ndctl-namespace-Handle-create-namespace-in-label-less-mode.patch
- Removed ndctl-ndctl-lib-Fix-duplicate-bus-detection.patch
- Removed ndctl-test-Relax-dax_pmem_compat-requirement.patch
- Removed ndctl_check_Ensure_mmap_of_BTT_sections_work_with_64K_page-sizes.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1594728000">- Clarify documentation about filtering options (bsc#1173861)
  + ndctl-Documentation-use-includes-in-more-ndctl-command-pag.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1597060800">- Update to v69 (jsc#SLE-13824, jsc#SLE-12770, jsc#SLE-15065, jsc#SLE-15484,
    jsc#SLE-15485, bsc#1175052, ltc#186863, bsc#1174969, ltc#185845):
  * infoblock: Set the default alignment to the platform alignment
  * libndctl/papr_scm: Add support for reporting "life_used_percentage" metric
  * Skip region filtering if numa_node attribute is not present
  * libndctl,papr_scm: Implement support for PAPR_PDSM_HEALTH
  * miscellaneous bugfixes
- Removed ndctl-Documentation-use-includes-in-more-ndctl-command-pag.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1598616000">- Suppress ENXIO when processing all namespaces (jsc#SLE-13321, bsc#1175851, ltc#187867).
  + ndctl-namespace-Suppress-ENXIO-when-processing-all-n.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1603281600">- Update to upstream v70.1 (jsc#SLE-13338).
  Adds firmware activation support.</changelog>
  <changelog author="msuchanek@suse.de" date="1609416000">- Update to upstream v71 (jsc#SLE-14344, bsc#1170384).
  - support for the new device-dax subdivision functionality added in Linux in
    v5.10, including ways to create smaller devdax devices using
    daxctl/libdaxctl, as well as creating, listing, and restoring from a config
    dump, 'mappings' on these devices.
  - miscellaneous bugfixes
- Fix documentation and license packaging</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 71.1:
  * ndctl/dimm: Attempt an abort upon firmware-update-busy status
  * ndctl/dimm: Fix submit_abort_firmware()</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1611316800">- Enable aarch64 build (bsc#1188502).</changelog>
  <changelog author="jsegitz@suse.com" date="1634126400">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_ndctl-monitor.service.patch</changelog>
  <changelog author="mwilck@suse.com" date="1646395200">- Install modprobe.conf file to %_modprobedir (bsc#1196275, jsc#SLE-20639)</changelog>
  <changelog author="msuchanek@suse.com" date="1646654400">- Add support for reporting dirty shutdown count (jsc#SLE-18196).
  + 0016-libndctl-papr-Add-support-for-reporting-shutdown-cou.patch
  + 0009-libndctl-papr-Fix-probe-for-papr-scm-compatible-nvdi.patch
  + 0003-libndctl-Unify-adding-dimms-for-papr-and-nfit-famili.patch
- Merge fixes that went into v72 and v73
  - Documentation updates
    + 0015-ndctl-docs-Clarify-update-firwmware-activation-overf.patch
    + 0014-Documentation-ndctl-fix-self-reference-of-ndctl-disa.patch
    + 0013-daxctl-Add-Soft-Reservation-theory-of-operation.patch
    + 0008-ndctl-Update-nvdimm-mailing-list-address.patch
  - Label index block calculation fix
    + 0012-ndctl-dimm-Fix-label-index-block-calculations.patch
    + 0002-Expose-ndctl_bus_nfit_translate_spa-as-a-public-func.patch
  - Scrub fix
    + 0011-ndctl-scrub-Reread-scrub-engine-status-at-start.patch
    + 0010-ndctl-scrub-Stop-translating-return-values.patch
  - Add memblock count to JSON
    + 0007-daxctl-emit-counts-of-total-and-online-memblocks.patch
  - DAX disable fix
    + 0006-libndctl-check-for-active-system-ram-before-disablin.patch
    + 0005-libdaxctl-add-an-API-to-check-if-a-device-is-active.patch
    + 0001-ndctl-namespace-Fix-disable-namespace-accounting-rel.patch
  - DAX reconfigure fix
    + 0004-daxctl-fail-reconfigure-device-based-on-kernel-onlin.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1677067200">- Fix parsing NDCTL_TIMEOUT (bsc#1208548 ltc#199892)
    + ndctl-Fix-the-NDCTL_TIMEOUT-environment-variable-par.patch</changelog>
</package>
<package pkgid="49e53ddf566f5210fb46906117fad92db97b38423285dce6969d688470bbb6f5" name="net-snmp" arch="src">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="bcd6fa5b595c715feda11e020766465992e41ffe84896cd36b8769454f041e5f" name="net-snmp" arch="src">
  <version epoch="0" ver="5.9.3" rel="150300.15.8.1"/>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
  <changelog author="abergmann@suse.com" date="1672920000">- Fixed NULL pointer exception issue when handling ipDefaultTTL or
  pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792).
  add:
  * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch
- Enable AES-192 and AES-256 privacy protocol (bsc#1206828).</changelog>
  <changelog author="abergmann@suse.com" date="1673265600">- Hardening systemd services setting "ProtectHome=true" caused home directory
  size and allocation to be listed incorrectly (bsc#1206044).
  add:
  * net-snmp-5.9.3-harden_snmpd.service.patch
  * net-snmp-5.9.3-harden_snmptrapd.service.patch
  delete:
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch</changelog>
</package>
<package pkgid="983a122e69a197188d940082cf352458b0c76069c835eaf1001ca94aea8661dc" name="nfs-client" arch="aarch64">
  <version epoch="0" ver="2.1.1" rel="150100.10.32.1"/>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
  <changelog author="nfbrown@suse.com" date="1673697600">- 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch
  Avoid modprobe errors when sysctl is not installed.
  (bsc#1200710 bsc#1207022 bsc#1206781)
- 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch
  Add "-S scope" option to rpc.nfsd to simplify fail-over cluster
  config.
  (bsc#1203746)</changelog>
  <changelog author="nfbrown@suse.com" date="1675684800">- Rename all drop-in options.conf files as 10-options.conf
  This makes it easier for other packages to over-ride
  with a drop-in with a later sequence number.
  resource-agents does this.
  (bsc#1207843)</changelog>
</package>
<package pkgid="94d5dcdb75cdc948553ca85fdc2a218027dbc6d26513ab68e7c0ea01578f1424" name="nfs-client" arch="x86_64">
  <version epoch="0" ver="2.1.1" rel="150100.10.32.1"/>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
  <changelog author="nfbrown@suse.com" date="1673697600">- 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch
  Avoid modprobe errors when sysctl is not installed.
  (bsc#1200710 bsc#1207022 bsc#1206781)
- 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch
  Add "-S scope" option to rpc.nfsd to simplify fail-over cluster
  config.
  (bsc#1203746)</changelog>
  <changelog author="nfbrown@suse.com" date="1675684800">- Rename all drop-in options.conf files as 10-options.conf
  This makes it easier for other packages to over-ride
  with a drop-in with a later sequence number.
  resource-agents does this.
  (bsc#1207843)</changelog>
</package>
<package pkgid="98ca2fa9549984ab58992b09512d0bda5ebbfbf4247608d86154de908a654f03" name="nfs-kernel-server" arch="aarch64">
  <version epoch="0" ver="2.1.1" rel="150100.10.32.1"/>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
  <changelog author="nfbrown@suse.com" date="1673697600">- 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch
  Avoid modprobe errors when sysctl is not installed.
  (bsc#1200710 bsc#1207022 bsc#1206781)
- 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch
  Add "-S scope" option to rpc.nfsd to simplify fail-over cluster
  config.
  (bsc#1203746)</changelog>
  <changelog author="nfbrown@suse.com" date="1675684800">- Rename all drop-in options.conf files as 10-options.conf
  This makes it easier for other packages to over-ride
  with a drop-in with a later sequence number.
  resource-agents does this.
  (bsc#1207843)</changelog>
</package>
<package pkgid="6c3b46977ab103014c0fe595b5bcca3b9f07e8b62eda4609f03cd4d48fb2c2d6" name="nfs-kernel-server" arch="x86_64">
  <version epoch="0" ver="2.1.1" rel="150100.10.32.1"/>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
  <changelog author="nfbrown@suse.com" date="1673697600">- 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch
  Avoid modprobe errors when sysctl is not installed.
  (bsc#1200710 bsc#1207022 bsc#1206781)
- 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch
  Add "-S scope" option to rpc.nfsd to simplify fail-over cluster
  config.
  (bsc#1203746)</changelog>
  <changelog author="nfbrown@suse.com" date="1675684800">- Rename all drop-in options.conf files as 10-options.conf
  This makes it easier for other packages to over-ride
  with a drop-in with a later sequence number.
  resource-agents does this.
  (bsc#1207843)</changelog>
</package>
<package pkgid="cf7fc428c35f30e7e3f81b6a72c244a6d92f55815b1fc2dd84c4bac0f2521264" name="nfs-utils" arch="src">
  <version epoch="0" ver="2.1.1" rel="150100.10.32.1"/>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
  <changelog author="nfbrown@suse.com" date="1673697600">- 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch
  Avoid modprobe errors when sysctl is not installed.
  (bsc#1200710 bsc#1207022 bsc#1206781)
- 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch
  Add "-S scope" option to rpc.nfsd to simplify fail-over cluster
  config.
  (bsc#1203746)</changelog>
  <changelog author="nfbrown@suse.com" date="1675684800">- Rename all drop-in options.conf files as 10-options.conf
  This makes it easier for other packages to over-ride
  with a drop-in with a later sequence number.
  resource-agents does this.
  (bsc#1207843)</changelog>
</package>
<package pkgid="1d73e74bded170b50dbb2a0a88f7a73331bb91c68d54346864cda4a76a8713d5" name="nvme-cli" arch="aarch64">
  <version epoch="0" ver="2.0" rel="150400.3.12.1"/>
  <changelog author="jsegitz@suse.com" date="1634040000">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_nvmf-connect@.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="dimstar@opensuse.org" date="1639051200">- Update to version 1.16:
  + Print ProductName found even if subvendor/subdevice is unknown.
  + Add New fields on PEL based on NVMe 2.0a.
  + nvme-cli:
  - Split media units written/read into hi/lo 64 bit fields.
  - Add support for new SN650 device.
  - Update WDC pluging version to 1.15.3.
  - fix the [data|mdata]_len param (boo#1193547).
  - Add support for C3/Latency Monitor Log page parsing.
  - ctrl-loss-tmo should accept -1 as value.
  + nvme: add spinup control feature (fid=0x1A).
  + nvme: Add Identify for CNS 08h NVMe spec 2.0a based.
  + nvme: add boot partition log support.
  + nvme: add support for fid supported and effects log(lid =
    0x12).
  + add identify endurance group list (cns 0x19) support.
  + add json support for zns report zones.
  + fabrics: fix 'nvme discover' segfault if sysfs path is not
    available.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- Honor JSON config file in connect-all command (bsc#1203204 bsc#1203163)
  * add 0016-fabrics-nvme-config-modify-depends-on-n-and-t-argume.patch
  * add 0017-fabrics-Honor-JSON-config-file-in-connect-all-comman.patch
  * add 0018-fabrics-Trigger-auto-connect-if-config.json-exists.patch
- Add show-topology command (bsc#1200089)
  * add 0019-nvme-Add-show-topology-command.patch
  * add 0020-doc-Add-nvme-show-topology-documnetation.patch
  * add 0021-completions-Add-show-topology-tab-completion.patch</changelog>
  <changelog author="mwilck@suse.com" date="1669204800">- fix 'persistent' handling during connect-all with JSON file (bsc#1205657)
  * add 0022-fabrics-fix-persistent-handling-during-connect-all-w.patch</changelog>
</package>
<package pkgid="d5f2a85b9b00dc4e827d57688385b0d2c2d75c042f4c4a398d4f1fdacba353c5" name="nvme-cli" arch="src">
  <version epoch="0" ver="2.0" rel="150400.3.12.1"/>
  <changelog author="jsegitz@suse.com" date="1634040000">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_nvmf-connect@.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="dimstar@opensuse.org" date="1639051200">- Update to version 1.16:
  + Print ProductName found even if subvendor/subdevice is unknown.
  + Add New fields on PEL based on NVMe 2.0a.
  + nvme-cli:
  - Split media units written/read into hi/lo 64 bit fields.
  - Add support for new SN650 device.
  - Update WDC pluging version to 1.15.3.
  - fix the [data|mdata]_len param (boo#1193547).
  - Add support for C3/Latency Monitor Log page parsing.
  - ctrl-loss-tmo should accept -1 as value.
  + nvme: add spinup control feature (fid=0x1A).
  + nvme: Add Identify for CNS 08h NVMe spec 2.0a based.
  + nvme: add boot partition log support.
  + nvme: add support for fid supported and effects log(lid =
    0x12).
  + add identify endurance group list (cns 0x19) support.
  + add json support for zns report zones.
  + fabrics: fix 'nvme discover' segfault if sysfs path is not
    available.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- Honor JSON config file in connect-all command (bsc#1203204 bsc#1203163)
  * add 0016-fabrics-nvme-config-modify-depends-on-n-and-t-argume.patch
  * add 0017-fabrics-Honor-JSON-config-file-in-connect-all-comman.patch
  * add 0018-fabrics-Trigger-auto-connect-if-config.json-exists.patch
- Add show-topology command (bsc#1200089)
  * add 0019-nvme-Add-show-topology-command.patch
  * add 0020-doc-Add-nvme-show-topology-documnetation.patch
  * add 0021-completions-Add-show-topology-tab-completion.patch</changelog>
  <changelog author="mwilck@suse.com" date="1669204800">- fix 'persistent' handling during connect-all with JSON file (bsc#1205657)
  * add 0022-fabrics-fix-persistent-handling-during-connect-all-w.patch</changelog>
</package>
<package pkgid="c297fa983e5d0977477c6925affd6f576423011233c682b2f836d90ad3d1a068" name="nvme-cli" arch="x86_64">
  <version epoch="0" ver="2.0" rel="150400.3.12.1"/>
  <changelog author="jsegitz@suse.com" date="1634040000">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_nvmf-connect@.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="dimstar@opensuse.org" date="1639051200">- Update to version 1.16:
  + Print ProductName found even if subvendor/subdevice is unknown.
  + Add New fields on PEL based on NVMe 2.0a.
  + nvme-cli:
  - Split media units written/read into hi/lo 64 bit fields.
  - Add support for new SN650 device.
  - Update WDC pluging version to 1.15.3.
  - fix the [data|mdata]_len param (boo#1193547).
  - Add support for C3/Latency Monitor Log page parsing.
  - ctrl-loss-tmo should accept -1 as value.
  + nvme: add spinup control feature (fid=0x1A).
  + nvme: Add Identify for CNS 08h NVMe spec 2.0a based.
  + nvme: add boot partition log support.
  + nvme: add support for fid supported and effects log(lid =
    0x12).
  + add identify endurance group list (cns 0x19) support.
  + add json support for zns report zones.
  + fabrics: fix 'nvme discover' segfault if sysfs path is not
    available.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- Honor JSON config file in connect-all command (bsc#1203204 bsc#1203163)
  * add 0016-fabrics-nvme-config-modify-depends-on-n-and-t-argume.patch
  * add 0017-fabrics-Honor-JSON-config-file-in-connect-all-comman.patch
  * add 0018-fabrics-Trigger-auto-connect-if-config.json-exists.patch
- Add show-topology command (bsc#1200089)
  * add 0019-nvme-Add-show-topology-command.patch
  * add 0020-doc-Add-nvme-show-topology-documnetation.patch
  * add 0021-completions-Add-show-topology-tab-completion.patch</changelog>
  <changelog author="mwilck@suse.com" date="1669204800">- fix 'persistent' handling during connect-all with JSON file (bsc#1205657)
  * add 0022-fabrics-fix-persistent-handling-during-connect-all-w.patch</changelog>
</package>
<package pkgid="bf3d12032d931e32163f21e7c4b08c7ef6beac054f2ac1b237389a7a25ae7deb" name="nvme-cli" arch="aarch64">
  <version epoch="0" ver="2.0" rel="150400.3.9.3"/>
  <changelog author="daniel.wagner@suse.com" date="1629288000">- update to 1.15
  * add NVMe MI features
  * add uuid index in get and set features command
  * nvme-cli: Add lsi option for get-log command
  * nvme: add json output format for list_ns
  * fabrics: add fast_io_fail_tmo option
  * fabrics: add --host-iface option
  * nvme: add latency parameter for passthru commands
  * nvme: add optional copy format support id ctrl field
  * nvme: add zone desc changed notice async event
  * nvme: add json, binary and human readable output format for id iocs
  * fabrics: print device name on connect
  * nvme: add get log page 2.0 spec fields
  * nvme: add the status codes from 2.0 spec
  * zns: add timeout parameter for Zone Management Commands
  * nvme: add CDW2 and CDW3 support for Write Zeroes and Verify Command
  * nvme: add Storage Tag Check field in NVM Commands
  * bash: updated completion support for latest commands and plugins
  * nvme: add capacity management command support
  * add identify CNS 0x18 domain list support</changelog>
  <changelog author="jsegitz@suse.com" date="1634040000">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_nvmf-connect@.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="dimstar@opensuse.org" date="1639051200">- Update to version 1.16:
  + Print ProductName found even if subvendor/subdevice is unknown.
  + Add New fields on PEL based on NVMe 2.0a.
  + nvme-cli:
  - Split media units written/read into hi/lo 64 bit fields.
  - Add support for new SN650 device.
  - Update WDC pluging version to 1.15.3.
  - fix the [data|mdata]_len param (boo#1193547).
  - Add support for C3/Latency Monitor Log page parsing.
  - ctrl-loss-tmo should accept -1 as value.
  + nvme: add spinup control feature (fid=0x1A).
  + nvme: Add Identify for CNS 08h NVMe spec 2.0a based.
  + nvme: add boot partition log support.
  + nvme: add support for fid supported and effects log(lid =
    0x12).
  + add identify endurance group list (cns 0x19) support.
  + add json support for zns report zones.
  + fabrics: fix 'nvme discover' segfault if sysfs path is not
    available.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- Honor JSON config file in connect-all command (bsc#1203204 bsc#1203163)
  * add 0016-fabrics-nvme-config-modify-depends-on-n-and-t-argume.patch
  * add 0017-fabrics-Honor-JSON-config-file-in-connect-all-comman.patch
  * add 0018-fabrics-Trigger-auto-connect-if-config.json-exists.patch
- Add show-topology command (bsc#1200089)
  * add 0019-nvme-Add-show-topology-command.patch
  * add 0020-doc-Add-nvme-show-topology-documnetation.patch
  * add 0021-completions-Add-show-topology-tab-completion.patch</changelog>
</package>
<package pkgid="ca8ed214ccdb65720f9361220dca06e29686b7ad8f8f3c0e672f77873ef9af69" name="nvme-cli" arch="src">
  <version epoch="0" ver="2.0" rel="150400.3.9.3"/>
  <changelog author="daniel.wagner@suse.com" date="1629288000">- update to 1.15
  * add NVMe MI features
  * add uuid index in get and set features command
  * nvme-cli: Add lsi option for get-log command
  * nvme: add json output format for list_ns
  * fabrics: add fast_io_fail_tmo option
  * fabrics: add --host-iface option
  * nvme: add latency parameter for passthru commands
  * nvme: add optional copy format support id ctrl field
  * nvme: add zone desc changed notice async event
  * nvme: add json, binary and human readable output format for id iocs
  * fabrics: print device name on connect
  * nvme: add get log page 2.0 spec fields
  * nvme: add the status codes from 2.0 spec
  * zns: add timeout parameter for Zone Management Commands
  * nvme: add CDW2 and CDW3 support for Write Zeroes and Verify Command
  * nvme: add Storage Tag Check field in NVM Commands
  * bash: updated completion support for latest commands and plugins
  * nvme: add capacity management command support
  * add identify CNS 0x18 domain list support</changelog>
  <changelog author="jsegitz@suse.com" date="1634040000">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_nvmf-connect@.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="dimstar@opensuse.org" date="1639051200">- Update to version 1.16:
  + Print ProductName found even if subvendor/subdevice is unknown.
  + Add New fields on PEL based on NVMe 2.0a.
  + nvme-cli:
  - Split media units written/read into hi/lo 64 bit fields.
  - Add support for new SN650 device.
  - Update WDC pluging version to 1.15.3.
  - fix the [data|mdata]_len param (boo#1193547).
  - Add support for C3/Latency Monitor Log page parsing.
  - ctrl-loss-tmo should accept -1 as value.
  + nvme: add spinup control feature (fid=0x1A).
  + nvme: Add Identify for CNS 08h NVMe spec 2.0a based.
  + nvme: add boot partition log support.
  + nvme: add support for fid supported and effects log(lid =
    0x12).
  + add identify endurance group list (cns 0x19) support.
  + add json support for zns report zones.
  + fabrics: fix 'nvme discover' segfault if sysfs path is not
    available.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- Honor JSON config file in connect-all command (bsc#1203204 bsc#1203163)
  * add 0016-fabrics-nvme-config-modify-depends-on-n-and-t-argume.patch
  * add 0017-fabrics-Honor-JSON-config-file-in-connect-all-comman.patch
  * add 0018-fabrics-Trigger-auto-connect-if-config.json-exists.patch
- Add show-topology command (bsc#1200089)
  * add 0019-nvme-Add-show-topology-command.patch
  * add 0020-doc-Add-nvme-show-topology-documnetation.patch
  * add 0021-completions-Add-show-topology-tab-completion.patch</changelog>
</package>
<package pkgid="27128a7132597c33d2d3ddb3692e8636114fe13e37f6de14e8deb3e1aff8b456" name="nvme-cli" arch="x86_64">
  <version epoch="0" ver="2.0" rel="150400.3.9.3"/>
  <changelog author="daniel.wagner@suse.com" date="1629288000">- update to 1.15
  * add NVMe MI features
  * add uuid index in get and set features command
  * nvme-cli: Add lsi option for get-log command
  * nvme: add json output format for list_ns
  * fabrics: add fast_io_fail_tmo option
  * fabrics: add --host-iface option
  * nvme: add latency parameter for passthru commands
  * nvme: add optional copy format support id ctrl field
  * nvme: add zone desc changed notice async event
  * nvme: add json, binary and human readable output format for id iocs
  * fabrics: print device name on connect
  * nvme: add get log page 2.0 spec fields
  * nvme: add the status codes from 2.0 spec
  * zns: add timeout parameter for Zone Management Commands
  * nvme: add CDW2 and CDW3 support for Write Zeroes and Verify Command
  * nvme: add Storage Tag Check field in NVM Commands
  * bash: updated completion support for latest commands and plugins
  * nvme: add capacity management command support
  * add identify CNS 0x18 domain list support</changelog>
  <changelog author="jsegitz@suse.com" date="1634040000">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_nvmf-connect@.service.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="dimstar@opensuse.org" date="1639051200">- Update to version 1.16:
  + Print ProductName found even if subvendor/subdevice is unknown.
  + Add New fields on PEL based on NVMe 2.0a.
  + nvme-cli:
  - Split media units written/read into hi/lo 64 bit fields.
  - Add support for new SN650 device.
  - Update WDC pluging version to 1.15.3.
  - fix the [data|mdata]_len param (boo#1193547).
  - Add support for C3/Latency Monitor Log page parsing.
  - ctrl-loss-tmo should accept -1 as value.
  + nvme: add spinup control feature (fid=0x1A).
  + nvme: Add Identify for CNS 08h NVMe spec 2.0a based.
  + nvme: add boot partition log support.
  + nvme: add support for fid supported and effects log(lid =
    0x12).
  + add identify endurance group list (cns 0x19) support.
  + add json support for zns report zones.
  + fabrics: fix 'nvme discover' segfault if sysfs path is not
    available.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642161600">- Update to v2.0-rc0
  * Depends on libnvme
  * rename harden_nvmf-connect@.service.patch to 0100-harden_nvmf-connect@.service.patch
  * drop 0102-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642420800">- Update Source URL and introduce a variable for the release canditate
  version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="dwagner@suse.de" date="1668513600">- Honor JSON config file in connect-all command (bsc#1203204 bsc#1203163)
  * add 0016-fabrics-nvme-config-modify-depends-on-n-and-t-argume.patch
  * add 0017-fabrics-Honor-JSON-config-file-in-connect-all-comman.patch
  * add 0018-fabrics-Trigger-auto-connect-if-config.json-exists.patch
- Add show-topology command (bsc#1200089)
  * add 0019-nvme-Add-show-topology-command.patch
  * add 0020-doc-Add-nvme-show-topology-documnetation.patch
  * add 0021-completions-Add-show-topology-tab-completion.patch</changelog>
</package>
<package pkgid="110763db3888ece58335ebd0c41983f945902c53292c2cce7165b9f13c2c0152" name="open-vm-tools" arch="src">
  <version epoch="0" ver="12.1.0" rel="150300.21.2"/>
  <changelog author="kallan@suse.com" date="1583496000">- Update to 11.0.5 (build 15389592) (boo#1165955)
  + DNS server is reported incorrectly as '127.0.0.53' when using
    systemd-resolved. DNS server is reported incorrectly in GuestInfo as
    '127.0.0.53' , when the OS uses systemd-resolved. This issue is fixed
    in this release.
- Conditionalized the use of systemd_ordering.  Use systemd_ordering
  for factory, openSUSE &gt;= 15, and SLE &gt;= 15.  Use systemd_requires
  for older openSUSE and SLE releases.
- Conditionalize out the use of %license COPYING for SLE 12 SP2 and older.
- Added patches
  + gcc10-warning.patch (boo#1160408)
  + diskinfo-debug-logging-1162435.patch (boo#1162435 and bsc#1162119)
  - Changed g_warning to g_debug
  + app_info_plugin.patch (boo#1165955)
- Drop unnecessary patch:
  - fix-leaks-Aliases-MappedAliases.patch</changelog>
  <changelog author="kallan@suse.com" date="1583755200">- Simplified the conditional around systemd_ordering to just use
  suse_version &gt;= 1500.</changelog>
  <changelog author="kallan@suse.com" date="1589544000">- Update to 11.1.0 (build 16036546) (boo#1171764, boo#1171765)
  + open-vm-tools 11.1.0 includes a new 'Service Discovery' plugin, which
    connects with the vRealize Operations Manager product.  For more
    information and details on configuring this plugin, refer to Configuring
    Service Discovery.
  + In this release, a new tools.conf switch is added to enable and disable
    the guest customization in the guest virtual machine. By default, the
    guest customization is enabled. For more details, refer KB 78903.
- Spec file changes to remove the is_opensuse macros where possible.
- Remoed the mv vm-support line from the spec file.  vm-support is now
  automatically placed in the /usr/bin directory.
- Added version number to Requires: libxmlsec1-openssl1 to help with vgauth
  version checking.
- Added patches
  + pam-vmtoolsd.patch (boo#1171003)
- Drop unnecessary patch:
  - app_info_plugin.patch
  - diskinfo-debug-logging-1162435.patch
  - gcc9-static-inline.patch</changelog>
  <changelog author="kallan@suse.com" date="1590667200">- While updating to 11.1.0 (build 16036546) (boo#1171764) hold off on
  producing the open-vm-tools-sdmp (boo#1171765 Service Discover plugin)
  until it has gone through the ECO process.  Once approved, will resubmit
  to include the plugin.</changelog>
  <changelog author="kallan@suse.com" date="1591185600">- VMware has now asked that in updating to 11.1.0 (build 16036546) (boo#1171764)
  to hold off on producing the open-vm-tools-sdmp service discovery plugin
  (boo#1171765) for all SUSE versions due to the plugin's dependency on
  netstat.  Once they have removed the netstat dependency we will need to go
  through the ECO process to get the plugin added.</changelog>
  <changelog author="kallan@suse.com" date="1592395200">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
- Fixed bug (bsc#1172693) by removing the 'pam_securetty.so' line from
  pam-vmtoolsd.patch as instructed by vmware (boo#1171003).
  This should fix both (boo#1171003) and (bsc#1172693).</changelog>
  <changelog author="kallan@suse.com" date="1592481600">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
  with new 'Service Discovery' plugin (boo#1171765).
- Reenabled building sdmp in the spec file.
- Added patches (boo#1171765)
  + sdmp-get-version.patch
  + sdmp-netstat-to-ss.patch
  + sdmp-warnings.patch</changelog>
  <changelog author="kallan@suse.com" date="1598616000">- Update to 11.1.5 (build 16724464) (boo#1175573)
  + This source release rolls up the SDMP fixes release post 11.1.0.
  + Fix serveral Coverity reported issues.
  + Address github issues:
    https://github.com/vmware/open-vm-tools/issues/451
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/issues/428
- Drop unnecessary patch:
  - gcc10-warning.patch
  - sdmp-get-version.patch
  - sdmp-netstat-to-ss.patch
  - sdmp-warnings.patch</changelog>
  <changelog author="schwab@suse.de" date="1599480000">- Use libtirpc also in SLE-15-SP3</changelog>
  <changelog author="kallan@suse.com" date="1603281600">- Update to 11.2.0 (build 16938113) (boo#1177987)
  + Fixed memory leak occurs in disk device mapping information for IDE,
    SATA or SAS (LSI Logic SAS) disks configured in the guest.
  + The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/pull/431
    https://github.com/vmware/open-vm-tools/pull/432
    https://github.com/vmware/open-vm-tools/issues/452
  + A number of Coverity reported errors and false positives have been
    addressed.
  + A complete list of the granular changes that are in the open-vm-tools
    11.2.0 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.0/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch (boo#1177987): removed the pam_securetty.so line
  from the new suse file.  Modified the Makefile.am to copy the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1604923200">- Add explicit pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: used
  to be pulled in (as part of gdk-pixbuf) by GTK3 in the past. But
  as configure explicitly looks for it, it is our own duty to
  ensure its presence.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1606910400">- Enable build on aarch64</changelog>
  <changelog author="kallan@suse.com" date="1611230400">- Update to 11.2.5 (build 17337674) (boo#1180997)
  + Resolved issues:
  - The SUSE specific vmtoolsd PAM configuration file incorrectly referenced
    pam_securetty.so.
  - The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/467
    https://github.com/vmware/open-vm-tools/issues/468
    https://github.com/vmware/open-vm-tools/pull/469
  - A number of Coverity reported errors and false positives have been
    addressed.
  - A complete list of the granular changes that are in the
    open-vm-tools 11.2.5 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.5/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch: With the pam_securetty.so entry fixed, only need
  the modified Makefile.am portion of the patch which copies the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="lnussel@suse.de" date="1615809600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="dimstar@opensuse.org" date="1616760000">- Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67.
  Patch has been borrowed by Fedora, upstream is still busy working
  out a patch (I'd not be surprised if they end up merging this
  finally.
  https://github.com/vmware/open-vm-tools/issues/500</changelog>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
</package>
<package pkgid="94d3e556439ba9803cc79feb2a96d1c263ca46871f457f099eef3f2cf9f48470" name="open-vm-tools" arch="x86_64">
  <version epoch="0" ver="12.1.0" rel="150300.21.2"/>
  <changelog author="kallan@suse.com" date="1583496000">- Update to 11.0.5 (build 15389592) (boo#1165955)
  + DNS server is reported incorrectly as '127.0.0.53' when using
    systemd-resolved. DNS server is reported incorrectly in GuestInfo as
    '127.0.0.53' , when the OS uses systemd-resolved. This issue is fixed
    in this release.
- Conditionalized the use of systemd_ordering.  Use systemd_ordering
  for factory, openSUSE &gt;= 15, and SLE &gt;= 15.  Use systemd_requires
  for older openSUSE and SLE releases.
- Conditionalize out the use of %license COPYING for SLE 12 SP2 and older.
- Added patches
  + gcc10-warning.patch (boo#1160408)
  + diskinfo-debug-logging-1162435.patch (boo#1162435 and bsc#1162119)
  - Changed g_warning to g_debug
  + app_info_plugin.patch (boo#1165955)
- Drop unnecessary patch:
  - fix-leaks-Aliases-MappedAliases.patch</changelog>
  <changelog author="kallan@suse.com" date="1583755200">- Simplified the conditional around systemd_ordering to just use
  suse_version &gt;= 1500.</changelog>
  <changelog author="kallan@suse.com" date="1589544000">- Update to 11.1.0 (build 16036546) (boo#1171764, boo#1171765)
  + open-vm-tools 11.1.0 includes a new 'Service Discovery' plugin, which
    connects with the vRealize Operations Manager product.  For more
    information and details on configuring this plugin, refer to Configuring
    Service Discovery.
  + In this release, a new tools.conf switch is added to enable and disable
    the guest customization in the guest virtual machine. By default, the
    guest customization is enabled. For more details, refer KB 78903.
- Spec file changes to remove the is_opensuse macros where possible.
- Remoed the mv vm-support line from the spec file.  vm-support is now
  automatically placed in the /usr/bin directory.
- Added version number to Requires: libxmlsec1-openssl1 to help with vgauth
  version checking.
- Added patches
  + pam-vmtoolsd.patch (boo#1171003)
- Drop unnecessary patch:
  - app_info_plugin.patch
  - diskinfo-debug-logging-1162435.patch
  - gcc9-static-inline.patch</changelog>
  <changelog author="kallan@suse.com" date="1590667200">- While updating to 11.1.0 (build 16036546) (boo#1171764) hold off on
  producing the open-vm-tools-sdmp (boo#1171765 Service Discover plugin)
  until it has gone through the ECO process.  Once approved, will resubmit
  to include the plugin.</changelog>
  <changelog author="kallan@suse.com" date="1591185600">- VMware has now asked that in updating to 11.1.0 (build 16036546) (boo#1171764)
  to hold off on producing the open-vm-tools-sdmp service discovery plugin
  (boo#1171765) for all SUSE versions due to the plugin's dependency on
  netstat.  Once they have removed the netstat dependency we will need to go
  through the ECO process to get the plugin added.</changelog>
  <changelog author="kallan@suse.com" date="1592395200">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
- Fixed bug (bsc#1172693) by removing the 'pam_securetty.so' line from
  pam-vmtoolsd.patch as instructed by vmware (boo#1171003).
  This should fix both (boo#1171003) and (bsc#1172693).</changelog>
  <changelog author="kallan@suse.com" date="1592481600">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
  with new 'Service Discovery' plugin (boo#1171765).
- Reenabled building sdmp in the spec file.
- Added patches (boo#1171765)
  + sdmp-get-version.patch
  + sdmp-netstat-to-ss.patch
  + sdmp-warnings.patch</changelog>
  <changelog author="kallan@suse.com" date="1598616000">- Update to 11.1.5 (build 16724464) (boo#1175573)
  + This source release rolls up the SDMP fixes release post 11.1.0.
  + Fix serveral Coverity reported issues.
  + Address github issues:
    https://github.com/vmware/open-vm-tools/issues/451
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/issues/428
- Drop unnecessary patch:
  - gcc10-warning.patch
  - sdmp-get-version.patch
  - sdmp-netstat-to-ss.patch
  - sdmp-warnings.patch</changelog>
  <changelog author="schwab@suse.de" date="1599480000">- Use libtirpc also in SLE-15-SP3</changelog>
  <changelog author="kallan@suse.com" date="1603281600">- Update to 11.2.0 (build 16938113) (boo#1177987)
  + Fixed memory leak occurs in disk device mapping information for IDE,
    SATA or SAS (LSI Logic SAS) disks configured in the guest.
  + The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/pull/431
    https://github.com/vmware/open-vm-tools/pull/432
    https://github.com/vmware/open-vm-tools/issues/452
  + A number of Coverity reported errors and false positives have been
    addressed.
  + A complete list of the granular changes that are in the open-vm-tools
    11.2.0 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.0/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch (boo#1177987): removed the pam_securetty.so line
  from the new suse file.  Modified the Makefile.am to copy the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1604923200">- Add explicit pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: used
  to be pulled in (as part of gdk-pixbuf) by GTK3 in the past. But
  as configure explicitly looks for it, it is our own duty to
  ensure its presence.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1606910400">- Enable build on aarch64</changelog>
  <changelog author="kallan@suse.com" date="1611230400">- Update to 11.2.5 (build 17337674) (boo#1180997)
  + Resolved issues:
  - The SUSE specific vmtoolsd PAM configuration file incorrectly referenced
    pam_securetty.so.
  - The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/467
    https://github.com/vmware/open-vm-tools/issues/468
    https://github.com/vmware/open-vm-tools/pull/469
  - A number of Coverity reported errors and false positives have been
    addressed.
  - A complete list of the granular changes that are in the
    open-vm-tools 11.2.5 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.5/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch: With the pam_securetty.so entry fixed, only need
  the modified Makefile.am portion of the patch which copies the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="lnussel@suse.de" date="1615809600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="dimstar@opensuse.org" date="1616760000">- Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67.
  Patch has been borrowed by Fedora, upstream is still busy working
  out a patch (I'd not be surprised if they end up merging this
  finally.
  https://github.com/vmware/open-vm-tools/issues/500</changelog>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
</package>
<package pkgid="e652dc54df91d4de7c501934b0b7e983a157ff8c3f95d13ce27e565c356c507e" name="openssh" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="dff8fd3a65cda217d36711c727f3dc9a34a85c76ff1dfba10a2b95c5fad6af59" name="openssh" arch="src">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="42478d10f44f7d8776c476d3edcc540411082ac12921c5ffbba481593673302a" name="openssh" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="ac8f396e6b978d5f69f8536c8d518853b5aeb65c0e87827de192e2605429adaa" name="openssh-clients" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="f575d45bc89451e65147c5559f46da334c2faf8135c5ab9c5aec1b7a111212b1" name="openssh-clients" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="641f11bea3552ea7ba71a37f1086c85bc17d9255dc68dcc9cdfa642c0004e2e4" name="openssh-common" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="867321a6f70affee94a99e4450748f3acb53f780216c17ce25697ba8f00432ea" name="openssh-common" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="4499d476cea1ec3040d6c2170ab432e3f0ca0bcbbfbe4364810f737ccf4b33b4" name="openssh-fips" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="a3b69a1f72b38cba682d26e75c9d0876df33cf8943d644d026da6761e1798496" name="openssh-fips" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="32746bca9e6e8359924bafcae2ff9fdd4f0773674ae7ad3174ac8c4f140f7c94" name="openssh-server" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="140cc919055b9f9aae8e349d2651ca0b24a8032fd53fd5e3724712b227df46ce" name="openssh-server" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="8caf31b48ffcef1bd308ebbf173423da457b32d3c8c5119cb2be737d30a6598b" name="openssl-1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.16.1"/>
  <changelog author="pmonreal@suse.com" date="1647604800">- FIPS: Additional PBKDF2 requirements for KAT [bsc#1197280]
  * The IG 10.3.A and SP800-132 require some minimum parameters for
    the salt length, password length and iteration count. These
    parameters should be also used in the KAT.
  * Add openssl-1_1-FIPS-PBKDF2-KAT-requirements.patch</changelog>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
</package>
<package pkgid="52c8b8cb30199aba9fbc5a063879cb837db72fa8c1c6af988d6c7d3f45d7c7ba" name="openssl-1_1" arch="src">
  <version epoch="0" ver="1.1.1l" rel="150400.7.16.1"/>
  <changelog author="pmonreal@suse.com" date="1647604800">- FIPS: Additional PBKDF2 requirements for KAT [bsc#1197280]
  * The IG 10.3.A and SP800-132 require some minimum parameters for
    the salt length, password length and iteration count. These
    parameters should be also used in the KAT.
  * Add openssl-1_1-FIPS-PBKDF2-KAT-requirements.patch</changelog>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
</package>
<package pkgid="1f3c9236e0f48ff29aea341763378d91df082652ecc17b1e267b36f9427b46c1" name="openssl-1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.16.1"/>
  <changelog author="pmonreal@suse.com" date="1647604800">- FIPS: Additional PBKDF2 requirements for KAT [bsc#1197280]
  * The IG 10.3.A and SP800-132 require some minimum parameters for
    the salt length, password length and iteration count. These
    parameters should be also used in the KAT.
  * Add openssl-1_1-FIPS-PBKDF2-KAT-requirements.patch</changelog>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
</package>
<package pkgid="aea48c33f075a1346b8cc0bf2e822171f1ffbc579a89f897d0adad0dd61b03c9" name="openssl-1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.19.1"/>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
</package>
<package pkgid="096f7ce66506712731d41404c1ef1d05d5116dadc9e02b34d0150eaaf47c0a50" name="openssl-1_1" arch="src">
  <version epoch="0" ver="1.1.1l" rel="150400.7.19.1"/>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
</package>
<package pkgid="20ac87fc0297d4093219d92ebb03fa995f46fe683cbea6146e6a9f2f560a149d" name="openssl-1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.19.1"/>
  <changelog author="jsikes@suse.com" date="1650542400">- FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
  * Known answer test for ECDSA
  * bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
  * Enable tests for Deterministic Random Bit Generator
  * bsc#1198207
- Bypass a regression test that fails in FIPS mode.
  * [openssl-1_1-shortcut-test_afalg_aes_cbc.patch]</changelog>
  <changelog author="jsikes@suse.com" date="1651492800">- FIPS: Added signature verification test to
    bsc1185319-FIPS-KAT-for-ECDSA.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
</package>
<package pkgid="1ca20113db61fc785c9feab4ce7efdc72350169add31f15e3bb5a4c368cf5b1f" name="openssl-1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.22.1"/>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
</package>
<package pkgid="df4fe0fa3f17a8b2b36c6b0e812b3a6159d40c90797bedf1d6e8f38727b89eb3" name="openssl-1_1" arch="src">
  <version epoch="0" ver="1.1.1l" rel="150400.7.22.1"/>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
</package>
<package pkgid="29348390e1d94e41681abd3d0d1c4965f946abb71d6946e5ae139e79eb780baa" name="openssl-1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.22.1"/>
  <changelog author="jsikes@suse.com" date="1655467200">- Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
</package>
<package pkgid="460487f6122d7f6bc93826c7735ef7782b97d90a7c7dce1e82e4d7e23c648eb1" name="openssl-1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.25.1"/>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
</package>
<package pkgid="015f737c1a3391a8367824c188deba5ddd9c24ad17cc99ab2bae970fcfb334ea" name="openssl-1_1" arch="src">
  <version epoch="0" ver="1.1.1l" rel="150400.7.25.1"/>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
</package>
<package pkgid="313a9140d29e1db026233d72fe1f39cdfe43e064409063b42838d1c3ffc043be" name="openssl-1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.25.1"/>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
</package>
<package pkgid="31f3d05888817f346891403a475204247ac02ba26f28eccbfe8f61bac996fba7" name="openssl-1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.28.1"/>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
</package>
<package pkgid="38bd76b1b41476c5ffc19aac8405424457d97c6c18066c34d02d1d19020178b1" name="openssl-1_1" arch="src">
  <version epoch="0" ver="1.1.1l" rel="150400.7.28.1"/>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
</package>
<package pkgid="07f1117fccab966665a2cda616cef18ede3337312cabd67d656eef4e6b037ef3" name="openssl-1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150400.7.28.1"/>
  <changelog author="pmonreal@suse.com" date="1658404800">- FIPS: Add zeroization of temporary variables to the hmac integrity
  function FIPSCHECK_verify(). [bsc#1190653]
  * Add openssl-1_1-Zeroization.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1658404801">- FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
  * Add patches:
  - openssl-1_1-ossl-sli-000-fix-build-error.patch
  - openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
  - openssl-1_1-ossl-sli-002-ran-make-update.patch
  - openssl-1_1-ossl-sli-003-add-sli.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1661860800">- FIPS: OpenSSL: Port openssl to use jitterentropy
  [bsc#1202148, jsc#SLE-24941]
  * Add openssl-1_1-jitterentropy-3.4.0.patch
  * Add build dependency on jitterentropy-devel &gt;= 3.4.0 and
    libjitterentropy3 &gt;= 3.4.0</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662033600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120000">- FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
  * The FIPS_drbg implementation is not FIPS validated anymore. To
    provide backwards compatibility for applications that need FIPS
    compliant RNG number generation and use FIPS_drbg_generate,
    this function was re-wired to call the FIPS validated DRBG
    instance instead through the RAND_bytes() call.
  * Add openssl-1_1-FIPS_drbg-rewire.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1662120001">- FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
  * Add openssl-1_1-fips-drbg-selftest.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662724800">- FIPS: list only FIPS approved digest and public key algorithms
  [bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
  * Disabled test 15-test_ec.t in FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1663329600">- FIPS: Default to RFC-7919 groups for genparam and dhparam
  * Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995]</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664971200">- FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
  * Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1673956800">- FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
  * Add openssl-fips-DH-Pair-wise-Consistency.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
</package>
<package pkgid="99fa0c9a78a36443194839ab48e718944ca75b1cc22e3dd5cbab8c90840f6060" name="pixman" arch="src">
  <version epoch="0" ver="0.40.0" rel="150400.3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1342872000">- Update to version 0.26.2:
  + Some bug fixes.
  + Custom build rules for ARM/iwMMXt.
  + An important bug fix for MMX/x86.</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1352462400">- Update to version 0.28.0:
  + Support for sRGB coded images.
  + New API for fast glyph rendering.
  + Faster bilinear scaling on iwMMX, Loongson and MMX.
  + More fast paths in the MIPS DSPr2 backend.
  + Faster scaling in general and on SSE2 in particular.</changelog>
  <changelog author="vuntz@opensuse.org" date="1355227200">- Update to version 0.28.2:
  + Fixes for 64 bit Windows, clang, and PowerPC on MacOS and
    OpenBSD.</changelog>
  <changelog author="dimstar@opensuse.org" date="1368100800">- Update to version 0.30.0:
  + Support for high-quality image downscaling.
  + Much improved ARMv6 assembly.
  + Improved rendering quality for gradients.
  + Improvements to the SSE2 backend.
  + Improvements to MIPS DSPr2 backend.
  + Improvements to test suite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1375876800">- Update to version 0.30.2:
  + Require GTK+ version &gt;= 2.16.
  + Use AC_LINK_IFELSE to check if the Loongson MMI code can link.
  + configure.ac: Don't use '+=' since it's not POSIX.
  + test:
  - Fix build on MSVC.
  - fix matrix-test on big endian systems.
  + Fix broken build when HAVE_CONFIG_H is undefined, e.g. on
    Win32.</changelog>
  <changelog author="dmueller@suse.com" date="1382184000">- Disable neon on all %arm platforms.</changelog>
  <changelog author="dimstar@opensuse.org" date="1384776000">- Update to version 0.32.4:
  + Fix the SSSE3 CPUID detection.
- Changes from version 0.32.2:
  + Build fixes.
- Changes from version 0.32.0:
  + This release contains performance improvements to bilinear
    scaling, and a large number of bug fixes.</changelog>
  <changelog author="fcrozat@suse.com" date="1402056000">- RENDER extension hotfix: Add --disable-vmx for PPC64LE.
  This makes the RENDER extension work for the time being.
  Proper fix for vmx will come later (bnc#876757) (from Egbert
  Eich).</changelog>
  <changelog author="dimstar@opensuse.org" date="1404993600">- Update to version 0.32.6:
  + MIPS: Fix exported symbols in public API.
  + build: Check if the compiler supports GCC vector extensions.
  + Bugs fixed: rh#972647, fdo#69014.</changelog>
  <changelog author="zaitor@opensuse.org" date="1440244800">- Update to version 0.33.2:
  + ARMv6 - Many fast paths implementations were added.
  + PPC64/PPC64LE - Fix all outstanding bugs and add many fast
    paths implementations using vmx.
  + Major enhancements to lowlevel-blt-bench utility.
  + A couple of fixes and enhancements to mmx code.</changelog>
  <changelog author="zaitor@opensuse.org" date="1445947200">- Update to version 0.33.4:
  + Important security fix to prevent stack buffer overflow.
  + POWER: New fast-paths and optimizations to existing fast-paths.
  + ARMv6: New fast-path.
  + Tests: New cover and fence-image-self tests.
  + Remove redundant corrections in various calculations for
    COVER-CLIP and COVER analysis.</changelog>
  <changelog author="zaitor@opensuse.org" date="1451736000">- Update to version 0.33.6:
  + configura.ac: fix test for SSE2 &amp; SSSE3 assembler support.
  + mmx: Improve detection of support for "K" constraint.
  + Revert "mmx: Use MMX2 intrinsics from xmmintrin.h directly".</changelog>
  <changelog author="zaitor@opensuse.org" date="1454328000">- Update to version 0.34.0:
  + No changes from last version, stable version release only.</changelog>
  <changelog author="zaitor@opensuse.org" date="1459771200">- Add pixman-private-correct-include.patch: pixman-private: include
  &lt;float.h&gt; only in C code, patch from upstream git.</changelog>
  <changelog author="mgorse@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520251200">- Fix SRPM group. Update summaries.</changelog>
  <changelog author="mvetter@suse.com" date="1542974400">- Update to version 0.36.0:
  + Add tests for (a)rgb floating point formats
  + Add support for argb/xrgb float formats, v5
  + Fix stride calculation in stress-test
  + Adjust for clang's removal of __builtin_shuffle
  + Fix vector loads on ppc64le
  + Promote unsigned short to unsigned int explicitly
  + pixman-filter: Made Gaussian a bit wider
  + pixman-filter: Nested polynomial for cubic
  + pixman-filter: Fix several issues related to normalization
  + pixman-filter: Speed up BOX/BOX filter
  + pixman-filter: integral splitting is only needed for triangle
    filterdd
  + pixman-filter: Correct Simpsons integration
  + pixman-filter: reduce amount of malloc/free/memcpy to generate
    filter
  + pixman-image: Added enable-gnuplot config to view filters in
    gnuplot
  + pixman-fast-path.c: Pick NEAREST affine fast paths before
    BILINEAR ones
  + pixman-private: include &lt;float.h&gt; only in C code
- Remove pixman-private-correct-include.patch: upstreamed</changelog>
  <changelog author="info@paolostivanin.com" date="1587384000">- Update to versio 0.40.0:
  + Meson build system improvements
  + Supporting optimizations on Hygon Dhyana processors
    to match what is enabled for Intel/AMD CPUs.
  + A few Loongson fixes/improvements.
  + Lots of other fixes</changelog>
  <changelog author="mgorse@suse.com" date="1667563200">- Add pixman-CVE-2022-44638.patch: avoid an integer overflow
  (boo#1205033 CVE-2022-44638).</changelog>
</package>
<package pkgid="f8cec5fb59a447e7951645521583d7fbb79690b91e55d71362b57c9c5707e2d7" name="podman" arch="aarch64">
  <version epoch="0" ver="4.3.1" rel="150400.4.11.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024 / bsc#1193166, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190 / bsc#1193273, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="rbrown@suse.com" date="1647432000">- Update to version 4.0.2:
  * Bump to v4.0.2
  * Update release notes for v4.0.2
  * Revert "use GetRuntimeDir() from c/common"
  * Revert "Option --url and --connection should imply --remote."
  * Option --url and --connection should imply --remote.
  * Bump to v4.0.2-dev
  * Bump to v4.0.1
  * Update release notes for v4.0.1
  * Fix a potential flake in volume plugins tests
  * Propagate $CONTAINERS_CONF to conmon
  * tests: Remove inaccurate comment
  * System tests: show one-line config overview
  * provide better error on invalid flag
  * use GetRuntimeDir() from c/common
  * kube: honor --build=false and make --build=true by default
  * system tests: cleanup networks on teardown
  * Remove the runtime lock
  * Don't log errors on removing volumes inuse, if container --volumes-from
  * kube: honor mount propagation mode
  * Load ip_tables modules at boot
  * Cirrus: Disable F34 aka prior-fedora testing
  * Cirrus: Update VM Images for 4.0 release
  * Bump to v4.0.1-dev
  * Bump to v4.0.0
  * Release notes for v4.0.0 final
  * Fix lint
  * Fix manifest 4.0 Endpoints Branch forced 4.0 only endpoints
  * Introduce podman machine init --root=t|f and podman machine set --root=t|f
  * Initial implementation of mac forwarding using a privileged docker sock claim helper
  * ignition: propagate proxy settings from a host into a vm
  * Update to podman4 copr stream
  * Unify ls --filter docs for networks and pods
  * e2e: merge after/since image-filter tests
  * podman network: add documentation for netavark
  * create: Fix key=value annotation in the flag output
  * enable netavark specific tests
  * Fix checkpoint/restore pod tests
  * Make sure building with relative paths work correctly.
  * Add 409 response to swagger godoc
  * Fix images since/after tests
  * Changes of docker descriptions
  * Temporarily pull machine images from side repo
  * Cirrus: TODO: netavark/aardvark release branches
  * Cirrus: Expand netavark testing to include rootless
  * Cirrus: Minor - limit release task applicability
  * Cirrus: Add [CI:BUILD] magic that only builds
  * CI: fix nightly builds
  * Cirrus: Log netavark/aardvark binary build info.
  * Cirrus: Add netavark/aardvark system test task
  * Cirrus: Also download aardvark-dns binary
  * Cirrus: Add e2e task w/ upstream netavark
  * Revert minimum API change
  * netavark e2e tests
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC5
  * Update release notes for v4.0.0-RC5
  * Modify /etc/resolv.conf when connecting/disconnecting
  * Do not set the network config dir to cni plugin dir
  * Show API doc for several versions
  * [NO NEW TEST NEEDED] Add schema for ImageCreate 200 response.
  * fix: Multiplication of durations
  * move rootless netns slirp4netns process to systemd user.slice
  * compat: endpoint /build must set header content type as application/json in reponse
  * Cleanup: remove obsolete/misleading bug workaround
  * tests: retrofit healthcheck system tests
  * healthcheck, libpod: Read healthcheck event output from os pipe
  * Fix: Do not print error when parsing journald log fails
  * Bump github.com/buger/goterm from 1.0.1 to 1.0.4
  * append podman dns search domain
  * Podman pod create --share-parent vs --share=cgroup
  * System tests: revert emergency skip of checkpoint tests
  * Add version guard to libpod API endpoints
  * [v4.0] Bump c/common to v0.47.4
  * idmap should be able to be specified along with other options
  * Vendor in containers/buildah v1.24.1
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC4
  * Disable failing E2E test
  * Revert "Move each search dns to its own line"
  * Move each search dns to its own line
  * Update release notes for v4.0.0-RC4
  * Document `schema` values in the `--url` flag
  * podman image scp syntax correction
  * system prune: remove all networks
  * Only change network fields if they were actually changed by the user
  * docs: clarify rootless net stats
  * Fix size to match Docker selection
  * libpod: enforce noexec,nosuid,nodev for /dev/shm
  * Clarify remote client means Mac and Windows
  * libpod: report slirp4netns network stats
  * Add notes to "--oom-kill-disable" not supported on cgroups V2
  * Fix use of infra image to clarify default
  * Adapt podman images ls filters docs to be aligned with prune filters docs
  * ignition, machine: delegate cpu,io cgroup controllers to machine's default users
  * pkg/bindings/images.Build(): slashify "dockerfile" values, too
  * Remove mention of IPv6 portfwd from release notes
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC3
  * Update release notes for v4.0.0-RC3
  * Fix Cirrus destination branch
  * volume: add support for non-volatile upperdir,workdir for overlay volumes
  * github: label issues based on os fix regex
  * github: label issues based on os
  * Cirrus: Fix get_ci_vm.sh initial setup
  * System tests: emergency skip of checkpoint tests
  * network create: allow multiple subnets
  * Update troubleshooting.md
  * Fix sort ordering of filters
  * Unify podman prune filter description: volumes, networks, system
  * Bump Buildah to v1.24.0
  * rootless: drop permission check for devices
  * switch podman image scp from depending on machinectl to just os/exec
  * Bump github.com/containers/image/v5 from 5.18.0 to 5.19.0
  * Bump github.com/containers/storage from 1.38.0 to 1.38.1
  * change location of where make outputs podman binary on osx
  * Github workflow: Fix parsing of GraphQL response JSON
  * Github-workflow: Fix YAML syntax
  * Update godoc, swagger using wrong struct
  * Makefile: install targets independent of build
  * [CI:DOCS] Fix typos and improve language
  * CI: enable rootless-remote system tests
  * pkg/specgen/generate/security: fix error message
  * Github workflow: Send e-mail on job error
  * Github workflow: Update Cirrus-cron GraphQL query
  * remote build: set rootless oci isolation correctly
  * [CI:DOCS] Fix typos and improve language
  * Fix handling of duplicate matches on id expansion
  * Show correct default values or show none
  * exec: retry rm -rf on ENOTEMPTY and EBUSY
  * container create: do not check for network dns support
  * libpod: fix leaking fd
  * libpod: fix connection leak
  * [CI:DOCS] fix typo subpordinate
  * Fix filter description and unify filters docs for containers/images prune
  * Remove unused param and clean API handlers
  * Restore machine start logic that was hanging
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC2
  * Final release notes for v4.0.0-rc2
  * Run codespell on code
  * Update release notes for Podman v4.0.0
  * Fix #2 for compat commit handling of --changes
  * Fix nil pointer dereference for configmap optional
  * Make error message matching in 030-run.bats less fragile
  * Don't explicitly check for crun|runc in package information
  * Don't segfault if an image layer has no creation timestamp
  * compat: remove hardcoded index from load images output report
  * compat: images/load must be able to load tar with multiple images
  * System tests: fix for new systemd on rawhide
  * Remove rootless_networking option from containers.conf
  * vendor c/psgo@v1.7.2 (fixes CVE-2022-1227 / bsc#1182428)
  * Engine.Remote from containers.conf
  * vendor: bump c/common and other vendors
  * rootless: report correctly the error
  * Implement API forwarding for podman machine on Windows
  * Implement env parsing on Windows
  * Handle changes in docker compat mode
  * Show package version when running on alpine
  * Handlers for `generate systemd` with custom dependencies
  * APIv2 tests: followup to recent log test
  * Add IndexConfigs to compat /info endpoint
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * apiv2 test: add regression test for #12904
  * SECURITY.md: fix the project name
  * rename --cni-config-dir to --network-config-dir
  * compat attach: fix write on closed channel
  * upgrade all dependencies
  * Revert "Cirrus: Temporarily disable OSX Cross task"
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * bump go module to version 4
  * [NO NEW TESTS NEEDED] add builddeps to copr template
  * CI: rootless user: also create in some root tests
  * [WIP] Tests for podman image scp (the sudo form)
  * Revamp Libpod state strings for Docker compat
  * Cirrus: Temporarily disable OSX Cross task
  * update c/common to latest
  * Use PODMAN_USERNS environment variable when running as a service
  * Unify the method of parsing filters in cmd
  * fix default branch links
  * [CI:DOCS] fix default branch links
  * [CI:DOCS] Unprivileged native overlayfs is now supported
  * [CI:DOCS] Fix typo in --env
  * Recursively copy cert files.
  * Refactor manifest list operations
  * Add rpkg template for COPR autobuild
  * Fix cgroup mode handling in api server
  * Standardize on capatalized Cgroups
  * test/system: podman run update /etc/hosts
  * Remove two GetImages functions from API
  * Use fully-qualified device name in CDI test
  * Use new CDI API
  * troubleshooting links to main branch
  * Podman Build use absolute filepath
  * Prohibit --uid/gid map and --pod for container create/run
  * podman container rm: remove pod
  * Manual fixes for PR #12642:
  * podman build enable --all-platforms and --unsetenv
  * use events_logfile_path from containers.conf for events log.
  * Podman Pod Create --sysctl support
  * Wait for podman stop to complete
  * libpod: fix check for systemd session
  * libpod: refine check for empty pod cgroup
  * fix buildah-bud test diff
  * upgrade test: check that network backend is cni
  * use netns package from c/common
  * update buildah to latest and use new network stack
  * podman image scp: implement --quiet
  * use libnetwork from c/common
  * Add --noout option to prevent the output of ids
  * remote events: convert TimeNano properly
  * Bump github.com/BurntSushi/toml from 0.4.1 to 1.0.0
  * vendor latest c/common
  * add additional fields to podman machine ls --json
  * buildah bud tests: skip failing tests
  * Fix permission on secrets directory
  * Add podman rm --depend
  * fix host.containers.internal entry for macvlan networks
  * It takes some time to start a VM
  * Pretty Print output of podman machine ls --format json
  * Use the InfraImage defined in containers.conf
  * Cirrus: Freshen VM images
  * Revert "Cirrus: Temp. ignore gitlab task failures"
  * pkg: use PROXY_VARS from c/common
  * ignition: add support from setting SSL_CERT_FILE
  * ignition: propogate HTTP proxy variables from host to remote
  * System tests: fix RHEL8 gating tests
  * vendor c/common
  * Remove dead RuntimeOption functions
  * Update docker cli message for case where user creates directory
  * Don't add env if optional and not found
  * Fix type-o in podman.wxs
  * [CI:DOCS] fixes indentation of example pod yaml
  * Prevent double decoding of storage options
  * Emergency system-test fixes
  * add OCI Runtime name to errors
  * fix healthcheck timeouts and ut8 coercion
  * Don't rename pod if container has the same name
  * Set volume NeedsCopyUp to false iff data was copied up
  * Fix CI
  * correct typo words in docs
  * Change Tests to ignore missing containers when removing --all
  * test/e2e/pod_initcontainers: fix a flake
  * test/e2e/run: don't use date +%N on Alpine
  * Support all volume mounts for rootless containers
  * Fix wrong 'podman search --format' placeholder
  * Fix Container List API call to return mount info
  * fix misleading comment regarding default value of cpu period [NO NEW TESTS NEEDED]
  * add --ip6 flag to podman create/run
  * legacy events: also set exitCode
  * Don't initialize the global RNG with GinkgoRandomSeed() in e2e tests
  * Avoid collisions on RemoteSocket paths
  * Refactor remote socket path determination in tests
  * fix doc
  * test/system: podman run image with filesystem permission
  * test/system: podman run with log-opt option
  * Update swagger documentation
  * Make it possible to select the volume driver
  * Check the mount type for future compatibility
  * Implement virtfs volumes for podman machine
  * [CI:DOCS] Add example of cpus to init command
  * prefix imageId with sha256: in containers list test for compat API ImageId
  * Pod Security Option support
  * ignition: add certs from current user into the machine while init
  * docs: sort swagger operations alpabetically
  * .service file removal on failure
  * Introduce Windows WSL implementation of podman machine
  * podman image scp never enter podman user NS
  * Allow users to add host user accounts to /etc/passwd
  * container creation: don't apply reserved annotations from image
  * [CI:DOCS] clarify `io.podman.annotations.seccomp`
  * Error out early if system does not support pre-copy checkpointing
  * Update go-criu to v5.3.0
  * [CI:DOCS] docs: document rootless userns mappings
  * Switch to a new installer approach using a path manipulation helper
  * e2e: Add dev/shm checkpoint/restore test
  * Enable checkpoint/restore for /dev/shm
  * Update github.com/checkpoint-restore/checkpointctl
  * Always run passwd management code when DB value is nil
  * Warn on use of --kernel-memory
  * support hosts without /etc/hosts
  * Podman run --passwd
  * ci: force scratch build for crun
  * Use hosts public ip address in rootless containers
  * compat: image normalization: handle sha256 prefix
  * specgen: honor userns=auto from containers.conf
  * [CI:DOCS] Small checkpoint/restore man page fixes
  * [CI:DOCS] Explicitly mention that checkpointing systemd containers might fail
  * vendor: update containers/storage
  * build: fix test for subid 4
  * test: add --rm to podman run commands
  * fix(generate): fix up podman generate kube missing env field bug
  * legacy events: also set Action="die"
  * rootless: include the args in the debug message
  * apiv2 tests: use quay.io/libpod/testimage:20210610 for platform tests
  * image rm: allow for force-remove infra images
  * tests: adjust old build test to expect exit code
  * Test for checkpoint specific inspect fields
  * Add more checkpoint/restore information to 'inspect'
  * build: relay exitcode from imagebuildah to registry
  * Removed .service file for healthchecks
  * Set machine timezone
  * MovePauseProcessToScope do not seed everytime
  * bindings rmi test: clarify behavior
  * bump cobra to 1.3.0
  * .github: revert to the old template
  * oci: configure the devices cgroup with default devices
  * kill: fix output
  * e2e: search flake: skip test on registry.redhat.io
  * APIv2 tests: fail on syntax/logic errors
  * Show --external containers even without --all option
  * apiv2 tests: refactor complicated curls
  * fix network id handling
  * Update Windows Install Doc
  * Fixes #12063 Add docker compatible output after image build.
  * pause scope: don't use the global math/rand RNG
  * specgen: check that networks are only set with bridge
  * container restore/import: store networks from db
  * play kube add support for multiple networks
  * support advanced network configuration via cli
  * Add new networks format to spegecen
  * fix incorrect swagger doc for network dis/connect
  * network connect allow ip, ipv6 and mac address
  * network db: add new strucutre to container create
  * remove unneeded return value from c.Networks()
  * network db rewrite: migrate existing settings
  * network ls: show networks in deterministic order
  * Bump github.com/docker/docker
  * pprof flakes: bump timeout to 20 seconds
  * Add secret list --filter to cli
  * Cirrus: Temp. ignore gitlab task failures
  * compat build: adhere to q/quiet
  * Make XRegistryAuthHeader and XRegistryConfigHeader private
  * Remove the authfile parameter of MakeXRegistryAuthHeader
  * Simplify the header decision in pkg/bindings/images.Build a bit
  * Remove the authfile parameter of MakeXRegistryConfigHeader
  * Remove no-longer-useful name variables
  * Consolidate creation of SystemContext with auth.json into a helper
  * Remove pkg/auth.Header
  * Call MakeXRegistryAuthHeader instead of Header(..., XRegistryAuthHeader)
  * Turn headerAuth into MakeXRegistryAuthHeader
  * Call MakeXRegistryConfigHeader instead of Header(..., XRegistryConfigHeader)
  * Turn headerConfig into MakeXRegistryConfigHeader
  * Move the auth file creation to GetCredentials
  * Consolidate the error handling path in GetCredentials
  * Only look up HTTP header values once in GetCredentials
  * Use Header.Values in GetCredentials.has
  * Beautify GetCredentials.has a bit
  * Pass a header value directly to parseSingleAuthHeader and parseMultiAuthHeader
  * Simplify parseSingleAuthHeader
  * Simplify the interface of parseSingleAuthHeader
  * Don't return a header name from auth.GetCredentials
  * Fix normalizeAuthFileKey to use the correct semantics
  * Rename normalize and a few variables
  * Add TestHeaderGetCredentialsRoundtrip
  * Add tests for auth.Header
  * Improve TestAuthConfigsToAuthFile
  * Add unit tests for singleAuthHeader
  * Add unit tests for multiAuthHeader
  * fix e2e test missing network cleanup
  * pprof CI flakes: enforce 5 seconds grace period
  * [NO NEW TESTS NEEDED] rootless: declare TEMP_FAILURE_RETRY before usage (Fixes: #12563)
  * --hostname should be set when using --pod new:foobar
  * Cirrus: Use cached swagger binary
  * inotify: make sure to remove files
  * System tests: remove rm_pause_image()
  * specgen: honor empty args for entrypoint
  * generate systemd: support entrypoint JSON strings
  * Bump github.com/uber/jaeger-client-go
  * remove runlabel test for global opts
  * utils: reintroduce moveToCgroup
  * autocopr: distro conditionals for containers-common
  * vendor c/image/v5@main
  * Update vendor or containers/common moving pkg/cgroups there
  * volume: apply exact permission of target directory without adding extra 0111
  * Cirrus: Remove remnants of nix-based static build
  * Refactor podman pods to report.Formatter
  * rootless netns: resolve all path components for resolv.conf
  * tests: clean up FIXMEs and noise
  * fix remote run/start flake
  * e2e: fix pprof flakes
  * Bump github.com/opencontainers/runc from 1.0.2 to 1.0.3
  * vendor c/common@main
  * Escape trailing slash in install directory location so the closing quote is not escaped
  * centos 9 stream cannot use %autochangelog
  * Refactor podman system to report.Formatter [NO NEW TESTS NEEDED]
  * add spec file for automated copr builds
  * Add restart-sec option to systemd generate
  * Fix documentation of (podman image save --compress --uncompressed)
  * Improve documentation of (podman image save --format)
  * Add support for configmap volumes to play kube
  * cmd, push: use the configured compression format
  * [CI:DOCS] logformatter: fix corner case with links
  * UPdate vendor of image-spec and containers/storage
  * vendor: update containers/common
  * Update doc to explictly mention using ed25519 in ssh keys
  * Refactor podman image command output
  * Manual fixes
  * Same thing, with BeNumerically("==", x)
  * Use HaveLen(x) instead of Expect(len(y)).To(Equal(x))
  * Same thing, for BeNumerically("==", 0)
  * Use BeEmpty() instead of len(x).To(Equal(0))
  * Same as previous, for assertions other than Equal()
  * e2e tests: a little more minor cleanup
  * compat API: push: report size of manifest
  * compat: images/json
  * Add ashley-cui, lsm5 and floutoc to owners
  * remove ARTIFACT_DIR and ArtifactPath
  * Image caches: allow overriding cache dir
  * Rename CrioRoot as just Root
  * Fix possible rootless netns cleanup race
  * [NO NEW TESTS NEEDED] Refactor podman container command output
  * Hostname in `spec.hostname` should be passed to infra ctr init opt
  * container, cgroup: detect pid termination
  * top: parse ps(1) args correctly
  * podman, push: expose --compression-format
  * e2e: yet more cleanup of BeTrue/BeFalse
  * Ensure the generated NodePort values are unique
  * Allow containerPortsToServicePorts to fail
  * Don't use the global math/rand RNG for service ports
  * Move a comment to the relevant place
  * a few more manual BeTrue cleanups
  * Convert strings.Contains() to Expect(ContainSubstring)
  * e2e tests: more cleanup of BeTrue()s
  * Implement 'podman run --blkio-weight-device'
  * systemd: replace multi-user with default.target
  * compat API: allow enforcing short-names resolution to Docker Hub
  * Fixed the containerfile not found during remote build.
  * podman-remote: prevent leaking secret into image
  * podman-remote: copy secret to contextdir is absolute path on host
  * api: allow build api to accept secrets
  * Only open save output file with WRONLY
  * List /etc/containers/certs.d as default for --cert-path
  * e2e tests: enable golint
  * fix: parsing of HostConfig.Mounts for container create
  * Move the chown to after the ADDs
  * fix: error reporting for archive endpoint
  * Bindings test: emit GIT_COMMIT, for links in logs
  * checkpoint do not modify XDG_RUNTIME_DIR
  * libpod: improve heuristic to detect cgroup
  * libpod, inspect: export cgroup path
  * stats: get the memory limit from the spec
  * compat: Add compatiblity with Docker/Moby API for scenarios where build fails
  * libpod: leave thread locked on errors
  * Find and fix empty Expect()s
  * Unset SocketLabel after system finishes checkpointing
  * Remove StringInSlice(), part 2
  * Remove StringInSlice(), part 1
  * e2e test cleanup, continued
  * Update basic_networking.md
  * Warn on failing to update container status
  * oci: ack crun output when container is not there
  * oci: exit gracefully if container is already dead
  * Support env variables based on ConfigMaps sent in payload
  * image lookup: do not match *any* tags
  * generate systemd: add --start-timeout flag
  * Oops! Manual edits to broken tests
  * e2e tests: clean up antihelpful BeTrue()s
  * Cirrus: Strip out static nix build
  * Rename pod on generate of container
  * [CI:DOCS] Update notes on java TZ in man page
  * Bump github.com/containers/image/v5 from 5.16.1 to 5.17.0
  * Fix netavark error handling and teardown issue
  * swagger: add layers to build api docs
  * compat: add layer caching compatiblity for non podman clients
  * Bump github.com/opencontainers/selinux from 1.9.1 to 1.10.0
  * Add note about volume with unprivileged container
  * Add EXPOSE e2e test
  * Support EXPOSE with port ranges
  * compat: Add subnet mask behind IP address to match Docker API
  * [CI:DOCS] Add java TZ note to run manpage
  * Bump github.com/rootless-containers/rootlesskit from 0.14.5 to 0.14.6
  * podman-remote does not support signature-policy
  * Add tests for restore runtime verification
  * Use same runtime to restore a container as during checkpointing
  * Force iptables driver for netavark tests
  * Make sure netavark output is logged to the syslog
  * filter: use filepath.Match to maintain consistency with other pattern matching in podman
  * Semiperiodic cleanup of obsolete Skip()s
  * [CI:DOCS]upload a translation file
  * api/handlers: Add checkpoint/restore FileLocks
  * test: Update error string for --file-locks test
  * fix duplicated logs command
  * Bump github.com/docker/docker
  * Bump k8s.io/api from 0.22.3 to 0.22.4
  * Do not store the exit command in container config
  * Add test for checkpoint/restore with --file-locks
  * Add --file-locks checkpoint/restore option
  * Cirrus: Bump Fedora to release 35
  * Cirrus: Partially revert catatonit --force install
  * Revert "Cirrus: Temp. disable prior-fedora testing"
  * Cirrus: Workaround log_driver=journald setting
  * Cirrus: Fix bindings test hang b/c logging config mismatch
  * Cirrus: Timeout bindings test after 30m
  * Cirrus: Log more things in bindings and unit tests
  * Minor Makefile fix
  * rootless netns, one netns per libpod tmp dir
  * Introduce Address type to be used in secondary IPv4 and IPv6 inspect data structure.
  * volumes: add new option idmap
  * remote checkpoint/restore: more fixes
  * fix CI
  * fix: take absolute path for dd on apple silicon
  * System tests: new checkpoint tests
  * rootless: use catatonit to maintain user+mnt namespace
  * rootless: drop strerror(errno) calls
  * rootless: reuse existing open_namespace function
  * rootless: use auto cleanup functions
  * utils: use podman-pause-$RANDOM.scope name
  * hack/bats: deal with new bin helpers
  * Change error message for compatibility with docker
  * rename libpod nettypes fields
  * podman machine start wait for ssh
  * fix remote checkpoint/restore
  * Add --unsetenv &amp; --unsetenv-all to remove def environment variables
  * Set config environment variables early in Podman init
  * journald logs: keep reading until the journal's end
  * secret: honor custom target for secrets with run
  * bindings: reuse context for API requests
  * podman machine improve port forwarding
  * Network test: fix podman-remote-rootless corner case
  * filter: add basic pattern matching for label keys
  * cirrus: force-install catatonit
  * infra container: replace pause with catatonit
  * Revert "add kubernetes pause"
  * Added test for checkpoint/restore --print-stats
  * Update man pages for checkpoint/restore --print-stats
  * Added optional container restore statistics
  * Added optional container checkpointing statistics
  * Error logs --follow if events-backend != journald, event-logger=journald
  * Enable 'podman run --memory-swappiness=0'
  * Fix network mode in play kube
  * Always create working directory when using compat API
  * play kube: don't force-pull infra image
  * Podman Image SCP transfer patch
  * --authfile command line argument for image sign command.
  * Cirrus: Temp. disable prior-fedora testing
  * Cirrus: Update to Ubuntu 21.10
  * Add failing run test for netavark
  * Add flag to overwrite network backend from config
  * libpod: create /etc/mtab safely
  * Add network backend to podman info
  * Add more netavark tests
  * select network backend based on config
  * Fix RUST_LOG envar for netavark
  * netavark IPAM assignment
  * netavark network interface
  * Make networking code reusable
  * Fix flake in upgrade tests
  * export adding id-specifier code to setContainerNameForTemplate
  * VOLUME must be declared after RUN chown command
  * network reload return error if we cannot reload ports
  * network reload without ports should not reload ports
  * Print headers for system connection ls
  * [CI:DOCS] Add CI check for SEE ALSO in man pages
  * podman load: support downloading files
  * Add links to all SEE ALSO sections
  * pod create: read infra image from containers.conf
  * rootless: adjust error message
  * Fix rootless networking with userns and ports
  * support health checks from image configs
  * change from run to create in 250-systemd.bats
  * Exclude already built sources for static build
  * shm_lock: Handle ENOSPC better in AllocateSemaphore
  * Fix Zsh completion command documentation
  * Match .c files in Makefile
  * Add Static Build download instructions to README
  * Add links to podman build,run, create see also
  * Minor test tweaks
  * pod create: read network mode from config
  * Bump Catatonit up to v0.1.7
  * test connection add
  * system: Adds support for removing all named destination via --all
  * pod/container create: resolve conflicts of generated names
  * podman-generate-kube - remove empty structs from YAML
  * Add some information about disabling SELinux when using system volumes
  * Fix swagger definition for the new mac address type
  * Log Apache access_log-like entries at Info level [NO NEW TESTS NEEDED]
  * Test to check for presence of 'stats-dump' in exported checkpoints
  * Add 'stats-dump' file to exported checkpoint
  * Podman Image SCP rootful to rootless transfer
  * rename rootless cni ns to rootless netns
  * mount full XDG_RUNTIME_DIR in rootless cni ns
  * Bump github.com/checkpoint-restore/go-criu/v5 from 5.1.0 to 5.2.0
  * Keep error semantics intact
  * Fix rootless cni netns cleanup logic
  * tweak a couple of flag descriptions in help output
  * Update swagger doc make filed optional
  * Fix bindings container log test
  * test: run --cgroups=split in new cgroup
  * MAC address json unmarshal should allow strings
  * Make stop message more similar to start
  * Implement top streaming for containers and pods
  * Handle HTTP 409 error messages properly for Pod actions
  * Add tests
  * Fix swagger definitions
  * More conforming libpod API and swagger types
  * More conforming libpod API and swagger types
  * Better emptiness test for custom JSON serializer
  * System tests: enhance volume test, add debug prints
  * add unit test to containers_test
  * Use correct swagger type in doc-comment
  * Cirrus: Authorize rootless user self-ssh
  * Fix libpod API conformance to swagger
  * Fix help message case for `podman version`
  * Fix pause usage example
  * Use systemctl in local system test
  * Allow label and labels when creating volumes
  * volumes: be more tolerant and fix infinite loop
  * Add information on how podman machine is updated
  * volumes: allow more options for devpts
  * volumes: do not pass mount opt as formatter string
  * Bump k8s.io/api from 0.22.2 to 0.22.3
  * runtime: change PID existence check
  * oci: rename sub-cgroup to runtime instead of supervisor
  * libpod: deduplicate ports in db
  * Set flags to test 'logs -f' with journald driver
  * Set Checkpointed state to false after restore
  * container create: fix --tls-verify parsing
  * runtime: check for pause pid existence
  * utils: do not overwrite the err variable
  * Fix systemd PID1 test
  * Record the image stream along with the path
  * cgroups: use SessionBusPrivateNoAutoStartup
  * vendor: update godbus to v5.0.6
  * Slirp4netns with ipv6 set net.ipv6.conf.default.accept_dad=0
  * Fix a few problems in 'podman logs --tail' with journald driver
  * Allow 'container restore' with '--ipc host'
  * Document to not set K8S envars for CNI
  * Bump github.com/docker/docker
  * pod create: remove need for pause image
  * add kubernetes pause
  * cirrus: containers: mount directory in /var/tmp to /tmp
  * overlay root fs: create mount on runtime dir
  * Update vendor github.com/opencontainers/runtime-tools
  * If Dockerfile exists in same directory as service, we should not use it.
  * Fix tests of podman image trust --raw and --json
  * Tighten the expected output of the "podman image trust show" test
  * Use INTEGRATION_ROOT instead of current directory
  * Add support to play kube for --log-opt
  * [NO NEW TESTS NEEDED] Fix off-by-one index comparision (reported by LGTM)
  * Fix some typos in documentation and comments (found by codespell)
  * Replace 'an user' =&gt; 'a user'
  * [CI:DOCS] Fix typo keep_id -&gt; keep-id
  * Set DOCKER_HOST in the VM
  * fuse-overlay probably means fuse-overlayfs.
  * Support template unit files in podman generate systemd
  * Remove --kernel-memory options
  * tag: Support tagging manifest list instead of resolving to images
  * Remove infra ID from DB before removing containers
  * System tests: confirm that -a and -l clash
  * systemd: compatible with rootless mode
  * system tests: CONTAINER_* and --help: cleanup
  * podman run --memory=0 ... should not set memory limit
  * Add information on how to discover default log driver
  * Add test for system connection
  * Generate Kube should not print default structs
  * libpod: change mountpoint ownership c.Root when using overlay on top of external rootfs
  * Change podman connection list to use default field
  * Allow API to specify size and inode quota
  * Use exponential backoff when waiting for a journal entry
  * Pod Rm Infra Improvements
  * system tests: socket activation: clean up
  * rootfs-overlay: fix overlaybase path for cleanups
  * Move CONTAINER_HOST and _CONNECTION to IsRemote Function
  * We should only be relabeling when on first run
  * If CONTAINER_HOST env variable is set default podman --remote=true
  * Set targetPort to the port value in the kube yaml
  * Do not add TCP to protocol in generated kube yaml
  * Use CGO_ENABLED=1 when building natively on darwin
  * Test-hang fix: Wait for ready + timeout on connect.
  * Checkpoint/Restore test fixes
  * Don't include ctr.log if not using file logging
  * Don't use docker/pkg/archive, use containers/storage/pkg/archive
  * Fix codespell errors
  * Adjust tests to verify all subcommands show the help message
  * Fix panic in container create compat api
  * Don't add image entrypoint to the generate kube yaml
  * Display help text on empty subcommand by default
  * podman search: display only name and description by default
  * codespell code
  * Add information about .containerignore to podman build man page
  * CNI: fix network create --ip-range
  * Kube Gen run as user/group issues
  * rootlessport: reduce memory usage of the process
  * No space in kube annotations for bind mounts
  * Fix CI flake on time of shutdown for API service
  * Refactor podman search to be more code friendly
  * Unit files: Use actual installed path for podman
  * Bump github.com/onsi/ginkgo from 1.16.4 to 1.16.5
  * cgroups: use cgroup.controllers to read controllers
  * builder: Add support for builder prune
  * Remove a volume with --force if container is running
  * Use SplitN(2) when copying env variables
  * podman stats: move cgroup validation to server
  * fix test
  * Support readonly rootfs contains colon
  * [CI:DOCS] oci-hooks.5.md: fixup section in header
  * Enable /debug/pprof API service endpoints
  * Not all fields in machine list were set properly
  * faster image inspection
  * Warn if podman stop timeout expires that sigkill was sent
  * [CI:DOCS] introduce --replace flag for play kube
  * [CI:DOCS] Include manifest example usage
  * Change podman.1 man page to show corret log-level default
  * Bump github.com/opencontainers/selinux from 1.8.5 to 1.9.1
  * Fixes #11668
  * libpod: fix race when closing STDIN
  * Ensure `podman ps --sync` functions
  * Allow `podman stop` to be run on Stopping containers
  * Bump github.com/containers/image/v5 from 5.16.0 to 5.16.1
  * Bump github.com/docker/docker
  * It really should be no **NEW** tests needed
  * README.md: Point to Podman's channels
  * Add podman-plugins to upstream image
  * CNI networks: reload networks if needed
  * bump c/common to latest and c/storage to 1.37.0
  * Add --time out for podman * rm  -f commands
  * Cirrus: Fix defunct package metadata breaking cache
  * Pod Events Logging Fix
  * [NO TESTS NEEDED] Ignore removed containers
  * Pod Volumes From Support
  * Add note about empty fields and null values for API responses
  * Bump github.com/containers/buildah from 1.23.0 to 1.23.1
  * Add podman play kube --no-hosts options
  * Gating tests: fix permissions error
  * pkg/specgen: cache image in generator
  * cirrus: gitlab: download packages
  * Add guard for BuildOptions.CommonBuildOpts
  * System tests: tighten 'is' operator
  * Update README and release notes for v3.4.0
  * sdnotify test: accept MAINPID anywhere
  * machine: silently cleanup dangling sockets before rm if possible
  * Add expose type map[uint16]string to description
  * [NO TESTS NEEDED] Fix typo in storage.conf file exists message
  * Support selinux options with bind mounts play/gen
  * kube: fix conversion from milliCPU to period/quota
  * Bump github.com/mattn/go-isatty from 0.0.12 to 0.0.14
  * test: use new helper
  * test: skip test on rootless cgroupsv1
  * machine: Info on successfully stopping qemu machine
  * Allow a value of -1 to set unlimited pids limit
  * Vendor in latest containers/storage
  * Storage can remove ErrNotAContainer as well
  * libpod: container create: init variable: do not deep copy spec
  * libpod: add GetConfigNoCopy()
  * libpod: add execSessionNoCopy
  * libpod: do not call (*container).Spec()
  * Pod Device-Read-BPS support
  * Remind user to check connection or use podman machine
  * Ensure pod ID bucket is properly updated on rename
  * Fix contributor make targets on Ubuntu and Debian
  * Implement PR template to assist review &amp; release
  * libpod: do not call (*container).Config()
  * [NO TESTS NEEDED] Add port configuration to first regular container
  * [CI:DOCS] cmd/podman: no dot for short descriptions
  * move network alias validation to container create
  * set --cni-config-dir for exit command
  * always add short container id as net alias
  * image prune: support removing external containers
  * System tests: speed up. They've gotten too slow.
  * Add dockerfile.5 as man link to containerfile man page
  * Set MSI to be 64-bit only.
  * fix podman network prune integration test flakes
  * Cirrus: Add gitlab podman runner test
  * CNI: network remove do not error for ENOENT
  * remote build: EvalSymlinks() the context directory
  * stop: Do nothing if container was never created in runtime
  * logging: new mode -l passthrough
  * Allow machine options to be set from containers.conf
  * Vendor in containers/common v0.46.0
  * podman machine: do not join userns
  * Disable docker and alias to podman in FCOS ignition
  * added healthcheck to ps command
  * Fix english on prune prompt
  * Document missing /images/search query parameters
  * rootful: do not set XDG_RUNTIME_DIR for cni plugins
  * Revert "rootful: unset XDG_RUNTIME_DIR"
  * Add completion for machine list format
  * Set context dir for play kube build
  * Makefile: use -ldflags/-gccgoflags depending on the go implemenatiton
  * Update docs for --platform in podman-build.1
  * shell completion: do not show images without tag
  * podman inspect add State.Health field for docker compat
  * podman save: enforce signature removal
  * Add JSON version of the machine list
  * Add support for :U flag with --mount option
  * [CI:DOCS] Add link to running ctrimage on enablesysadm
  * Ignore mount errors except ErrContainerUnknown when cleaningup container
  * standardize logrus messages to upper case
  * podman generate kube should not include images command
  * Fix machine image
  * sync container state before reading the healthcheck
  * Also show the (initial) disk size
  * Show cpus and memory in machine list
  * Eighty-six eighty-eighty
  * net types: remove omitempty from required fields
  * podman save: add `--uncompressed`
  * Bump CNI to v1.0.1
  * vendor c/psgo@v1.7.1
  * [CI:DOCS] Add network alias note in man pages
  * Add a backoff and retries to retrieving exited event
  * Cross-build release-archives w/ arch in filename
  * Fix Error, empty output for info: 'VERSION'
  * Generate kube should'd add podman default environment vars
  * volume: Add support for overlay on named volumes
  * Pod Device Support
  * Support --format tables in ps output
  * Remove references to kube being development
  * Add support for retrieving system service --timeout
  * Add podman image/container inspect man pages
  * [CI:DOCS] Add link to skopeo delete in podman rmi
  * vendor c/common@main
  * remote untag: support digests
  * Created MapOptions for PodCreate
  * Bump k8s.io/api from 0.22.1 to 0.22.2
  * compat API: /images/json prefix image id with sha256
  * podman machine: use gvproxy for host.containers.internal
  * utils: return error message from StartTransientUnit
  * utils: raise warning only on cgroupv2
  * Add podman machine init --now option
  * System tests: cleanup, and remove obsolete skips
  * Add username flag for machine ssh
  * Remove unused code from libpod
  * [CI:DOCS] markdown cleanup
  * Fix up build the docs site
  * Use a new markdown converter for sphinx
  * runtime: move pause process to scope
  * system: move MovePauseProcessToScope to utils
  * system: always move pause process when running on systemd
  * system: avoid reading pause pid file
  * Only add 127.0.0.1 entry to /etc/hosts with --net=none
  * Add no-trunc support to podman-events
  * CNI: add ipvlan driver
  * CNI: network create support macvlan modes
  * Do not allow network modes to be used as network names
  * fix inverted condition
  * Fix /auth compat endpoint
  * Add Drivers method to the Network Interface
  * CI: load ipv6 kernel modules for rootless tests
  * Drop OCICNI dependency
  * Wire network interface into libpod
  * cni network configs set ipv6 enables correctly
  * default network: do not validate the used subnets
  * network create: validate the input subnet
  * Set default storage from containers.conf for temporary images
  * container runlabel remove image tag from name
  * build.bats: fix copy tests after containers/buildah#3486
  * build: mirror --authfile to filesystem if pointing to FD instead of file
  * Fix example in podman machine init man page
  * vendor: Bump github.com/containers/buildah from 1.22.3 to 1.23.0
  * api: handle nil pointer dereference in rest endpoints
  * build: take advantage of --platform lists
  * Document `all` query parameter for /libpod/images/prune
  * Show variant and codename of the distribution
  * Use new aarch64 fcos repos
  * Enhance bindings for IDE hints
  * Pod Volumes Support
  * test: enable --cgroup-parent test
  * libpod: honor --cgroups=split also with pods
  * tests: enable --cgroups=disabled test for rootless
  * tests: simplify --cgroups=disabled test
  * libpod: rootful close binded ports
  * Search gvproxy with config.FindHelperBinary()
  * rootfs: Add support for rootfs-overlay and bump to buildah v1.22.1-0.202108
  * fix restart always with rootlessport
  * Cirrus: NM/CNI workaround + Remove prior-Ubuntu
  * If container exits with 125 podman should exit with 125
  * Bump github.com/json-iterator/go from 1.1.11 to 1.1.12
  * bump c/common to v0.44.0
  * remove rootlessport socket to prevent EADDRINUSE
  * Add deprecated fields for 1.22+ clients that still expect them
  * Use default username for podman machine ssh</changelog>
  <changelog author="michael@stroeder.com" date="1648814400">- Update to version 4.0.3:
  * Security
  - This release fixes CVE-2022-27649, where containers run by Podman would have excess inheritable capabilities set.
  * Changes
  - The podman machine rm --force command will now remove running machines as well (such machines are shut down first, then removed) (#13448).
  - When a podman machine VM is started that is using a too-old VM image, it will now start in a reduced functionality mode, and provide instructions on how to recreate it (previously, VMs were effectively unusable) (#13510).
  * Bugfixes
  - Fixed a bug where devices added to containers by the --device option to podman run and podman create would not be accessible within the container.
  - Fixed a bug where Podman would refuse to create containers when the working directory in the container was a symlink (#13346).
  - Fixed a bug where pods would be created with cgroups even if cgroups were disabled in containers.conf (#13411).
  - Fixed a bug where the podman play kube command would produce confusing errors if invalid YAML with duplicated container named was passed (#13332).
  - Fixed a bug where the podman machine rm command would not remove the Podman API socket on the host that was associated with the VM.
  - Fixed a bug where the remote Podman client was unable to properly resize the TTYs of containers on non-Linux OSes.
  - Fixed a bug where rootless Podman could hang indefinitely when starting containers on systems with IPv6 disabled (#13388).
  - Fixed a bug where the podman version command could sometimes print excess blank lines as part of its output.
  - Fixed a bug where the podman generate systemd command would sometimes generate systemd services with names beginning with a hyphen (#13272).
  - Fixed a bug where locally building the pause image could fail if the current directory contained a .dockerignore file (#13529).
  - Fixed a bug where root containers in VMs created by podman machine could not bind ports to specific IPs on the host (#13543).
  - Fixed a bug where the storage utilization percentages displayed by podman system df were incorrect (#13516).
  - Fixed a bug where the CPU utilization percentages displayed by podman stats were incorrect (#13597).
  - Fixed a bug where containers created with the --no-healthcheck option would still display healthcheck status in podman inspect (#13578).
  - Fixed a bug where the podman pod rm command could print a warning about a missing cgroup (#13382).
  - Fixed a bug where the podman exec command could sometimes print a timed out waiting for file error after the process in the container exited (#13227).
  - Fixed a bug where virtual machines created by podman machine were not tolerant of changes to the path to the qemu binary on the host (#13394).
  - Fixed a bug where the remote Podman client's podman build command did not properly handle the context directory if a Containerfile was manually specified using -f (#13293).
  - Fixed a bug where Podman would not properly detect the use of systemd as PID 1 in a container when the entrypoint was prefixed with /bin/sh -c (#13324).
  - Fixed a bug where rootless Podman could, on systems that do not use systemd as init, print a warning message about the rootless network namespace (#13703).
  - Fixed a bug where the default systemd unit file for podman system service did not delegate all cgroup controllers, resulting in podman info queries against the remote API returning incorrect cgroup controllers (#13710).
  - Fixed a bug where the slirp4netns port forwarder for rootless Podman would only publish the first port of a range (#13643).
  * API
  - Fixed a bug where the Compat Create API for containers did not properly handle permissions for tmpfs mounts (#13108).
  * Misc
  - The static binary for Linux is now built with CGo disabled to avoid panics due to a Golang bug (#13557).
  - Updated Buildah to v1.24.3
  - Updated the containers/storage library to v1.38.3
  - Updated the containers/image library to v5.19.2
  - Updated the containers/common library to v0.47.5</changelog>
  <changelog author="fvogt@suse.com" date="1649332800">- Add patch to fix starting containers on btrfs with SELinux
  (gh#opencontainers/selinux#172):
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
- Add patch to fix starting containers as user service with systemd 250
  (boo#1197672, gh#containers/podman#13731):
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch</changelog>
  <changelog author="fvogt@suse.com" date="1649332801">- Add patch to make buildah happy after selinux change:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch</changelog>
  <changelog author="rbrown@suse.com" date="1649764800">- Require catatonit &gt;= 0.1.7 for pause functionality needed by pods</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport upstream commit be5abf03ababc ("fix: Container.cGroupPath()
  skip empty line to avoid false error logging") for fixing "Error parsing
  cgroup: expected 3 fields but got 1" (see bsc#1199790, as it applies
  to Factory/Tumbleweed too)
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="rbrown@suse.com" date="1655899200">- Update to version 4.1.1:
  * The output of the podman load command now mirrors that of docker load.
  * Podman now supports Docker Compose v2.2 and higher. Please note that it may be necessary to disable the use of Buildkit by setting the environment variable DOCKER_BUILDKIT=0.
  * A new container command has been added, podman container clone. This command makes a copy of an existing container, with the ability to change some settings (e.g. resource limits) while doing so.
  * Podman now supports sending JSON events related to machines to a Unix socket named machine_events.*\.sock in XDG_RUNTIME_DIR/podman or to a socket whose path is set in the PODMAN_MACHINE_EVENTS_SOCK environment variable.
  * Two new volume commands have been added, podman volume mount and podman volume unmount. These allow for Podman-managed named volumes to be mounted and accessed from outside containers.
  * The podman container checkpoint and podman container restore options now support checkpointing to and restoring from OCI images. This allows checkpoints to be distributed via standard image registries.
  * The podman play kube command now supports environment variables that are specified using the fieldRef and resourceFieldRef sources.
  * The podman play kube command will now set default resource limits when the provided YAML does not include them.
  * The podman play kube command now supports a new option, --annotation, to add annotations to created containers.
  * The podman play kube --build command now supports a new option, --context-dir, which allows the user to specify the context directory to use when building the Containerfile.
  * The podman container commit command now supports a new option, --squash, which squashes the generated image into a single layer.
  * The podman pod logs command now supports two new options, --names, which identifies which container generated a log message by name, instead of ID and --color, which colors messages based on what container generated them.
  * The podman rmi command now supports a new option, --ignore, which will ignore errors caused by missing images.
  * The podman network create command now features a new option, --ipam-driver, to specify details about how IP addresses are assigned to containers in the network.
  * The podman machine list command now features a new option, --quiet, to print only the names of configured VMs and no other information.
  * The --ipc option to the podman create, podman run, and podman pod create commands now supports three new modes: none, private, and shareable. The default IPC mode is now shareable, indicating the the IPC namespace can be shared with other containers.
  * The --mount option to the podman create and podman run commands can now set options for created named volumes via the volume-opt parameter.
  * The --mount option to the podman create and podman run commands now allows parameters to be passed in CSV format.
  * The --userns option to the podman create and podman run commands now supports a new option, nomap, that (only for rootless containers) does not map the UID of the user that started the container into the container, increasing security.
  * The podman import command now supports three new options, --arch, --os, and --variant, to specify what system the imported image was built for.
  * The podman inspect command now includes information on the network configuration of containers that joined a pre-configured network namespace with the --net ns: option to podman run, podman create, and podman pod create.
  * The podman run and podman create commands now support a new option, --chrootdirs, which specifies additional locations where container-specific files managed by Podman (e.g. /etc/hosts, `/etc/resolv.conf, etc) will be mounted inside the container (#12961).
  * The podman run and podman create commands now support a new option, --passwd-entry, allowing entries to be added to the container's /etc/passwd file.
  * The podman images --format command now accepts two new format directives: {{.CreatedAt}} and {{.CreatedSince}}.
  * The podman volume create command's -o option now accepts a new argument, o=noquota, to disable XFS quotas entirely and avoid potential issues when Podman is run on an XFS filesystem with existing quotas defined.
  * The podman info command now includes additional information on the machine Podman is running on, including disk utilization on the drive Podman is storing containers and images on, and CPU utilization.
  * Fix CVE-2022-27191 / bsc#1197284
- Drop obsolete patches:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="predivan@mts.rs" date="1656676800">- Fix build on Leap
    Use libexec macro to set correct, per-distribution specific, directory.</changelog>
  <changelog author="michael@stroeder.com" date="1660219200">- Update to version 4.2.0:
  * Features
  - Podman now supports the Gitlab Runner (using the Docker executor), allowing its use in Gitlab CI/CD pipelines.
  - A new command has been added, podman pod clone, to create a copy of an existing pod. It supports several options, including --start to start the new pod, --destroy to remove the original pod, and --name to change the name of the new pod (#12843).
  - A new command has been added, podman volume reload, to sync changes in state between Podman's database and any configured volume plugins (#14207).
  - A new command has been added, podman machine info, which displays information about the host and the versions of various machine components.
  - Pods created by podman play kube can now be managed by systemd unit files. This can be done via a new systemd service, podman-kube@.service - e.g. systemctl --user start podman-play-kube@$(systemd-escape my.yaml).service will run the Kubernetes pod or deployment contained in my.yaml under systemd.
  - The podman play kube command now honors the RunAsUser, RunAsGroup, and SupplementalGroups setting from the Kubernetes pod's security context.
  - The podman play kube command now supports volumes with the BlockDevice and CharDevice types (#13951).
  - The podman play kube command now features a new flag, --userns, to set the user namespace of created pods. Two values are allowed at present: host and auto (#7504).
  - The podman play kube command now supports setting the type of created init containers via the io.podman.annotations.init.container.type annotation.
  - Pods now have include an exit policy (configurable via the --exit-policy option to podman pod create), which determines what will happen to the pod's infra container when the entire pod stops. The default, continue, acts as Podman currently does, while a new option, stop, stops the infra container after the last container in the pod stops, and is used by default for pods from podman play kube (#13464).
  - The podman pod create command now allows the pod's name to be specified as an argument, instead of using the --name option - for example, podman pod create mypod instead of the prior podman pod create --name mypod. Please note that the --name option is not deprecated and will continue to work.
  - The podman pod create command's --share option now supports adding namespaces to the set by prefacing them with + (as opposed to specifying all namespaces that should be shared) (#13422).
  - The podman pod create command has a new option, --shm-size, to specify the size of the /dev/shm mount that will be shared if the pod shares its UTS namespace (#14609).
  - The podman pod create command has a new option, --uts, to configure the UTS namespace that will be shared by containers in the pod.
  - The podman pod create command now supports setting pod-level resource limits via the --cpus, --cpuset-cpus, and --memory options. These will set a limit for all containers in the pod, while individual containers within the pod are allowed to set further limits. Look forward to more options for resource limits in our next release!
  - The podman create and podman run commands now include the -c short option for the --cpu-shares option.
  - The podman create and podman run commands can now create containers from a manifest list (and not an image) as long as the --platform option is specified (#14773).
  - The podman build command now supports a new option, --cpp-flag, to specify options for the C preprocessor when using Containerfile.in files that require preprocessing.
  - The podman build command now supports a new option, --build-context, allowing the user to specify an additional build context.
  - The podman machine inspect command now prints the location of the VM's Podman API socket on the host (#14231).
  - The podman machine init command on Windows now fetches an image with packages pre-installed (#14698).
  - Unused, cached Podman machine VM images are now cleaned up automatically. Note that because Podman now caches in a different directory, this will not clean up old images pulled before this change (#14697).
  - The default for the --image-volume option to podman run and podman create can now have its default set through the image_volume_mode setting in containers.conf (#14230).
  - Overlay volumes now support two new options, workdir and upperdir, to allow multiple overlay volumes from different containers to reuse the same workdir or upperdir (#14427).
  - The podman volume create command now supports two new options, copy and nocopy, to control whether contents from the overmounted folder in a container will be copied into the newly-created named volume (copy-up).
  - Volumes created using a volume plugin can now specify a timeout for all operations that contact the volume plugin (replacing the standard 5 second timeout) via the --opt o=timeout= option to podman volume create (BZ 2080458).
  - The podman volume ls command's --filter name= option now supports regular expression matching for volume names (#14583).
  - When used with a podman machine VM, volumes now support specification of the 9p security model using the security_model option to podman create -v and podman run -v.
  - The remote Podman client's podman push command now supports the --remove-signatures option (#14558).
  - The remote Podman client now supports the podman image scp command.
  - The podman image scp command now supports tagging the transferred image with a new name.
  - The podman network ls command supports a new filter, --filter dangling=, to list networks not presently used by any containers (#14595).
  - The --condition option to podman wait can now be specified multiple times to wait on any one of multiple conditions.
  - The podman events command now includes the -f short option for the --filter option.
  - The podman pull command now includes the -a short option for the --all-tags option.
  - The podman stop command now includes a new flag, --filter, to filter which containers will be stopped (e.g. podman stop --all --filter label=COM.MY.APP).
  - The Podman global option --url now has two aliases: -H and --host.
  - The podman network create command now supports a new option with the default bridge driver, --opt isolate=, which isolates the network by blocking any traffic from it to any other network with the isolate option enabled. This option is enabled by default for networks created using the Docker-compatible API.
  - Added the ability to create sigstore signatures in podman push and podman manifest push.
  - Added an option to read image signing passphrase from a file.
  * Changes
  - Paused containers can now be killed with the podman kill command.
  - The podman system prune command now removes unused networks.
  - The --userns=keep-id and --userns=nomap options to the podman run and podman create commands are no longer allowed (instead of simply being ignored) with root Podman.
  - If the /run directory for a container is part of a volume, Podman will not create the /run/.containerenv file (#14577).
  - The podman machine stop command on macOS now waits for the machine to be completely stopped to exit (#14148).
  - All podman machine commands now only support being run as rootless, given that VMs only functioned when run rootless.
  - The podman unpause --all command will now only attempt to unpause containers that are paused, not all containers.
  - Init containers created with podman play kube now default to the once type (#14877).
  - Pods created with no shared namespaces will no longer create an infra container unless one is explicitly requested (#15048).
  - The podman create, podman run, and podman cp commands can now autocomplete paths in the image or container via the shell completion.
  - The libpod/common package has been removed as it's not used anywhere.
  - The --userns option to podman create and podman run is no longer accepted when an explicit UID or GID mapping is specified (#15233).
  * Bugfixes
  - Fixed a bug where bind-mounting /dev into a container which used the --init flag would cause the container to fail to start (#14251).
  - Fixed a bug where the podman image mount command would not pretty-print its output when multiple images were mounted.
  - Fixed a bug where the podman volume import command would print an unrelated error when attempting to import into a nonexistent volume (#14411).
  - Fixed a bug where the podman system reset command could race against other Podman commands (#9075).
  - Fixed a bug where privileged containers were not able to restart if the layout of host devices changed (#13899).
  - Fixed a bug where the podman cp command would overwrite directories with non-directories and vice versa. A new --overwrite flag to podman cp allows for retaining the old behavior if needed (#14420).
  - Fixed a bug where the podman machine ssh command would not preserve the exit code from the command run via ssh (#14401).
  - Fixed a bug where VMs created by podman machine would fail to start when created with more than 3072MB of RAM on Macs with M1 CPUs (#14303).
  - Fixed a bug where the podman machine init command would fail when run from C:\Windows\System32 on Windows systems (#14416).
  - Fixed a bug where the podman machine init --now did not respect proxy environment variables (#14640).
  - Fixed a bug where the podman machine init command would fail if there is no $HOME/.ssh dir (#14572).
  - Fixed a bug where the podman machine init command would add a connection even if creating the VM failed (#15154).
  - Fixed a bug where interrupting the podman machine start command could render the VM unable to start.
  - Fixed a bug where the podman machine list --format command would still print a heading.
  - Fixed a bug where the podman machine list command did not properly set the Starting field (#14738).
  - Fixed a bug where the podman machine start command could fail to start QEMU VMs when the machine name started with a number.
  - Fixed a bug where Podman Machine VMs with proxy variables could not be started more than once (#14636 and #14837).
  - Fixed a bug where containers created using the Podman API would, when the Podman API service was managed by systemd, be killed when the API service was stopped (BZ 2052697).
  - Fixed a bug where the podman -h command did not show help output.
  - Fixed a bug where the podman wait command (and the associated REST API endpoint) could return before a container had fully exited, breaking some tools like the Gitlab Runner.
  - Fixed a bug where healthchecks generated exec events, instead of health_status events (#13493).
  - Fixed a bug where the podman pod ps command could return an error when run at the same time as podman pod rm (#14736).
  - Fixed a bug where the podman systemd df command incorrectly calculated reclaimable storage for volumes (#13516).
  - Fixed a bug where an exported container checkpoint using a non-default OCI runtime could not be restored.
  - Fixed a bug where Podman, when used with a recent runc version, could not remove paused containers.
  - Fixed a bug where the remote Podman client's podman manifest rm command would remove images, not manifests (#14763).
  - Fixed a bug where Podman did not correctly parse wildcards for device major number in the podman run and podman create commands' --device-cgroup-rule option.
  - Fixed a bug where the podman play kube command on 32 bit systems where the total memory was calculated incorrectly (#14819).
  - Fixed a bug where the podman generate kube command could set ports and hostname incorrectly in generated YAML (#13030).
  - Fixed a bug where the podman system df --format "{{ json . }}" command would not output the Size and Reclaimable fields (#14769).
  - Fixed a bug where the remote Podman client's podman pull command would display duplicate progress output.
  - Fixed a bug where the podman system service command could leak memory when a client unexpectedly closed a connection when reading events or logs (#14879).
  - Fixed a bug where Podman containers could fail to run if the image did not contain an /etc/passwd file (#14966).
  - Fixed a bug where the remote Podman client's podman push command did not display progress information (#14971).
  - Fixed a bug where a lock ordering issue could cause podman pod rm to deadlock if it was run at the same time as a command that attempted to lock multiple containers at once (#14929).
  - Fixed a bug where the podman rm --force command would exit with a non-0 code if the container in question did not exist (#14612).
  - Fixed a bug where the podman container restore command would fail when attempting to restore a checkpoint for a container with the same name as an image (#15055).
  - Fixed a bug where the podman manifest push --rm command could remove image, instead of manifest lists (#15033).
  - Fixed a bug where the podman run --rm command could fail to remove the container if it failed to start (#15049).
  - Fixed a bug where the podman generate systemd --new command would create incorrect unit files when the container was created with the --sdnotify parameter (#15052).
  - Fixed a bug where the podman generate systemd --new command would fail when -h &lt;hostname&gt; was used to create the container (#15124).
  * API
  - The Docker-compatible API now supports API version v1.41 (#14204).
  - Fixed a bug where containers created via the Libpod API had an incorrect umask set (#15036).
  - Fixed a bug where the remote parameter to the Libpod API's Build endpoint for Images was nonfunctional (#13831).
  - Fixed a bug where the Libpod List endpoint for Containers did not return the application/json content type header when there were no containers present (#14647).
  - Fixed a bug where the Compat Stats endpoint for Containers could return incorrect memory limits (#14676).
  - Fixed a bug where the Compat List and Inspect endpoints for Containers could return incorrect strings for container status.
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle disabling healthchecks (#14493).
  - Fixed a bug where the Compat Create endpoint for Networks did not support the mtu, name, mode, and parent options (#14482).
  - Fixed a bug where the Compat Create endpoint for Networks did not allow the creation of networks name bridge (#14983).
  - Fixed a bug where the Compat Inspect endpoint for Networks did not properly set netmasks in the SecondaryIPAddresses and SecondaryIPv6Addresses fields (#14674).
  - The Libpod Stats endpoint for Pods now supports streaming output via two new parameters, stream and delay (#14674).
  * Misc
  - Podman will now check for nameservers in /run/NetworkManager/no-stub-resolv.conf if the /etc/resolv.conf file only contains a localhost server.
  - The podman build command now supports caching with builds that specify --squash-all by allowing the --layers flag to be used at the same time.
  - Podman Machine support for QEMU installations at non-default paths has been improved.
  - The podman machine ssh command no longer prints spurious warnings every time it is run.
  - When accessing the WSL prompt on Windows, the rootless user will be preferred.
  - The podman info command now includes a field for information on supported authentication plugins for improved Docker compatibility. Authentication plugins are not presently supported by Podman, so this field is always empty.
  - The podman system prune command now no longer prints the Deleted Images header if no images were pruned.
  - The podman system service command now automatically creates and moves to a sub-cgroup when running in the root cgroup (#14573).
  - Updated Buildah to v1.27.0 (fixes CVE-2022-21698 / bsc#1196338)
  - Updated the containers/image library to v5.22.0
  - Updated the containers/storage library to v1.42.0 (fixes bsc#1196751)
  - Updated the containers/common library to v0.49.1
  - Podman will automatically create a sub-cgroup and move itself into it when it detects that it is running inside a container (#14884).
  - Fixed an incorrect release note about regexp.
  - A new MacOS installer (via pkginstaller) is now supported.</changelog>
  <changelog author="asarai@suse.com" date="1663761600">- Update to version 4.2.1:
  * Bump to v4.2.1
  * Add release notes for v4.2.1
  * remove SkipIfNotFedora() from events test
  * fix podman events with custom format
  * Drop stale config value resulting in asymmetric config
  * Fix list of default capabilities
  * Add container GID to additional groups (CVE-2022-2989 / bsc#1202809, removes patch 0001-Add-container-GID-to-additional-groups.patch)
  * libpod: Ensure that generated container names are random
  * Fix bind-mount-option annotation in gen/play kube
  * Improved Windows compatibility for machine command
  * updated apiv2 tests to reflect hash compat fix
  * api: return imageID instead of imageName, for "Image" when Podman API is queried
  * Inhibit SIGTERM during Conmon startup
  * Fix example sections to follow the same format
  * Fix template name inconsistency
  * service: make move to sub-cgroup non fatal
  * Remove duplicate annotations in generated service yaml
  * Compat API image remove events now have 'delete' status
  * [CI:DOCS] Automatically set podman version in pkginstaller
  * Allow colons in windows file paths
  * Fixes isRootfull check using qemu machine on Windows
  * vendor containers/psgo@v1.7.3
  * Allow podman to run in an environment with keys containing spaces
  * Document restrictions on transport in FROM
  * Improved Windows compatibility
  * pass environment variables to container clone
  * podman save: update --compress validation
  * sort hc.Binds returned from compat api
  * Cirrus: Update podman-machine comment
  * podman images and friends can take one image as argument
  * [CI:DOCS] Add .DS_Store to gitignore
  * podman-kube@.service.in: Remove Restart=never option with typo
  * Fix #15499 already connected network
  * [CI:DOCS] Cirrus: Update meta-task for EC2 image
  * fix CI: remove hardcodeded alpine version
  * fix CI: remove hardcodeded alpine version
  * Preserve all unknown PolicyRequirement fields on (podman image trust set)
  * Reorganize the types in policy.go a bit
  * Add support for showing keyPaths in (podman image trust show)
  * Support (image trust show) for sigstoreSigned entries
  * BREAKING CHANGE: Change how (podman image trust show) represents multiple requirements
  * Reorganize descriptionsOfPolicyRequirements a bit
  * Use the full descriptionsOfPolicyRequirements for the default scope
  * Rename haveMatchRegistry to registriesDConfigurationForScope
  * Rename tempTrustShowOutput to entry
  * Split descriptionsOfPolicyRequirements out of getPolicyShowOutput
  * Recognize the new lookaside names for simple signing sigstore
  * Add a unit test for trust.PolicyDescription
  * Make the output of (podman image trust show) deterministic
  * Make most of pkg/trust package-private
  * Move most of ImageEngine.ShowTrust into pkg/trust.PolicyDescription
  * Add support for sigstoreSigned in (podman image trust set)
  * Create new policy entries together with validating input
  * Improve validation of data in ImageEngine.SetTrust
  * Move most of imageEngine.SetTrust to pkg/trust.AddPolicyEntries
  * Add a variable for scope
  * Make trust.CreateTempFile private
  * Reorganize pkg/trust
  * Remove an unused trust.ShowOutput type
  * Remove commented out code
  * libpod: UpdateContainerStatus: do not wait for container
  * Skip / update some tests under runc
  * Bump to v4.2.1-dev
  * test: update apply-podman-deltas for new tests
  * build: implement --cache-to,--cache-from and --cache-ttl
  * vendor: bump buildah to v1.27.0</changelog>
  <changelog author="dcermak@suse.com" date="1669118400">- switch to building with go 1.17
- use %%make_* macros
- drop /usr/share/user-tmpfiles.d/podman-docker.conf on SLE &amp; Leap
- remove rpmlintrc (contained only obsolete filters)
- remove obsolete with_libostree (we don't build on anything older than SLE 15)
- add patch: 0001-Revert-Default-missing-hostPort-to-containerPort-is-.patch
  (hotfix for https://github.com/containers/podman/issues/16765)
- Update to version 4.3.1:
  4.3.1:
  [#]## Bugfixes
- Fixed a deadlock between the `podman ps` and `podman container inspect` commands
  [#]## Misc
- Updated the containers/image library to v5.23.1
  4.3.0:
  [#]## Features
- A new command, `podman generate spec`, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
- A new command, `podman update`, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted ([#15067](https://github.com/containers/podman/issues/15067)).
- A new command, `podman kube down`, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to `podman kube play --down`, but it now has its own command).
- The `podman kube play` command now supports Kubernetes secrets using Podman's secrets backend.
- Systemd-managed pods created by the `podman kube play` command now integrate with sd-notify, using the `io.containers.sdnotify` annotation (or `io.containers.sdnotify/$name` for specific containers).
- Systemd-managed pods created by `podman kube play` can now be auto-updated, using the `io.containers.auto-update` annotation (or `io.containers.auto-update/$name` for specific containers).
- The `podman kube play` command can now read YAML from URLs, e.g. `podman kube play https://example.com/demo.yml` ([#14955](https://github.com/containers/podman/issues/14955)).
- The `podman kube play` command now supports the `emptyDir` volume type ([#13309](https://github.com/containers/podman/issues/13309)).
- The `podman kube play` command now supports the `HostUsers` field in the pod spec.
- The `podman play kube` command now supports `binaryData` in ConfigMaps.
- The `podman pod create` command can now set additional resource limits for pods using the new `--memory-swap`, `--cpuset-mems`, `--device-read-bps`, `--device-write-bps`, `--blkio-weight`, `--blkio-weight-device`, and `--cpu-shares` options.
- The `podman machine init` command now supports a new option, `--username`, to set the username that will be used to connect to the VM as a non-root user ([#15402](https://github.com/containers/podman/issues/15402)).
- The `podman volume create` command's `-o timeout=` option can now set a timeout of 0, indicating volume plugin operations will never time out.
- Added support for a new volume driver, `image`, which allows volumes to be created that are backed by images.
- The `podman run` and `podman create` commands support a new option, `--env-merge`, allowing environment variables to be specified relative to other environment variables in the image (e.g. `podman run --env-merge "PATH=$PATH:/my/app" ...`) ([#15288](https://github.com/containers/podman/issues/15288)).
- The `podman run` and `podman create` commands support a new option, `--on-failure`, to allow action to be taken when a container fails health checks, with the following supported actions: `none` (take no action, the default), `kill` (kill the container), `restart` (restart the container), and `stop` (stop the container).
- The `--keep-id` option to `podman create` and `podman run` now supports new options, `uid` and `gid`, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. `--userns=keep-id:uid=11` will made the user running Podman to UID 11 in the container) ([#15294](https://github.com/containers/podman/issues/15294)).
- The `podman generate systemd` command now supports a new option, `--env`/`-e`, to set environment variables in the generated unit file ([#15523](https://github.com/containers/podman/issues/15523)).
- The `podman pause` and `podman unpause` commands now support the `--latest`, `--cidfile`, and `--filter` options.
- The `podman restart` command now supports the `--cidfile` and `--filter` options.
- The `podman rm` command now supports the `--filter` option to select which containers will be removed.
- The `podman rmi` command now supports a new option, `--no-prune`, to prevent the removal of dangling parents of removed images.
- The `--dns-opt` option to `podman create`, `podman run`, and `podman pod create` has received a new alias, `--dns-option`, to improve Docker compatibility.
- The `podman` command now features a new global flag, `--debug`/`-D`, which enables debug-level logging (identical to `--log-level=debug`), improving Docker compatibility.
- The `podman` command now features a new global flag, `--config`. This flag is ignored, and is only included for Docker compatibility ([#14767](https://github.com/containers/podman/issues/14767)).
- The `podman manifest create` command now accepts a new option, `--amend`/`-a`.
- The `podman manifest create`, `podman manifest add` and `podman manifest push` commands now accept a new option, `--insecure` (identical to `--tls-verify=false`), improving Docker compatibility.
- The `podman secret create` command's `--driver` and `--format` options now have new aliases, `-d` for `--driver` and `-f` for `--format`.
- The `podman secret create` command now supports a new option, `--label`/`-l`, to add labels to created secrets.
- The `podman secret ls` command now accepts the `--quiet`/`-q` option.
- The `podman secret inspect` command now accepts a new option, `--pretty`, to print output in human-readable format.
- The `podman stats` command now accepts the `--no-trunc` option.
- The `podman save` command now accepts the `--signature-policy` option ([#15869](https://github.com/containers/podman/issues/15869)).
- The `podman pod inspect` command now allows multiple arguments to be passed. If so, it will return a JSON array of the inspected pods ([#15674](https://github.com/containers/podman/issues/15674)).
- A series of new hidden commands have been added under `podman context` as aliases to existing `podman system connection` commands, to improve Docker compatibility.
- The remote Podman client now supports proxying signals for attach sessions when the `--sig-proxy` option is set ([#14707](https://github.com/containers/podman/issues/14707)).
  [#]## Changes
- Duplicate volume mounts are now allowed with the `-v` option to `podman run`, `podman create`, and `podman pod create`, so long as source, destination, and options all match ([#4217](https://github.com/containers/podman/issues/4217)).
- The `podman generate kube` and `podman play kube` commands have been renamed to `podman kube generate` and `podman kube play` to group Kubernetes-related commands. Aliases have been added to ensure the old command names still function.
- A number of Podman commands (`podman init`, `podman container checkpoint`, `podman container restore`, `podman container cleanup`) now print the user-inputted name of the container, instead of its full ID, on success.
- When an unsupported option (e.g. resource limit) is specified for a rootless container on a cgroups v1 system, a warning message is now printed that the limit will not be honored.
- The installer for the Windows Podman client has been improved.
- The `--cpu-rt-period` and `--cpu-rt-runtime` options to `podman run` and `podman create` now print a warning and are ignored on cgroups v2 systems (cgroups v2 having dropped support for these controllers) ([#15666](https://github.com/containers/podman/issues/15666)).
- Privileged containers running systemd will no longer mount `/dev/tty*` devices other than `/dev/tty` itself into the container ([#15878](https://github.com/containers/podman/issues/15878)).
- Events for containers that are part of a pod now include the ID of the pod in the event.
- SSH functionality for `podman machine` commands has seen a thorough rework, addressing many issues about authentication.
- The `--network` option to `podman kube play` now allows passing `host` to set the pod to use host networking, even if the YAML does not request this.
- The `podman inspect` command on containers now includes the digest of the image used to create the container.
- Pods created by `podman play kube` are now, by default, placed into a network named `podman-kube`. If the `podman-kube` network does not exist, it will be created. This ensures pods can connect to each other by their names, as the network has DNS enabled.
  [#]## Bugfixes
- Fixed a bug where the `podman network prune` and `podman container prune` commands did not properly support the `--filter label!=` option ([#14182](https://github.com/containers/podman/issues/14182)).
- Fixed a bug where the `podman kube generate` command added an unnecessary `Secret: null` line to generated YAML ([#15156](https://github.com/containers/podman/issues/15156)).
- Fixed a bug where the `podman kube generate` command did not set `enableServiceLinks` and `automountServiceAccountToken` to false in generated YAML ([#15478](https://github.com/containers/podman/issues/15478) and [#15243](https://github.com/containers/podman/issues/15243)).
- Fixed a bug where the `podman kube play` command did not properly handle CPU limits ([#15726](https://github.com/containers/podman/issues/15726)).
- Fixed a bug where the `podman kube play` command did not respect default values for liveness probes ([#15855](https://github.com/containers/podman/issues/15855)).
- Fixed a bug where the `podman kube play` command did not bind ports if `hostPort` was not specified but `containerPort` was ([#15942](https://github.com/containers/podman/issues/15942)).
- Fixed a bug where the `podman kube play` command sometimes did not create directories on the host for `hostPath` volumes.
- Fixed a bug where the remote Podman client's `podman manifest push` command did not display progress.
- Fixed a bug where the `--filter "{{.Config.Healthcheck}}"` option to `podman image inspect` did not print the image's configured healthcheck ([#14661](https://github.com/containers/podman/issues/14661)).
- Fixed a bug where the `podman volume create -o timeout=` option could be specified even when no volume plugin was in use.
- Fixed a bug where the `podman rmi` command did not emit `untag` events when removing tagged images ([#15485](https://github.com/containers/podman/issues/15485)).
- Fixed a bug where API forwarding with `podman machine` VMs on windows could sometimes fail because the pipe was not created in time ([#14811](https://github.com/containers/podman/issues/14811)).
- Fixed a bug where the `podman pod rm` command could error if removal of a container in the pod was interrupted by a reboot.
- Fixed a bug where the `exited` and `exec died` events for containers did not include the container's labels ([#15617](https://github.com/containers/podman/issues/15617)).
- Fixed a bug where running Systemd containers on a system not using Systemd as PID 1 could fail ([#15647](https://github.com/containers/podman/issues/15647)).
- Fixed a bug where Podman did not pass all necessary environment variables (including `$PATH`) to Conmon when starting containers ([#15707](https://github.com/containers/podman/issues/15707)).
- Fixed a bug where the `podman events` command could function improperly when no events were present ([#15688](https://github.com/containers/podman/issues/15688)).
- Fixed a bug where the `--format` flag to various Podman commands did not properly handle template strings including a newline (`\n`) ([#13446](https://github.com/containers/podman/issues/13446)).
- Fixed a bug where Systemd-managed pods would kill every container in a pod when a single container exited ([#14546](https://github.com/containers/podman/issues/14546)).
- Fixed a bug where the `podman generate systemd` command would generate incorrect YAML for pods created without the `--name` option.
- Fixed a bug where the `podman generate systemd --new` command did not properly set stop timeout ([#16149](https://github.com/containers/podman/issues/16149)).
- Fixed a bug where a broken OCI spec resulting from the system rebooting while a container is being started could cause the `podman inspect` command to be unable to inspect the container until it was restarted.
- Fixed a bug where creating a container with a working directory on an overlay volume would result in the container being unable to start ([#15789](https://github.com/containers/podman/issues/15789)).
- Fixed a bug where attempting to remove a pod with running containers without `--force` would not error and instead would result in the pod, and its remaining containers, being placed in an unusable state ([#15526](https://github.com/containers/podman/issues/15526)).
- Fixed a bug where memory limits reported by `podman stats` could exceed the maximum memory available on the system ([#15765](https://github.com/containers/podman/issues/15765)).
- Fixed a bug where the `podman container clone` command did not properly handle environment variables whose value contained an `=` character ([#15836](https://github.com/containers/podman/issues/15836)).
- Fixed a bug where the remote Podman client would not print the container ID when running the `podman-remote run --attach stdin` command.
- Fixed a bug where the `podman machine list --format json` command did not properly show machine starting status.
- Fixed a bug where automatic updates would not error when attempting to update a container with a non-fully qualified image name ([#15879](https://github.com/containers/podman/issues/15879)).
- Fixed a bug where the `podman pod logs --latest` command could panic ([#15556](https://github.com/containers/podman/issues/15556)).
- Fixed a bug where Podman could leave lingering network namespace mounts on the system if cleaning up the network failed.
- Fixed a bug where specifying an unsupported URI scheme for `podman system service` to listen at would result in a panic.
- Fixed a bug where the `podman kill` command would sometimes not transition containers to the exited state ([#16142](https://github.com/containers/podman/issues/16142)).
  [#]## API
- Fixed a bug where the Compat DF endpoint reported incorrect reference counts for volumes ([#15720](https://github.com/containers/podman/issues/15720)).
- Fixed a bug in the Compat Inspect endpoint for Networks where an incorrect network option was displayed, causing issues with `docker-compose` ([#15580](https://github.com/containers/podman/issues/15580)).
- The Libpod Restore endpoint for Containers now features a new query parameter, `pod`, to set the pod that the container will be restored into ([#15018](https://github.com/containers/podman/issues/15018)).
- Fixed a bug where the REST API could panic while retrieving images.
- Fixed a bug where a cancelled connection to several endpoints could induce a memory leak.
  [#]## Misc
- Error messages when attempting to remove an image used by a non-Podman container have been improved ([#15006](https://github.com/containers/podman/issues/15006)).
- Podman will no longer print a warning that `/` is not a shared mount when run inside a container ([#15295](https://github.com/containers/podman/issues/15295)).
- Work is ongoing to port Podman to FreeBSD.
- The output of `podman generate systemd` has been adjusted to improve readability.
- A number of performance improvements have been made to `podman create` and `podman run`.
- A major reworking of the manpages to ensure duplicated options between commands have the same description text has been performed.
- Updated Buildah to v1.28.0
- Updated the containers/image library to v5.23.0
- Updated the containers/storage library to v1.43.0
- Updated the containers/common library to v0.50.1</changelog>
</package>
<package pkgid="a36470bda23216935182da951620967ba332a1d47130044ac19d4dc879cbc777" name="podman" arch="src">
  <version epoch="0" ver="4.3.1" rel="150400.4.11.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024 / bsc#1193166, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190 / bsc#1193273, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="rbrown@suse.com" date="1647432000">- Update to version 4.0.2:
  * Bump to v4.0.2
  * Update release notes for v4.0.2
  * Revert "use GetRuntimeDir() from c/common"
  * Revert "Option --url and --connection should imply --remote."
  * Option --url and --connection should imply --remote.
  * Bump to v4.0.2-dev
  * Bump to v4.0.1
  * Update release notes for v4.0.1
  * Fix a potential flake in volume plugins tests
  * Propagate $CONTAINERS_CONF to conmon
  * tests: Remove inaccurate comment
  * System tests: show one-line config overview
  * provide better error on invalid flag
  * use GetRuntimeDir() from c/common
  * kube: honor --build=false and make --build=true by default
  * system tests: cleanup networks on teardown
  * Remove the runtime lock
  * Don't log errors on removing volumes inuse, if container --volumes-from
  * kube: honor mount propagation mode
  * Load ip_tables modules at boot
  * Cirrus: Disable F34 aka prior-fedora testing
  * Cirrus: Update VM Images for 4.0 release
  * Bump to v4.0.1-dev
  * Bump to v4.0.0
  * Release notes for v4.0.0 final
  * Fix lint
  * Fix manifest 4.0 Endpoints Branch forced 4.0 only endpoints
  * Introduce podman machine init --root=t|f and podman machine set --root=t|f
  * Initial implementation of mac forwarding using a privileged docker sock claim helper
  * ignition: propagate proxy settings from a host into a vm
  * Update to podman4 copr stream
  * Unify ls --filter docs for networks and pods
  * e2e: merge after/since image-filter tests
  * podman network: add documentation for netavark
  * create: Fix key=value annotation in the flag output
  * enable netavark specific tests
  * Fix checkpoint/restore pod tests
  * Make sure building with relative paths work correctly.
  * Add 409 response to swagger godoc
  * Fix images since/after tests
  * Changes of docker descriptions
  * Temporarily pull machine images from side repo
  * Cirrus: TODO: netavark/aardvark release branches
  * Cirrus: Expand netavark testing to include rootless
  * Cirrus: Minor - limit release task applicability
  * Cirrus: Add [CI:BUILD] magic that only builds
  * CI: fix nightly builds
  * Cirrus: Log netavark/aardvark binary build info.
  * Cirrus: Add netavark/aardvark system test task
  * Cirrus: Also download aardvark-dns binary
  * Cirrus: Add e2e task w/ upstream netavark
  * Revert minimum API change
  * netavark e2e tests
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC5
  * Update release notes for v4.0.0-RC5
  * Modify /etc/resolv.conf when connecting/disconnecting
  * Do not set the network config dir to cni plugin dir
  * Show API doc for several versions
  * [NO NEW TEST NEEDED] Add schema for ImageCreate 200 response.
  * fix: Multiplication of durations
  * move rootless netns slirp4netns process to systemd user.slice
  * compat: endpoint /build must set header content type as application/json in reponse
  * Cleanup: remove obsolete/misleading bug workaround
  * tests: retrofit healthcheck system tests
  * healthcheck, libpod: Read healthcheck event output from os pipe
  * Fix: Do not print error when parsing journald log fails
  * Bump github.com/buger/goterm from 1.0.1 to 1.0.4
  * append podman dns search domain
  * Podman pod create --share-parent vs --share=cgroup
  * System tests: revert emergency skip of checkpoint tests
  * Add version guard to libpod API endpoints
  * [v4.0] Bump c/common to v0.47.4
  * idmap should be able to be specified along with other options
  * Vendor in containers/buildah v1.24.1
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC4
  * Disable failing E2E test
  * Revert "Move each search dns to its own line"
  * Move each search dns to its own line
  * Update release notes for v4.0.0-RC4
  * Document `schema` values in the `--url` flag
  * podman image scp syntax correction
  * system prune: remove all networks
  * Only change network fields if they were actually changed by the user
  * docs: clarify rootless net stats
  * Fix size to match Docker selection
  * libpod: enforce noexec,nosuid,nodev for /dev/shm
  * Clarify remote client means Mac and Windows
  * libpod: report slirp4netns network stats
  * Add notes to "--oom-kill-disable" not supported on cgroups V2
  * Fix use of infra image to clarify default
  * Adapt podman images ls filters docs to be aligned with prune filters docs
  * ignition, machine: delegate cpu,io cgroup controllers to machine's default users
  * pkg/bindings/images.Build(): slashify "dockerfile" values, too
  * Remove mention of IPv6 portfwd from release notes
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC3
  * Update release notes for v4.0.0-RC3
  * Fix Cirrus destination branch
  * volume: add support for non-volatile upperdir,workdir for overlay volumes
  * github: label issues based on os fix regex
  * github: label issues based on os
  * Cirrus: Fix get_ci_vm.sh initial setup
  * System tests: emergency skip of checkpoint tests
  * network create: allow multiple subnets
  * Update troubleshooting.md
  * Fix sort ordering of filters
  * Unify podman prune filter description: volumes, networks, system
  * Bump Buildah to v1.24.0
  * rootless: drop permission check for devices
  * switch podman image scp from depending on machinectl to just os/exec
  * Bump github.com/containers/image/v5 from 5.18.0 to 5.19.0
  * Bump github.com/containers/storage from 1.38.0 to 1.38.1
  * change location of where make outputs podman binary on osx
  * Github workflow: Fix parsing of GraphQL response JSON
  * Github-workflow: Fix YAML syntax
  * Update godoc, swagger using wrong struct
  * Makefile: install targets independent of build
  * [CI:DOCS] Fix typos and improve language
  * CI: enable rootless-remote system tests
  * pkg/specgen/generate/security: fix error message
  * Github workflow: Send e-mail on job error
  * Github workflow: Update Cirrus-cron GraphQL query
  * remote build: set rootless oci isolation correctly
  * [CI:DOCS] Fix typos and improve language
  * Fix handling of duplicate matches on id expansion
  * Show correct default values or show none
  * exec: retry rm -rf on ENOTEMPTY and EBUSY
  * container create: do not check for network dns support
  * libpod: fix leaking fd
  * libpod: fix connection leak
  * [CI:DOCS] fix typo subpordinate
  * Fix filter description and unify filters docs for containers/images prune
  * Remove unused param and clean API handlers
  * Restore machine start logic that was hanging
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC2
  * Final release notes for v4.0.0-rc2
  * Run codespell on code
  * Update release notes for Podman v4.0.0
  * Fix #2 for compat commit handling of --changes
  * Fix nil pointer dereference for configmap optional
  * Make error message matching in 030-run.bats less fragile
  * Don't explicitly check for crun|runc in package information
  * Don't segfault if an image layer has no creation timestamp
  * compat: remove hardcoded index from load images output report
  * compat: images/load must be able to load tar with multiple images
  * System tests: fix for new systemd on rawhide
  * Remove rootless_networking option from containers.conf
  * vendor c/psgo@v1.7.2 (fixes CVE-2022-1227 / bsc#1182428)
  * Engine.Remote from containers.conf
  * vendor: bump c/common and other vendors
  * rootless: report correctly the error
  * Implement API forwarding for podman machine on Windows
  * Implement env parsing on Windows
  * Handle changes in docker compat mode
  * Show package version when running on alpine
  * Handlers for `generate systemd` with custom dependencies
  * APIv2 tests: followup to recent log test
  * Add IndexConfigs to compat /info endpoint
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * apiv2 test: add regression test for #12904
  * SECURITY.md: fix the project name
  * rename --cni-config-dir to --network-config-dir
  * compat attach: fix write on closed channel
  * upgrade all dependencies
  * Revert "Cirrus: Temporarily disable OSX Cross task"
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * bump go module to version 4
  * [NO NEW TESTS NEEDED] add builddeps to copr template
  * CI: rootless user: also create in some root tests
  * [WIP] Tests for podman image scp (the sudo form)
  * Revamp Libpod state strings for Docker compat
  * Cirrus: Temporarily disable OSX Cross task
  * update c/common to latest
  * Use PODMAN_USERNS environment variable when running as a service
  * Unify the method of parsing filters in cmd
  * fix default branch links
  * [CI:DOCS] fix default branch links
  * [CI:DOCS] Unprivileged native overlayfs is now supported
  * [CI:DOCS] Fix typo in --env
  * Recursively copy cert files.
  * Refactor manifest list operations
  * Add rpkg template for COPR autobuild
  * Fix cgroup mode handling in api server
  * Standardize on capatalized Cgroups
  * test/system: podman run update /etc/hosts
  * Remove two GetImages functions from API
  * Use fully-qualified device name in CDI test
  * Use new CDI API
  * troubleshooting links to main branch
  * Podman Build use absolute filepath
  * Prohibit --uid/gid map and --pod for container create/run
  * podman container rm: remove pod
  * Manual fixes for PR #12642:
  * podman build enable --all-platforms and --unsetenv
  * use events_logfile_path from containers.conf for events log.
  * Podman Pod Create --sysctl support
  * Wait for podman stop to complete
  * libpod: fix check for systemd session
  * libpod: refine check for empty pod cgroup
  * fix buildah-bud test diff
  * upgrade test: check that network backend is cni
  * use netns package from c/common
  * update buildah to latest and use new network stack
  * podman image scp: implement --quiet
  * use libnetwork from c/common
  * Add --noout option to prevent the output of ids
  * remote events: convert TimeNano properly
  * Bump github.com/BurntSushi/toml from 0.4.1 to 1.0.0
  * vendor latest c/common
  * add additional fields to podman machine ls --json
  * buildah bud tests: skip failing tests
  * Fix permission on secrets directory
  * Add podman rm --depend
  * fix host.containers.internal entry for macvlan networks
  * It takes some time to start a VM
  * Pretty Print output of podman machine ls --format json
  * Use the InfraImage defined in containers.conf
  * Cirrus: Freshen VM images
  * Revert "Cirrus: Temp. ignore gitlab task failures"
  * pkg: use PROXY_VARS from c/common
  * ignition: add support from setting SSL_CERT_FILE
  * ignition: propogate HTTP proxy variables from host to remote
  * System tests: fix RHEL8 gating tests
  * vendor c/common
  * Remove dead RuntimeOption functions
  * Update docker cli message for case where user creates directory
  * Don't add env if optional and not found
  * Fix type-o in podman.wxs
  * [CI:DOCS] fixes indentation of example pod yaml
  * Prevent double decoding of storage options
  * Emergency system-test fixes
  * add OCI Runtime name to errors
  * fix healthcheck timeouts and ut8 coercion
  * Don't rename pod if container has the same name
  * Set volume NeedsCopyUp to false iff data was copied up
  * Fix CI
  * correct typo words in docs
  * Change Tests to ignore missing containers when removing --all
  * test/e2e/pod_initcontainers: fix a flake
  * test/e2e/run: don't use date +%N on Alpine
  * Support all volume mounts for rootless containers
  * Fix wrong 'podman search --format' placeholder
  * Fix Container List API call to return mount info
  * fix misleading comment regarding default value of cpu period [NO NEW TESTS NEEDED]
  * add --ip6 flag to podman create/run
  * legacy events: also set exitCode
  * Don't initialize the global RNG with GinkgoRandomSeed() in e2e tests
  * Avoid collisions on RemoteSocket paths
  * Refactor remote socket path determination in tests
  * fix doc
  * test/system: podman run image with filesystem permission
  * test/system: podman run with log-opt option
  * Update swagger documentation
  * Make it possible to select the volume driver
  * Check the mount type for future compatibility
  * Implement virtfs volumes for podman machine
  * [CI:DOCS] Add example of cpus to init command
  * prefix imageId with sha256: in containers list test for compat API ImageId
  * Pod Security Option support
  * ignition: add certs from current user into the machine while init
  * docs: sort swagger operations alpabetically
  * .service file removal on failure
  * Introduce Windows WSL implementation of podman machine
  * podman image scp never enter podman user NS
  * Allow users to add host user accounts to /etc/passwd
  * container creation: don't apply reserved annotations from image
  * [CI:DOCS] clarify `io.podman.annotations.seccomp`
  * Error out early if system does not support pre-copy checkpointing
  * Update go-criu to v5.3.0
  * [CI:DOCS] docs: document rootless userns mappings
  * Switch to a new installer approach using a path manipulation helper
  * e2e: Add dev/shm checkpoint/restore test
  * Enable checkpoint/restore for /dev/shm
  * Update github.com/checkpoint-restore/checkpointctl
  * Always run passwd management code when DB value is nil
  * Warn on use of --kernel-memory
  * support hosts without /etc/hosts
  * Podman run --passwd
  * ci: force scratch build for crun
  * Use hosts public ip address in rootless containers
  * compat: image normalization: handle sha256 prefix
  * specgen: honor userns=auto from containers.conf
  * [CI:DOCS] Small checkpoint/restore man page fixes
  * [CI:DOCS] Explicitly mention that checkpointing systemd containers might fail
  * vendor: update containers/storage
  * build: fix test for subid 4
  * test: add --rm to podman run commands
  * fix(generate): fix up podman generate kube missing env field bug
  * legacy events: also set Action="die"
  * rootless: include the args in the debug message
  * apiv2 tests: use quay.io/libpod/testimage:20210610 for platform tests
  * image rm: allow for force-remove infra images
  * tests: adjust old build test to expect exit code
  * Test for checkpoint specific inspect fields
  * Add more checkpoint/restore information to 'inspect'
  * build: relay exitcode from imagebuildah to registry
  * Removed .service file for healthchecks
  * Set machine timezone
  * MovePauseProcessToScope do not seed everytime
  * bindings rmi test: clarify behavior
  * bump cobra to 1.3.0
  * .github: revert to the old template
  * oci: configure the devices cgroup with default devices
  * kill: fix output
  * e2e: search flake: skip test on registry.redhat.io
  * APIv2 tests: fail on syntax/logic errors
  * Show --external containers even without --all option
  * apiv2 tests: refactor complicated curls
  * fix network id handling
  * Update Windows Install Doc
  * Fixes #12063 Add docker compatible output after image build.
  * pause scope: don't use the global math/rand RNG
  * specgen: check that networks are only set with bridge
  * container restore/import: store networks from db
  * play kube add support for multiple networks
  * support advanced network configuration via cli
  * Add new networks format to spegecen
  * fix incorrect swagger doc for network dis/connect
  * network connect allow ip, ipv6 and mac address
  * network db: add new strucutre to container create
  * remove unneeded return value from c.Networks()
  * network db rewrite: migrate existing settings
  * network ls: show networks in deterministic order
  * Bump github.com/docker/docker
  * pprof flakes: bump timeout to 20 seconds
  * Add secret list --filter to cli
  * Cirrus: Temp. ignore gitlab task failures
  * compat build: adhere to q/quiet
  * Make XRegistryAuthHeader and XRegistryConfigHeader private
  * Remove the authfile parameter of MakeXRegistryAuthHeader
  * Simplify the header decision in pkg/bindings/images.Build a bit
  * Remove the authfile parameter of MakeXRegistryConfigHeader
  * Remove no-longer-useful name variables
  * Consolidate creation of SystemContext with auth.json into a helper
  * Remove pkg/auth.Header
  * Call MakeXRegistryAuthHeader instead of Header(..., XRegistryAuthHeader)
  * Turn headerAuth into MakeXRegistryAuthHeader
  * Call MakeXRegistryConfigHeader instead of Header(..., XRegistryConfigHeader)
  * Turn headerConfig into MakeXRegistryConfigHeader
  * Move the auth file creation to GetCredentials
  * Consolidate the error handling path in GetCredentials
  * Only look up HTTP header values once in GetCredentials
  * Use Header.Values in GetCredentials.has
  * Beautify GetCredentials.has a bit
  * Pass a header value directly to parseSingleAuthHeader and parseMultiAuthHeader
  * Simplify parseSingleAuthHeader
  * Simplify the interface of parseSingleAuthHeader
  * Don't return a header name from auth.GetCredentials
  * Fix normalizeAuthFileKey to use the correct semantics
  * Rename normalize and a few variables
  * Add TestHeaderGetCredentialsRoundtrip
  * Add tests for auth.Header
  * Improve TestAuthConfigsToAuthFile
  * Add unit tests for singleAuthHeader
  * Add unit tests for multiAuthHeader
  * fix e2e test missing network cleanup
  * pprof CI flakes: enforce 5 seconds grace period
  * [NO NEW TESTS NEEDED] rootless: declare TEMP_FAILURE_RETRY before usage (Fixes: #12563)
  * --hostname should be set when using --pod new:foobar
  * Cirrus: Use cached swagger binary
  * inotify: make sure to remove files
  * System tests: remove rm_pause_image()
  * specgen: honor empty args for entrypoint
  * generate systemd: support entrypoint JSON strings
  * Bump github.com/uber/jaeger-client-go
  * remove runlabel test for global opts
  * utils: reintroduce moveToCgroup
  * autocopr: distro conditionals for containers-common
  * vendor c/image/v5@main
  * Update vendor or containers/common moving pkg/cgroups there
  * volume: apply exact permission of target directory without adding extra 0111
  * Cirrus: Remove remnants of nix-based static build
  * Refactor podman pods to report.Formatter
  * rootless netns: resolve all path components for resolv.conf
  * tests: clean up FIXMEs and noise
  * fix remote run/start flake
  * e2e: fix pprof flakes
  * Bump github.com/opencontainers/runc from 1.0.2 to 1.0.3
  * vendor c/common@main
  * Escape trailing slash in install directory location so the closing quote is not escaped
  * centos 9 stream cannot use %autochangelog
  * Refactor podman system to report.Formatter [NO NEW TESTS NEEDED]
  * add spec file for automated copr builds
  * Add restart-sec option to systemd generate
  * Fix documentation of (podman image save --compress --uncompressed)
  * Improve documentation of (podman image save --format)
  * Add support for configmap volumes to play kube
  * cmd, push: use the configured compression format
  * [CI:DOCS] logformatter: fix corner case with links
  * UPdate vendor of image-spec and containers/storage
  * vendor: update containers/common
  * Update doc to explictly mention using ed25519 in ssh keys
  * Refactor podman image command output
  * Manual fixes
  * Same thing, with BeNumerically("==", x)
  * Use HaveLen(x) instead of Expect(len(y)).To(Equal(x))
  * Same thing, for BeNumerically("==", 0)
  * Use BeEmpty() instead of len(x).To(Equal(0))
  * Same as previous, for assertions other than Equal()
  * e2e tests: a little more minor cleanup
  * compat API: push: report size of manifest
  * compat: images/json
  * Add ashley-cui, lsm5 and floutoc to owners
  * remove ARTIFACT_DIR and ArtifactPath
  * Image caches: allow overriding cache dir
  * Rename CrioRoot as just Root
  * Fix possible rootless netns cleanup race
  * [NO NEW TESTS NEEDED] Refactor podman container command output
  * Hostname in `spec.hostname` should be passed to infra ctr init opt
  * container, cgroup: detect pid termination
  * top: parse ps(1) args correctly
  * podman, push: expose --compression-format
  * e2e: yet more cleanup of BeTrue/BeFalse
  * Ensure the generated NodePort values are unique
  * Allow containerPortsToServicePorts to fail
  * Don't use the global math/rand RNG for service ports
  * Move a comment to the relevant place
  * a few more manual BeTrue cleanups
  * Convert strings.Contains() to Expect(ContainSubstring)
  * e2e tests: more cleanup of BeTrue()s
  * Implement 'podman run --blkio-weight-device'
  * systemd: replace multi-user with default.target
  * compat API: allow enforcing short-names resolution to Docker Hub
  * Fixed the containerfile not found during remote build.
  * podman-remote: prevent leaking secret into image
  * podman-remote: copy secret to contextdir is absolute path on host
  * api: allow build api to accept secrets
  * Only open save output file with WRONLY
  * List /etc/containers/certs.d as default for --cert-path
  * e2e tests: enable golint
  * fix: parsing of HostConfig.Mounts for container create
  * Move the chown to after the ADDs
  * fix: error reporting for archive endpoint
  * Bindings test: emit GIT_COMMIT, for links in logs
  * checkpoint do not modify XDG_RUNTIME_DIR
  * libpod: improve heuristic to detect cgroup
  * libpod, inspect: export cgroup path
  * stats: get the memory limit from the spec
  * compat: Add compatiblity with Docker/Moby API for scenarios where build fails
  * libpod: leave thread locked on errors
  * Find and fix empty Expect()s
  * Unset SocketLabel after system finishes checkpointing
  * Remove StringInSlice(), part 2
  * Remove StringInSlice(), part 1
  * e2e test cleanup, continued
  * Update basic_networking.md
  * Warn on failing to update container status
  * oci: ack crun output when container is not there
  * oci: exit gracefully if container is already dead
  * Support env variables based on ConfigMaps sent in payload
  * image lookup: do not match *any* tags
  * generate systemd: add --start-timeout flag
  * Oops! Manual edits to broken tests
  * e2e tests: clean up antihelpful BeTrue()s
  * Cirrus: Strip out static nix build
  * Rename pod on generate of container
  * [CI:DOCS] Update notes on java TZ in man page
  * Bump github.com/containers/image/v5 from 5.16.1 to 5.17.0
  * Fix netavark error handling and teardown issue
  * swagger: add layers to build api docs
  * compat: add layer caching compatiblity for non podman clients
  * Bump github.com/opencontainers/selinux from 1.9.1 to 1.10.0
  * Add note about volume with unprivileged container
  * Add EXPOSE e2e test
  * Support EXPOSE with port ranges
  * compat: Add subnet mask behind IP address to match Docker API
  * [CI:DOCS] Add java TZ note to run manpage
  * Bump github.com/rootless-containers/rootlesskit from 0.14.5 to 0.14.6
  * podman-remote does not support signature-policy
  * Add tests for restore runtime verification
  * Use same runtime to restore a container as during checkpointing
  * Force iptables driver for netavark tests
  * Make sure netavark output is logged to the syslog
  * filter: use filepath.Match to maintain consistency with other pattern matching in podman
  * Semiperiodic cleanup of obsolete Skip()s
  * [CI:DOCS]upload a translation file
  * api/handlers: Add checkpoint/restore FileLocks
  * test: Update error string for --file-locks test
  * fix duplicated logs command
  * Bump github.com/docker/docker
  * Bump k8s.io/api from 0.22.3 to 0.22.4
  * Do not store the exit command in container config
  * Add test for checkpoint/restore with --file-locks
  * Add --file-locks checkpoint/restore option
  * Cirrus: Bump Fedora to release 35
  * Cirrus: Partially revert catatonit --force install
  * Revert "Cirrus: Temp. disable prior-fedora testing"
  * Cirrus: Workaround log_driver=journald setting
  * Cirrus: Fix bindings test hang b/c logging config mismatch
  * Cirrus: Timeout bindings test after 30m
  * Cirrus: Log more things in bindings and unit tests
  * Minor Makefile fix
  * rootless netns, one netns per libpod tmp dir
  * Introduce Address type to be used in secondary IPv4 and IPv6 inspect data structure.
  * volumes: add new option idmap
  * remote checkpoint/restore: more fixes
  * fix CI
  * fix: take absolute path for dd on apple silicon
  * System tests: new checkpoint tests
  * rootless: use catatonit to maintain user+mnt namespace
  * rootless: drop strerror(errno) calls
  * rootless: reuse existing open_namespace function
  * rootless: use auto cleanup functions
  * utils: use podman-pause-$RANDOM.scope name
  * hack/bats: deal with new bin helpers
  * Change error message for compatibility with docker
  * rename libpod nettypes fields
  * podman machine start wait for ssh
  * fix remote checkpoint/restore
  * Add --unsetenv &amp; --unsetenv-all to remove def environment variables
  * Set config environment variables early in Podman init
  * journald logs: keep reading until the journal's end
  * secret: honor custom target for secrets with run
  * bindings: reuse context for API requests
  * podman machine improve port forwarding
  * Network test: fix podman-remote-rootless corner case
  * filter: add basic pattern matching for label keys
  * cirrus: force-install catatonit
  * infra container: replace pause with catatonit
  * Revert "add kubernetes pause"
  * Added test for checkpoint/restore --print-stats
  * Update man pages for checkpoint/restore --print-stats
  * Added optional container restore statistics
  * Added optional container checkpointing statistics
  * Error logs --follow if events-backend != journald, event-logger=journald
  * Enable 'podman run --memory-swappiness=0'
  * Fix network mode in play kube
  * Always create working directory when using compat API
  * play kube: don't force-pull infra image
  * Podman Image SCP transfer patch
  * --authfile command line argument for image sign command.
  * Cirrus: Temp. disable prior-fedora testing
  * Cirrus: Update to Ubuntu 21.10
  * Add failing run test for netavark
  * Add flag to overwrite network backend from config
  * libpod: create /etc/mtab safely
  * Add network backend to podman info
  * Add more netavark tests
  * select network backend based on config
  * Fix RUST_LOG envar for netavark
  * netavark IPAM assignment
  * netavark network interface
  * Make networking code reusable
  * Fix flake in upgrade tests
  * export adding id-specifier code to setContainerNameForTemplate
  * VOLUME must be declared after RUN chown command
  * network reload return error if we cannot reload ports
  * network reload without ports should not reload ports
  * Print headers for system connection ls
  * [CI:DOCS] Add CI check for SEE ALSO in man pages
  * podman load: support downloading files
  * Add links to all SEE ALSO sections
  * pod create: read infra image from containers.conf
  * rootless: adjust error message
  * Fix rootless networking with userns and ports
  * support health checks from image configs
  * change from run to create in 250-systemd.bats
  * Exclude already built sources for static build
  * shm_lock: Handle ENOSPC better in AllocateSemaphore
  * Fix Zsh completion command documentation
  * Match .c files in Makefile
  * Add Static Build download instructions to README
  * Add links to podman build,run, create see also
  * Minor test tweaks
  * pod create: read network mode from config
  * Bump Catatonit up to v0.1.7
  * test connection add
  * system: Adds support for removing all named destination via --all
  * pod/container create: resolve conflicts of generated names
  * podman-generate-kube - remove empty structs from YAML
  * Add some information about disabling SELinux when using system volumes
  * Fix swagger definition for the new mac address type
  * Log Apache access_log-like entries at Info level [NO NEW TESTS NEEDED]
  * Test to check for presence of 'stats-dump' in exported checkpoints
  * Add 'stats-dump' file to exported checkpoint
  * Podman Image SCP rootful to rootless transfer
  * rename rootless cni ns to rootless netns
  * mount full XDG_RUNTIME_DIR in rootless cni ns
  * Bump github.com/checkpoint-restore/go-criu/v5 from 5.1.0 to 5.2.0
  * Keep error semantics intact
  * Fix rootless cni netns cleanup logic
  * tweak a couple of flag descriptions in help output
  * Update swagger doc make filed optional
  * Fix bindings container log test
  * test: run --cgroups=split in new cgroup
  * MAC address json unmarshal should allow strings
  * Make stop message more similar to start
  * Implement top streaming for containers and pods
  * Handle HTTP 409 error messages properly for Pod actions
  * Add tests
  * Fix swagger definitions
  * More conforming libpod API and swagger types
  * More conforming libpod API and swagger types
  * Better emptiness test for custom JSON serializer
  * System tests: enhance volume test, add debug prints
  * add unit test to containers_test
  * Use correct swagger type in doc-comment
  * Cirrus: Authorize rootless user self-ssh
  * Fix libpod API conformance to swagger
  * Fix help message case for `podman version`
  * Fix pause usage example
  * Use systemctl in local system test
  * Allow label and labels when creating volumes
  * volumes: be more tolerant and fix infinite loop
  * Add information on how podman machine is updated
  * volumes: allow more options for devpts
  * volumes: do not pass mount opt as formatter string
  * Bump k8s.io/api from 0.22.2 to 0.22.3
  * runtime: change PID existence check
  * oci: rename sub-cgroup to runtime instead of supervisor
  * libpod: deduplicate ports in db
  * Set flags to test 'logs -f' with journald driver
  * Set Checkpointed state to false after restore
  * container create: fix --tls-verify parsing
  * runtime: check for pause pid existence
  * utils: do not overwrite the err variable
  * Fix systemd PID1 test
  * Record the image stream along with the path
  * cgroups: use SessionBusPrivateNoAutoStartup
  * vendor: update godbus to v5.0.6
  * Slirp4netns with ipv6 set net.ipv6.conf.default.accept_dad=0
  * Fix a few problems in 'podman logs --tail' with journald driver
  * Allow 'container restore' with '--ipc host'
  * Document to not set K8S envars for CNI
  * Bump github.com/docker/docker
  * pod create: remove need for pause image
  * add kubernetes pause
  * cirrus: containers: mount directory in /var/tmp to /tmp
  * overlay root fs: create mount on runtime dir
  * Update vendor github.com/opencontainers/runtime-tools
  * If Dockerfile exists in same directory as service, we should not use it.
  * Fix tests of podman image trust --raw and --json
  * Tighten the expected output of the "podman image trust show" test
  * Use INTEGRATION_ROOT instead of current directory
  * Add support to play kube for --log-opt
  * [NO NEW TESTS NEEDED] Fix off-by-one index comparision (reported by LGTM)
  * Fix some typos in documentation and comments (found by codespell)
  * Replace 'an user' =&gt; 'a user'
  * [CI:DOCS] Fix typo keep_id -&gt; keep-id
  * Set DOCKER_HOST in the VM
  * fuse-overlay probably means fuse-overlayfs.
  * Support template unit files in podman generate systemd
  * Remove --kernel-memory options
  * tag: Support tagging manifest list instead of resolving to images
  * Remove infra ID from DB before removing containers
  * System tests: confirm that -a and -l clash
  * systemd: compatible with rootless mode
  * system tests: CONTAINER_* and --help: cleanup
  * podman run --memory=0 ... should not set memory limit
  * Add information on how to discover default log driver
  * Add test for system connection
  * Generate Kube should not print default structs
  * libpod: change mountpoint ownership c.Root when using overlay on top of external rootfs
  * Change podman connection list to use default field
  * Allow API to specify size and inode quota
  * Use exponential backoff when waiting for a journal entry
  * Pod Rm Infra Improvements
  * system tests: socket activation: clean up
  * rootfs-overlay: fix overlaybase path for cleanups
  * Move CONTAINER_HOST and _CONNECTION to IsRemote Function
  * We should only be relabeling when on first run
  * If CONTAINER_HOST env variable is set default podman --remote=true
  * Set targetPort to the port value in the kube yaml
  * Do not add TCP to protocol in generated kube yaml
  * Use CGO_ENABLED=1 when building natively on darwin
  * Test-hang fix: Wait for ready + timeout on connect.
  * Checkpoint/Restore test fixes
  * Don't include ctr.log if not using file logging
  * Don't use docker/pkg/archive, use containers/storage/pkg/archive
  * Fix codespell errors
  * Adjust tests to verify all subcommands show the help message
  * Fix panic in container create compat api
  * Don't add image entrypoint to the generate kube yaml
  * Display help text on empty subcommand by default
  * podman search: display only name and description by default
  * codespell code
  * Add information about .containerignore to podman build man page
  * CNI: fix network create --ip-range
  * Kube Gen run as user/group issues
  * rootlessport: reduce memory usage of the process
  * No space in kube annotations for bind mounts
  * Fix CI flake on time of shutdown for API service
  * Refactor podman search to be more code friendly
  * Unit files: Use actual installed path for podman
  * Bump github.com/onsi/ginkgo from 1.16.4 to 1.16.5
  * cgroups: use cgroup.controllers to read controllers
  * builder: Add support for builder prune
  * Remove a volume with --force if container is running
  * Use SplitN(2) when copying env variables
  * podman stats: move cgroup validation to server
  * fix test
  * Support readonly rootfs contains colon
  * [CI:DOCS] oci-hooks.5.md: fixup section in header
  * Enable /debug/pprof API service endpoints
  * Not all fields in machine list were set properly
  * faster image inspection
  * Warn if podman stop timeout expires that sigkill was sent
  * [CI:DOCS] introduce --replace flag for play kube
  * [CI:DOCS] Include manifest example usage
  * Change podman.1 man page to show corret log-level default
  * Bump github.com/opencontainers/selinux from 1.8.5 to 1.9.1
  * Fixes #11668
  * libpod: fix race when closing STDIN
  * Ensure `podman ps --sync` functions
  * Allow `podman stop` to be run on Stopping containers
  * Bump github.com/containers/image/v5 from 5.16.0 to 5.16.1
  * Bump github.com/docker/docker
  * It really should be no **NEW** tests needed
  * README.md: Point to Podman's channels
  * Add podman-plugins to upstream image
  * CNI networks: reload networks if needed
  * bump c/common to latest and c/storage to 1.37.0
  * Add --time out for podman * rm  -f commands
  * Cirrus: Fix defunct package metadata breaking cache
  * Pod Events Logging Fix
  * [NO TESTS NEEDED] Ignore removed containers
  * Pod Volumes From Support
  * Add note about empty fields and null values for API responses
  * Bump github.com/containers/buildah from 1.23.0 to 1.23.1
  * Add podman play kube --no-hosts options
  * Gating tests: fix permissions error
  * pkg/specgen: cache image in generator
  * cirrus: gitlab: download packages
  * Add guard for BuildOptions.CommonBuildOpts
  * System tests: tighten 'is' operator
  * Update README and release notes for v3.4.0
  * sdnotify test: accept MAINPID anywhere
  * machine: silently cleanup dangling sockets before rm if possible
  * Add expose type map[uint16]string to description
  * [NO TESTS NEEDED] Fix typo in storage.conf file exists message
  * Support selinux options with bind mounts play/gen
  * kube: fix conversion from milliCPU to period/quota
  * Bump github.com/mattn/go-isatty from 0.0.12 to 0.0.14
  * test: use new helper
  * test: skip test on rootless cgroupsv1
  * machine: Info on successfully stopping qemu machine
  * Allow a value of -1 to set unlimited pids limit
  * Vendor in latest containers/storage
  * Storage can remove ErrNotAContainer as well
  * libpod: container create: init variable: do not deep copy spec
  * libpod: add GetConfigNoCopy()
  * libpod: add execSessionNoCopy
  * libpod: do not call (*container).Spec()
  * Pod Device-Read-BPS support
  * Remind user to check connection or use podman machine
  * Ensure pod ID bucket is properly updated on rename
  * Fix contributor make targets on Ubuntu and Debian
  * Implement PR template to assist review &amp; release
  * libpod: do not call (*container).Config()
  * [NO TESTS NEEDED] Add port configuration to first regular container
  * [CI:DOCS] cmd/podman: no dot for short descriptions
  * move network alias validation to container create
  * set --cni-config-dir for exit command
  * always add short container id as net alias
  * image prune: support removing external containers
  * System tests: speed up. They've gotten too slow.
  * Add dockerfile.5 as man link to containerfile man page
  * Set MSI to be 64-bit only.
  * fix podman network prune integration test flakes
  * Cirrus: Add gitlab podman runner test
  * CNI: network remove do not error for ENOENT
  * remote build: EvalSymlinks() the context directory
  * stop: Do nothing if container was never created in runtime
  * logging: new mode -l passthrough
  * Allow machine options to be set from containers.conf
  * Vendor in containers/common v0.46.0
  * podman machine: do not join userns
  * Disable docker and alias to podman in FCOS ignition
  * added healthcheck to ps command
  * Fix english on prune prompt
  * Document missing /images/search query parameters
  * rootful: do not set XDG_RUNTIME_DIR for cni plugins
  * Revert "rootful: unset XDG_RUNTIME_DIR"
  * Add completion for machine list format
  * Set context dir for play kube build
  * Makefile: use -ldflags/-gccgoflags depending on the go implemenatiton
  * Update docs for --platform in podman-build.1
  * shell completion: do not show images without tag
  * podman inspect add State.Health field for docker compat
  * podman save: enforce signature removal
  * Add JSON version of the machine list
  * Add support for :U flag with --mount option
  * [CI:DOCS] Add link to running ctrimage on enablesysadm
  * Ignore mount errors except ErrContainerUnknown when cleaningup container
  * standardize logrus messages to upper case
  * podman generate kube should not include images command
  * Fix machine image
  * sync container state before reading the healthcheck
  * Also show the (initial) disk size
  * Show cpus and memory in machine list
  * Eighty-six eighty-eighty
  * net types: remove omitempty from required fields
  * podman save: add `--uncompressed`
  * Bump CNI to v1.0.1
  * vendor c/psgo@v1.7.1
  * [CI:DOCS] Add network alias note in man pages
  * Add a backoff and retries to retrieving exited event
  * Cross-build release-archives w/ arch in filename
  * Fix Error, empty output for info: 'VERSION'
  * Generate kube should'd add podman default environment vars
  * volume: Add support for overlay on named volumes
  * Pod Device Support
  * Support --format tables in ps output
  * Remove references to kube being development
  * Add support for retrieving system service --timeout
  * Add podman image/container inspect man pages
  * [CI:DOCS] Add link to skopeo delete in podman rmi
  * vendor c/common@main
  * remote untag: support digests
  * Created MapOptions for PodCreate
  * Bump k8s.io/api from 0.22.1 to 0.22.2
  * compat API: /images/json prefix image id with sha256
  * podman machine: use gvproxy for host.containers.internal
  * utils: return error message from StartTransientUnit
  * utils: raise warning only on cgroupv2
  * Add podman machine init --now option
  * System tests: cleanup, and remove obsolete skips
  * Add username flag for machine ssh
  * Remove unused code from libpod
  * [CI:DOCS] markdown cleanup
  * Fix up build the docs site
  * Use a new markdown converter for sphinx
  * runtime: move pause process to scope
  * system: move MovePauseProcessToScope to utils
  * system: always move pause process when running on systemd
  * system: avoid reading pause pid file
  * Only add 127.0.0.1 entry to /etc/hosts with --net=none
  * Add no-trunc support to podman-events
  * CNI: add ipvlan driver
  * CNI: network create support macvlan modes
  * Do not allow network modes to be used as network names
  * fix inverted condition
  * Fix /auth compat endpoint
  * Add Drivers method to the Network Interface
  * CI: load ipv6 kernel modules for rootless tests
  * Drop OCICNI dependency
  * Wire network interface into libpod
  * cni network configs set ipv6 enables correctly
  * default network: do not validate the used subnets
  * network create: validate the input subnet
  * Set default storage from containers.conf for temporary images
  * container runlabel remove image tag from name
  * build.bats: fix copy tests after containers/buildah#3486
  * build: mirror --authfile to filesystem if pointing to FD instead of file
  * Fix example in podman machine init man page
  * vendor: Bump github.com/containers/buildah from 1.22.3 to 1.23.0
  * api: handle nil pointer dereference in rest endpoints
  * build: take advantage of --platform lists
  * Document `all` query parameter for /libpod/images/prune
  * Show variant and codename of the distribution
  * Use new aarch64 fcos repos
  * Enhance bindings for IDE hints
  * Pod Volumes Support
  * test: enable --cgroup-parent test
  * libpod: honor --cgroups=split also with pods
  * tests: enable --cgroups=disabled test for rootless
  * tests: simplify --cgroups=disabled test
  * libpod: rootful close binded ports
  * Search gvproxy with config.FindHelperBinary()
  * rootfs: Add support for rootfs-overlay and bump to buildah v1.22.1-0.202108
  * fix restart always with rootlessport
  * Cirrus: NM/CNI workaround + Remove prior-Ubuntu
  * If container exits with 125 podman should exit with 125
  * Bump github.com/json-iterator/go from 1.1.11 to 1.1.12
  * bump c/common to v0.44.0
  * remove rootlessport socket to prevent EADDRINUSE
  * Add deprecated fields for 1.22+ clients that still expect them
  * Use default username for podman machine ssh</changelog>
  <changelog author="michael@stroeder.com" date="1648814400">- Update to version 4.0.3:
  * Security
  - This release fixes CVE-2022-27649, where containers run by Podman would have excess inheritable capabilities set.
  * Changes
  - The podman machine rm --force command will now remove running machines as well (such machines are shut down first, then removed) (#13448).
  - When a podman machine VM is started that is using a too-old VM image, it will now start in a reduced functionality mode, and provide instructions on how to recreate it (previously, VMs were effectively unusable) (#13510).
  * Bugfixes
  - Fixed a bug where devices added to containers by the --device option to podman run and podman create would not be accessible within the container.
  - Fixed a bug where Podman would refuse to create containers when the working directory in the container was a symlink (#13346).
  - Fixed a bug where pods would be created with cgroups even if cgroups were disabled in containers.conf (#13411).
  - Fixed a bug where the podman play kube command would produce confusing errors if invalid YAML with duplicated container named was passed (#13332).
  - Fixed a bug where the podman machine rm command would not remove the Podman API socket on the host that was associated with the VM.
  - Fixed a bug where the remote Podman client was unable to properly resize the TTYs of containers on non-Linux OSes.
  - Fixed a bug where rootless Podman could hang indefinitely when starting containers on systems with IPv6 disabled (#13388).
  - Fixed a bug where the podman version command could sometimes print excess blank lines as part of its output.
  - Fixed a bug where the podman generate systemd command would sometimes generate systemd services with names beginning with a hyphen (#13272).
  - Fixed a bug where locally building the pause image could fail if the current directory contained a .dockerignore file (#13529).
  - Fixed a bug where root containers in VMs created by podman machine could not bind ports to specific IPs on the host (#13543).
  - Fixed a bug where the storage utilization percentages displayed by podman system df were incorrect (#13516).
  - Fixed a bug where the CPU utilization percentages displayed by podman stats were incorrect (#13597).
  - Fixed a bug where containers created with the --no-healthcheck option would still display healthcheck status in podman inspect (#13578).
  - Fixed a bug where the podman pod rm command could print a warning about a missing cgroup (#13382).
  - Fixed a bug where the podman exec command could sometimes print a timed out waiting for file error after the process in the container exited (#13227).
  - Fixed a bug where virtual machines created by podman machine were not tolerant of changes to the path to the qemu binary on the host (#13394).
  - Fixed a bug where the remote Podman client's podman build command did not properly handle the context directory if a Containerfile was manually specified using -f (#13293).
  - Fixed a bug where Podman would not properly detect the use of systemd as PID 1 in a container when the entrypoint was prefixed with /bin/sh -c (#13324).
  - Fixed a bug where rootless Podman could, on systems that do not use systemd as init, print a warning message about the rootless network namespace (#13703).
  - Fixed a bug where the default systemd unit file for podman system service did not delegate all cgroup controllers, resulting in podman info queries against the remote API returning incorrect cgroup controllers (#13710).
  - Fixed a bug where the slirp4netns port forwarder for rootless Podman would only publish the first port of a range (#13643).
  * API
  - Fixed a bug where the Compat Create API for containers did not properly handle permissions for tmpfs mounts (#13108).
  * Misc
  - The static binary for Linux is now built with CGo disabled to avoid panics due to a Golang bug (#13557).
  - Updated Buildah to v1.24.3
  - Updated the containers/storage library to v1.38.3
  - Updated the containers/image library to v5.19.2
  - Updated the containers/common library to v0.47.5</changelog>
  <changelog author="fvogt@suse.com" date="1649332800">- Add patch to fix starting containers on btrfs with SELinux
  (gh#opencontainers/selinux#172):
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
- Add patch to fix starting containers as user service with systemd 250
  (boo#1197672, gh#containers/podman#13731):
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch</changelog>
  <changelog author="fvogt@suse.com" date="1649332801">- Add patch to make buildah happy after selinux change:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch</changelog>
  <changelog author="rbrown@suse.com" date="1649764800">- Require catatonit &gt;= 0.1.7 for pause functionality needed by pods</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport upstream commit be5abf03ababc ("fix: Container.cGroupPath()
  skip empty line to avoid false error logging") for fixing "Error parsing
  cgroup: expected 3 fields but got 1" (see bsc#1199790, as it applies
  to Factory/Tumbleweed too)
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="rbrown@suse.com" date="1655899200">- Update to version 4.1.1:
  * The output of the podman load command now mirrors that of docker load.
  * Podman now supports Docker Compose v2.2 and higher. Please note that it may be necessary to disable the use of Buildkit by setting the environment variable DOCKER_BUILDKIT=0.
  * A new container command has been added, podman container clone. This command makes a copy of an existing container, with the ability to change some settings (e.g. resource limits) while doing so.
  * Podman now supports sending JSON events related to machines to a Unix socket named machine_events.*\.sock in XDG_RUNTIME_DIR/podman or to a socket whose path is set in the PODMAN_MACHINE_EVENTS_SOCK environment variable.
  * Two new volume commands have been added, podman volume mount and podman volume unmount. These allow for Podman-managed named volumes to be mounted and accessed from outside containers.
  * The podman container checkpoint and podman container restore options now support checkpointing to and restoring from OCI images. This allows checkpoints to be distributed via standard image registries.
  * The podman play kube command now supports environment variables that are specified using the fieldRef and resourceFieldRef sources.
  * The podman play kube command will now set default resource limits when the provided YAML does not include them.
  * The podman play kube command now supports a new option, --annotation, to add annotations to created containers.
  * The podman play kube --build command now supports a new option, --context-dir, which allows the user to specify the context directory to use when building the Containerfile.
  * The podman container commit command now supports a new option, --squash, which squashes the generated image into a single layer.
  * The podman pod logs command now supports two new options, --names, which identifies which container generated a log message by name, instead of ID and --color, which colors messages based on what container generated them.
  * The podman rmi command now supports a new option, --ignore, which will ignore errors caused by missing images.
  * The podman network create command now features a new option, --ipam-driver, to specify details about how IP addresses are assigned to containers in the network.
  * The podman machine list command now features a new option, --quiet, to print only the names of configured VMs and no other information.
  * The --ipc option to the podman create, podman run, and podman pod create commands now supports three new modes: none, private, and shareable. The default IPC mode is now shareable, indicating the the IPC namespace can be shared with other containers.
  * The --mount option to the podman create and podman run commands can now set options for created named volumes via the volume-opt parameter.
  * The --mount option to the podman create and podman run commands now allows parameters to be passed in CSV format.
  * The --userns option to the podman create and podman run commands now supports a new option, nomap, that (only for rootless containers) does not map the UID of the user that started the container into the container, increasing security.
  * The podman import command now supports three new options, --arch, --os, and --variant, to specify what system the imported image was built for.
  * The podman inspect command now includes information on the network configuration of containers that joined a pre-configured network namespace with the --net ns: option to podman run, podman create, and podman pod create.
  * The podman run and podman create commands now support a new option, --chrootdirs, which specifies additional locations where container-specific files managed by Podman (e.g. /etc/hosts, `/etc/resolv.conf, etc) will be mounted inside the container (#12961).
  * The podman run and podman create commands now support a new option, --passwd-entry, allowing entries to be added to the container's /etc/passwd file.
  * The podman images --format command now accepts two new format directives: {{.CreatedAt}} and {{.CreatedSince}}.
  * The podman volume create command's -o option now accepts a new argument, o=noquota, to disable XFS quotas entirely and avoid potential issues when Podman is run on an XFS filesystem with existing quotas defined.
  * The podman info command now includes additional information on the machine Podman is running on, including disk utilization on the drive Podman is storing containers and images on, and CPU utilization.
  * Fix CVE-2022-27191 / bsc#1197284
- Drop obsolete patches:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="predivan@mts.rs" date="1656676800">- Fix build on Leap
    Use libexec macro to set correct, per-distribution specific, directory.</changelog>
  <changelog author="michael@stroeder.com" date="1660219200">- Update to version 4.2.0:
  * Features
  - Podman now supports the Gitlab Runner (using the Docker executor), allowing its use in Gitlab CI/CD pipelines.
  - A new command has been added, podman pod clone, to create a copy of an existing pod. It supports several options, including --start to start the new pod, --destroy to remove the original pod, and --name to change the name of the new pod (#12843).
  - A new command has been added, podman volume reload, to sync changes in state between Podman's database and any configured volume plugins (#14207).
  - A new command has been added, podman machine info, which displays information about the host and the versions of various machine components.
  - Pods created by podman play kube can now be managed by systemd unit files. This can be done via a new systemd service, podman-kube@.service - e.g. systemctl --user start podman-play-kube@$(systemd-escape my.yaml).service will run the Kubernetes pod or deployment contained in my.yaml under systemd.
  - The podman play kube command now honors the RunAsUser, RunAsGroup, and SupplementalGroups setting from the Kubernetes pod's security context.
  - The podman play kube command now supports volumes with the BlockDevice and CharDevice types (#13951).
  - The podman play kube command now features a new flag, --userns, to set the user namespace of created pods. Two values are allowed at present: host and auto (#7504).
  - The podman play kube command now supports setting the type of created init containers via the io.podman.annotations.init.container.type annotation.
  - Pods now have include an exit policy (configurable via the --exit-policy option to podman pod create), which determines what will happen to the pod's infra container when the entire pod stops. The default, continue, acts as Podman currently does, while a new option, stop, stops the infra container after the last container in the pod stops, and is used by default for pods from podman play kube (#13464).
  - The podman pod create command now allows the pod's name to be specified as an argument, instead of using the --name option - for example, podman pod create mypod instead of the prior podman pod create --name mypod. Please note that the --name option is not deprecated and will continue to work.
  - The podman pod create command's --share option now supports adding namespaces to the set by prefacing them with + (as opposed to specifying all namespaces that should be shared) (#13422).
  - The podman pod create command has a new option, --shm-size, to specify the size of the /dev/shm mount that will be shared if the pod shares its UTS namespace (#14609).
  - The podman pod create command has a new option, --uts, to configure the UTS namespace that will be shared by containers in the pod.
  - The podman pod create command now supports setting pod-level resource limits via the --cpus, --cpuset-cpus, and --memory options. These will set a limit for all containers in the pod, while individual containers within the pod are allowed to set further limits. Look forward to more options for resource limits in our next release!
  - The podman create and podman run commands now include the -c short option for the --cpu-shares option.
  - The podman create and podman run commands can now create containers from a manifest list (and not an image) as long as the --platform option is specified (#14773).
  - The podman build command now supports a new option, --cpp-flag, to specify options for the C preprocessor when using Containerfile.in files that require preprocessing.
  - The podman build command now supports a new option, --build-context, allowing the user to specify an additional build context.
  - The podman machine inspect command now prints the location of the VM's Podman API socket on the host (#14231).
  - The podman machine init command on Windows now fetches an image with packages pre-installed (#14698).
  - Unused, cached Podman machine VM images are now cleaned up automatically. Note that because Podman now caches in a different directory, this will not clean up old images pulled before this change (#14697).
  - The default for the --image-volume option to podman run and podman create can now have its default set through the image_volume_mode setting in containers.conf (#14230).
  - Overlay volumes now support two new options, workdir and upperdir, to allow multiple overlay volumes from different containers to reuse the same workdir or upperdir (#14427).
  - The podman volume create command now supports two new options, copy and nocopy, to control whether contents from the overmounted folder in a container will be copied into the newly-created named volume (copy-up).
  - Volumes created using a volume plugin can now specify a timeout for all operations that contact the volume plugin (replacing the standard 5 second timeout) via the --opt o=timeout= option to podman volume create (BZ 2080458).
  - The podman volume ls command's --filter name= option now supports regular expression matching for volume names (#14583).
  - When used with a podman machine VM, volumes now support specification of the 9p security model using the security_model option to podman create -v and podman run -v.
  - The remote Podman client's podman push command now supports the --remove-signatures option (#14558).
  - The remote Podman client now supports the podman image scp command.
  - The podman image scp command now supports tagging the transferred image with a new name.
  - The podman network ls command supports a new filter, --filter dangling=, to list networks not presently used by any containers (#14595).
  - The --condition option to podman wait can now be specified multiple times to wait on any one of multiple conditions.
  - The podman events command now includes the -f short option for the --filter option.
  - The podman pull command now includes the -a short option for the --all-tags option.
  - The podman stop command now includes a new flag, --filter, to filter which containers will be stopped (e.g. podman stop --all --filter label=COM.MY.APP).
  - The Podman global option --url now has two aliases: -H and --host.
  - The podman network create command now supports a new option with the default bridge driver, --opt isolate=, which isolates the network by blocking any traffic from it to any other network with the isolate option enabled. This option is enabled by default for networks created using the Docker-compatible API.
  - Added the ability to create sigstore signatures in podman push and podman manifest push.
  - Added an option to read image signing passphrase from a file.
  * Changes
  - Paused containers can now be killed with the podman kill command.
  - The podman system prune command now removes unused networks.
  - The --userns=keep-id and --userns=nomap options to the podman run and podman create commands are no longer allowed (instead of simply being ignored) with root Podman.
  - If the /run directory for a container is part of a volume, Podman will not create the /run/.containerenv file (#14577).
  - The podman machine stop command on macOS now waits for the machine to be completely stopped to exit (#14148).
  - All podman machine commands now only support being run as rootless, given that VMs only functioned when run rootless.
  - The podman unpause --all command will now only attempt to unpause containers that are paused, not all containers.
  - Init containers created with podman play kube now default to the once type (#14877).
  - Pods created with no shared namespaces will no longer create an infra container unless one is explicitly requested (#15048).
  - The podman create, podman run, and podman cp commands can now autocomplete paths in the image or container via the shell completion.
  - The libpod/common package has been removed as it's not used anywhere.
  - The --userns option to podman create and podman run is no longer accepted when an explicit UID or GID mapping is specified (#15233).
  * Bugfixes
  - Fixed a bug where bind-mounting /dev into a container which used the --init flag would cause the container to fail to start (#14251).
  - Fixed a bug where the podman image mount command would not pretty-print its output when multiple images were mounted.
  - Fixed a bug where the podman volume import command would print an unrelated error when attempting to import into a nonexistent volume (#14411).
  - Fixed a bug where the podman system reset command could race against other Podman commands (#9075).
  - Fixed a bug where privileged containers were not able to restart if the layout of host devices changed (#13899).
  - Fixed a bug where the podman cp command would overwrite directories with non-directories and vice versa. A new --overwrite flag to podman cp allows for retaining the old behavior if needed (#14420).
  - Fixed a bug where the podman machine ssh command would not preserve the exit code from the command run via ssh (#14401).
  - Fixed a bug where VMs created by podman machine would fail to start when created with more than 3072MB of RAM on Macs with M1 CPUs (#14303).
  - Fixed a bug where the podman machine init command would fail when run from C:\Windows\System32 on Windows systems (#14416).
  - Fixed a bug where the podman machine init --now did not respect proxy environment variables (#14640).
  - Fixed a bug where the podman machine init command would fail if there is no $HOME/.ssh dir (#14572).
  - Fixed a bug where the podman machine init command would add a connection even if creating the VM failed (#15154).
  - Fixed a bug where interrupting the podman machine start command could render the VM unable to start.
  - Fixed a bug where the podman machine list --format command would still print a heading.
  - Fixed a bug where the podman machine list command did not properly set the Starting field (#14738).
  - Fixed a bug where the podman machine start command could fail to start QEMU VMs when the machine name started with a number.
  - Fixed a bug where Podman Machine VMs with proxy variables could not be started more than once (#14636 and #14837).
  - Fixed a bug where containers created using the Podman API would, when the Podman API service was managed by systemd, be killed when the API service was stopped (BZ 2052697).
  - Fixed a bug where the podman -h command did not show help output.
  - Fixed a bug where the podman wait command (and the associated REST API endpoint) could return before a container had fully exited, breaking some tools like the Gitlab Runner.
  - Fixed a bug where healthchecks generated exec events, instead of health_status events (#13493).
  - Fixed a bug where the podman pod ps command could return an error when run at the same time as podman pod rm (#14736).
  - Fixed a bug where the podman systemd df command incorrectly calculated reclaimable storage for volumes (#13516).
  - Fixed a bug where an exported container checkpoint using a non-default OCI runtime could not be restored.
  - Fixed a bug where Podman, when used with a recent runc version, could not remove paused containers.
  - Fixed a bug where the remote Podman client's podman manifest rm command would remove images, not manifests (#14763).
  - Fixed a bug where Podman did not correctly parse wildcards for device major number in the podman run and podman create commands' --device-cgroup-rule option.
  - Fixed a bug where the podman play kube command on 32 bit systems where the total memory was calculated incorrectly (#14819).
  - Fixed a bug where the podman generate kube command could set ports and hostname incorrectly in generated YAML (#13030).
  - Fixed a bug where the podman system df --format "{{ json . }}" command would not output the Size and Reclaimable fields (#14769).
  - Fixed a bug where the remote Podman client's podman pull command would display duplicate progress output.
  - Fixed a bug where the podman system service command could leak memory when a client unexpectedly closed a connection when reading events or logs (#14879).
  - Fixed a bug where Podman containers could fail to run if the image did not contain an /etc/passwd file (#14966).
  - Fixed a bug where the remote Podman client's podman push command did not display progress information (#14971).
  - Fixed a bug where a lock ordering issue could cause podman pod rm to deadlock if it was run at the same time as a command that attempted to lock multiple containers at once (#14929).
  - Fixed a bug where the podman rm --force command would exit with a non-0 code if the container in question did not exist (#14612).
  - Fixed a bug where the podman container restore command would fail when attempting to restore a checkpoint for a container with the same name as an image (#15055).
  - Fixed a bug where the podman manifest push --rm command could remove image, instead of manifest lists (#15033).
  - Fixed a bug where the podman run --rm command could fail to remove the container if it failed to start (#15049).
  - Fixed a bug where the podman generate systemd --new command would create incorrect unit files when the container was created with the --sdnotify parameter (#15052).
  - Fixed a bug where the podman generate systemd --new command would fail when -h &lt;hostname&gt; was used to create the container (#15124).
  * API
  - The Docker-compatible API now supports API version v1.41 (#14204).
  - Fixed a bug where containers created via the Libpod API had an incorrect umask set (#15036).
  - Fixed a bug where the remote parameter to the Libpod API's Build endpoint for Images was nonfunctional (#13831).
  - Fixed a bug where the Libpod List endpoint for Containers did not return the application/json content type header when there were no containers present (#14647).
  - Fixed a bug where the Compat Stats endpoint for Containers could return incorrect memory limits (#14676).
  - Fixed a bug where the Compat List and Inspect endpoints for Containers could return incorrect strings for container status.
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle disabling healthchecks (#14493).
  - Fixed a bug where the Compat Create endpoint for Networks did not support the mtu, name, mode, and parent options (#14482).
  - Fixed a bug where the Compat Create endpoint for Networks did not allow the creation of networks name bridge (#14983).
  - Fixed a bug where the Compat Inspect endpoint for Networks did not properly set netmasks in the SecondaryIPAddresses and SecondaryIPv6Addresses fields (#14674).
  - The Libpod Stats endpoint for Pods now supports streaming output via two new parameters, stream and delay (#14674).
  * Misc
  - Podman will now check for nameservers in /run/NetworkManager/no-stub-resolv.conf if the /etc/resolv.conf file only contains a localhost server.
  - The podman build command now supports caching with builds that specify --squash-all by allowing the --layers flag to be used at the same time.
  - Podman Machine support for QEMU installations at non-default paths has been improved.
  - The podman machine ssh command no longer prints spurious warnings every time it is run.
  - When accessing the WSL prompt on Windows, the rootless user will be preferred.
  - The podman info command now includes a field for information on supported authentication plugins for improved Docker compatibility. Authentication plugins are not presently supported by Podman, so this field is always empty.
  - The podman system prune command now no longer prints the Deleted Images header if no images were pruned.
  - The podman system service command now automatically creates and moves to a sub-cgroup when running in the root cgroup (#14573).
  - Updated Buildah to v1.27.0 (fixes CVE-2022-21698 / bsc#1196338)
  - Updated the containers/image library to v5.22.0
  - Updated the containers/storage library to v1.42.0 (fixes bsc#1196751)
  - Updated the containers/common library to v0.49.1
  - Podman will automatically create a sub-cgroup and move itself into it when it detects that it is running inside a container (#14884).
  - Fixed an incorrect release note about regexp.
  - A new MacOS installer (via pkginstaller) is now supported.</changelog>
  <changelog author="asarai@suse.com" date="1663761600">- Update to version 4.2.1:
  * Bump to v4.2.1
  * Add release notes for v4.2.1
  * remove SkipIfNotFedora() from events test
  * fix podman events with custom format
  * Drop stale config value resulting in asymmetric config
  * Fix list of default capabilities
  * Add container GID to additional groups (CVE-2022-2989 / bsc#1202809, removes patch 0001-Add-container-GID-to-additional-groups.patch)
  * libpod: Ensure that generated container names are random
  * Fix bind-mount-option annotation in gen/play kube
  * Improved Windows compatibility for machine command
  * updated apiv2 tests to reflect hash compat fix
  * api: return imageID instead of imageName, for "Image" when Podman API is queried
  * Inhibit SIGTERM during Conmon startup
  * Fix example sections to follow the same format
  * Fix template name inconsistency
  * service: make move to sub-cgroup non fatal
  * Remove duplicate annotations in generated service yaml
  * Compat API image remove events now have 'delete' status
  * [CI:DOCS] Automatically set podman version in pkginstaller
  * Allow colons in windows file paths
  * Fixes isRootfull check using qemu machine on Windows
  * vendor containers/psgo@v1.7.3
  * Allow podman to run in an environment with keys containing spaces
  * Document restrictions on transport in FROM
  * Improved Windows compatibility
  * pass environment variables to container clone
  * podman save: update --compress validation
  * sort hc.Binds returned from compat api
  * Cirrus: Update podman-machine comment
  * podman images and friends can take one image as argument
  * [CI:DOCS] Add .DS_Store to gitignore
  * podman-kube@.service.in: Remove Restart=never option with typo
  * Fix #15499 already connected network
  * [CI:DOCS] Cirrus: Update meta-task for EC2 image
  * fix CI: remove hardcodeded alpine version
  * fix CI: remove hardcodeded alpine version
  * Preserve all unknown PolicyRequirement fields on (podman image trust set)
  * Reorganize the types in policy.go a bit
  * Add support for showing keyPaths in (podman image trust show)
  * Support (image trust show) for sigstoreSigned entries
  * BREAKING CHANGE: Change how (podman image trust show) represents multiple requirements
  * Reorganize descriptionsOfPolicyRequirements a bit
  * Use the full descriptionsOfPolicyRequirements for the default scope
  * Rename haveMatchRegistry to registriesDConfigurationForScope
  * Rename tempTrustShowOutput to entry
  * Split descriptionsOfPolicyRequirements out of getPolicyShowOutput
  * Recognize the new lookaside names for simple signing sigstore
  * Add a unit test for trust.PolicyDescription
  * Make the output of (podman image trust show) deterministic
  * Make most of pkg/trust package-private
  * Move most of ImageEngine.ShowTrust into pkg/trust.PolicyDescription
  * Add support for sigstoreSigned in (podman image trust set)
  * Create new policy entries together with validating input
  * Improve validation of data in ImageEngine.SetTrust
  * Move most of imageEngine.SetTrust to pkg/trust.AddPolicyEntries
  * Add a variable for scope
  * Make trust.CreateTempFile private
  * Reorganize pkg/trust
  * Remove an unused trust.ShowOutput type
  * Remove commented out code
  * libpod: UpdateContainerStatus: do not wait for container
  * Skip / update some tests under runc
  * Bump to v4.2.1-dev
  * test: update apply-podman-deltas for new tests
  * build: implement --cache-to,--cache-from and --cache-ttl
  * vendor: bump buildah to v1.27.0</changelog>
  <changelog author="dcermak@suse.com" date="1669118400">- switch to building with go 1.17
- use %%make_* macros
- drop /usr/share/user-tmpfiles.d/podman-docker.conf on SLE &amp; Leap
- remove rpmlintrc (contained only obsolete filters)
- remove obsolete with_libostree (we don't build on anything older than SLE 15)
- add patch: 0001-Revert-Default-missing-hostPort-to-containerPort-is-.patch
  (hotfix for https://github.com/containers/podman/issues/16765)
- Update to version 4.3.1:
  4.3.1:
  [#]## Bugfixes
- Fixed a deadlock between the `podman ps` and `podman container inspect` commands
  [#]## Misc
- Updated the containers/image library to v5.23.1
  4.3.0:
  [#]## Features
- A new command, `podman generate spec`, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
- A new command, `podman update`, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted ([#15067](https://github.com/containers/podman/issues/15067)).
- A new command, `podman kube down`, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to `podman kube play --down`, but it now has its own command).
- The `podman kube play` command now supports Kubernetes secrets using Podman's secrets backend.
- Systemd-managed pods created by the `podman kube play` command now integrate with sd-notify, using the `io.containers.sdnotify` annotation (or `io.containers.sdnotify/$name` for specific containers).
- Systemd-managed pods created by `podman kube play` can now be auto-updated, using the `io.containers.auto-update` annotation (or `io.containers.auto-update/$name` for specific containers).
- The `podman kube play` command can now read YAML from URLs, e.g. `podman kube play https://example.com/demo.yml` ([#14955](https://github.com/containers/podman/issues/14955)).
- The `podman kube play` command now supports the `emptyDir` volume type ([#13309](https://github.com/containers/podman/issues/13309)).
- The `podman kube play` command now supports the `HostUsers` field in the pod spec.
- The `podman play kube` command now supports `binaryData` in ConfigMaps.
- The `podman pod create` command can now set additional resource limits for pods using the new `--memory-swap`, `--cpuset-mems`, `--device-read-bps`, `--device-write-bps`, `--blkio-weight`, `--blkio-weight-device`, and `--cpu-shares` options.
- The `podman machine init` command now supports a new option, `--username`, to set the username that will be used to connect to the VM as a non-root user ([#15402](https://github.com/containers/podman/issues/15402)).
- The `podman volume create` command's `-o timeout=` option can now set a timeout of 0, indicating volume plugin operations will never time out.
- Added support for a new volume driver, `image`, which allows volumes to be created that are backed by images.
- The `podman run` and `podman create` commands support a new option, `--env-merge`, allowing environment variables to be specified relative to other environment variables in the image (e.g. `podman run --env-merge "PATH=$PATH:/my/app" ...`) ([#15288](https://github.com/containers/podman/issues/15288)).
- The `podman run` and `podman create` commands support a new option, `--on-failure`, to allow action to be taken when a container fails health checks, with the following supported actions: `none` (take no action, the default), `kill` (kill the container), `restart` (restart the container), and `stop` (stop the container).
- The `--keep-id` option to `podman create` and `podman run` now supports new options, `uid` and `gid`, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. `--userns=keep-id:uid=11` will made the user running Podman to UID 11 in the container) ([#15294](https://github.com/containers/podman/issues/15294)).
- The `podman generate systemd` command now supports a new option, `--env`/`-e`, to set environment variables in the generated unit file ([#15523](https://github.com/containers/podman/issues/15523)).
- The `podman pause` and `podman unpause` commands now support the `--latest`, `--cidfile`, and `--filter` options.
- The `podman restart` command now supports the `--cidfile` and `--filter` options.
- The `podman rm` command now supports the `--filter` option to select which containers will be removed.
- The `podman rmi` command now supports a new option, `--no-prune`, to prevent the removal of dangling parents of removed images.
- The `--dns-opt` option to `podman create`, `podman run`, and `podman pod create` has received a new alias, `--dns-option`, to improve Docker compatibility.
- The `podman` command now features a new global flag, `--debug`/`-D`, which enables debug-level logging (identical to `--log-level=debug`), improving Docker compatibility.
- The `podman` command now features a new global flag, `--config`. This flag is ignored, and is only included for Docker compatibility ([#14767](https://github.com/containers/podman/issues/14767)).
- The `podman manifest create` command now accepts a new option, `--amend`/`-a`.
- The `podman manifest create`, `podman manifest add` and `podman manifest push` commands now accept a new option, `--insecure` (identical to `--tls-verify=false`), improving Docker compatibility.
- The `podman secret create` command's `--driver` and `--format` options now have new aliases, `-d` for `--driver` and `-f` for `--format`.
- The `podman secret create` command now supports a new option, `--label`/`-l`, to add labels to created secrets.
- The `podman secret ls` command now accepts the `--quiet`/`-q` option.
- The `podman secret inspect` command now accepts a new option, `--pretty`, to print output in human-readable format.
- The `podman stats` command now accepts the `--no-trunc` option.
- The `podman save` command now accepts the `--signature-policy` option ([#15869](https://github.com/containers/podman/issues/15869)).
- The `podman pod inspect` command now allows multiple arguments to be passed. If so, it will return a JSON array of the inspected pods ([#15674](https://github.com/containers/podman/issues/15674)).
- A series of new hidden commands have been added under `podman context` as aliases to existing `podman system connection` commands, to improve Docker compatibility.
- The remote Podman client now supports proxying signals for attach sessions when the `--sig-proxy` option is set ([#14707](https://github.com/containers/podman/issues/14707)).
  [#]## Changes
- Duplicate volume mounts are now allowed with the `-v` option to `podman run`, `podman create`, and `podman pod create`, so long as source, destination, and options all match ([#4217](https://github.com/containers/podman/issues/4217)).
- The `podman generate kube` and `podman play kube` commands have been renamed to `podman kube generate` and `podman kube play` to group Kubernetes-related commands. Aliases have been added to ensure the old command names still function.
- A number of Podman commands (`podman init`, `podman container checkpoint`, `podman container restore`, `podman container cleanup`) now print the user-inputted name of the container, instead of its full ID, on success.
- When an unsupported option (e.g. resource limit) is specified for a rootless container on a cgroups v1 system, a warning message is now printed that the limit will not be honored.
- The installer for the Windows Podman client has been improved.
- The `--cpu-rt-period` and `--cpu-rt-runtime` options to `podman run` and `podman create` now print a warning and are ignored on cgroups v2 systems (cgroups v2 having dropped support for these controllers) ([#15666](https://github.com/containers/podman/issues/15666)).
- Privileged containers running systemd will no longer mount `/dev/tty*` devices other than `/dev/tty` itself into the container ([#15878](https://github.com/containers/podman/issues/15878)).
- Events for containers that are part of a pod now include the ID of the pod in the event.
- SSH functionality for `podman machine` commands has seen a thorough rework, addressing many issues about authentication.
- The `--network` option to `podman kube play` now allows passing `host` to set the pod to use host networking, even if the YAML does not request this.
- The `podman inspect` command on containers now includes the digest of the image used to create the container.
- Pods created by `podman play kube` are now, by default, placed into a network named `podman-kube`. If the `podman-kube` network does not exist, it will be created. This ensures pods can connect to each other by their names, as the network has DNS enabled.
  [#]## Bugfixes
- Fixed a bug where the `podman network prune` and `podman container prune` commands did not properly support the `--filter label!=` option ([#14182](https://github.com/containers/podman/issues/14182)).
- Fixed a bug where the `podman kube generate` command added an unnecessary `Secret: null` line to generated YAML ([#15156](https://github.com/containers/podman/issues/15156)).
- Fixed a bug where the `podman kube generate` command did not set `enableServiceLinks` and `automountServiceAccountToken` to false in generated YAML ([#15478](https://github.com/containers/podman/issues/15478) and [#15243](https://github.com/containers/podman/issues/15243)).
- Fixed a bug where the `podman kube play` command did not properly handle CPU limits ([#15726](https://github.com/containers/podman/issues/15726)).
- Fixed a bug where the `podman kube play` command did not respect default values for liveness probes ([#15855](https://github.com/containers/podman/issues/15855)).
- Fixed a bug where the `podman kube play` command did not bind ports if `hostPort` was not specified but `containerPort` was ([#15942](https://github.com/containers/podman/issues/15942)).
- Fixed a bug where the `podman kube play` command sometimes did not create directories on the host for `hostPath` volumes.
- Fixed a bug where the remote Podman client's `podman manifest push` command did not display progress.
- Fixed a bug where the `--filter "{{.Config.Healthcheck}}"` option to `podman image inspect` did not print the image's configured healthcheck ([#14661](https://github.com/containers/podman/issues/14661)).
- Fixed a bug where the `podman volume create -o timeout=` option could be specified even when no volume plugin was in use.
- Fixed a bug where the `podman rmi` command did not emit `untag` events when removing tagged images ([#15485](https://github.com/containers/podman/issues/15485)).
- Fixed a bug where API forwarding with `podman machine` VMs on windows could sometimes fail because the pipe was not created in time ([#14811](https://github.com/containers/podman/issues/14811)).
- Fixed a bug where the `podman pod rm` command could error if removal of a container in the pod was interrupted by a reboot.
- Fixed a bug where the `exited` and `exec died` events for containers did not include the container's labels ([#15617](https://github.com/containers/podman/issues/15617)).
- Fixed a bug where running Systemd containers on a system not using Systemd as PID 1 could fail ([#15647](https://github.com/containers/podman/issues/15647)).
- Fixed a bug where Podman did not pass all necessary environment variables (including `$PATH`) to Conmon when starting containers ([#15707](https://github.com/containers/podman/issues/15707)).
- Fixed a bug where the `podman events` command could function improperly when no events were present ([#15688](https://github.com/containers/podman/issues/15688)).
- Fixed a bug where the `--format` flag to various Podman commands did not properly handle template strings including a newline (`\n`) ([#13446](https://github.com/containers/podman/issues/13446)).
- Fixed a bug where Systemd-managed pods would kill every container in a pod when a single container exited ([#14546](https://github.com/containers/podman/issues/14546)).
- Fixed a bug where the `podman generate systemd` command would generate incorrect YAML for pods created without the `--name` option.
- Fixed a bug where the `podman generate systemd --new` command did not properly set stop timeout ([#16149](https://github.com/containers/podman/issues/16149)).
- Fixed a bug where a broken OCI spec resulting from the system rebooting while a container is being started could cause the `podman inspect` command to be unable to inspect the container until it was restarted.
- Fixed a bug where creating a container with a working directory on an overlay volume would result in the container being unable to start ([#15789](https://github.com/containers/podman/issues/15789)).
- Fixed a bug where attempting to remove a pod with running containers without `--force` would not error and instead would result in the pod, and its remaining containers, being placed in an unusable state ([#15526](https://github.com/containers/podman/issues/15526)).
- Fixed a bug where memory limits reported by `podman stats` could exceed the maximum memory available on the system ([#15765](https://github.com/containers/podman/issues/15765)).
- Fixed a bug where the `podman container clone` command did not properly handle environment variables whose value contained an `=` character ([#15836](https://github.com/containers/podman/issues/15836)).
- Fixed a bug where the remote Podman client would not print the container ID when running the `podman-remote run --attach stdin` command.
- Fixed a bug where the `podman machine list --format json` command did not properly show machine starting status.
- Fixed a bug where automatic updates would not error when attempting to update a container with a non-fully qualified image name ([#15879](https://github.com/containers/podman/issues/15879)).
- Fixed a bug where the `podman pod logs --latest` command could panic ([#15556](https://github.com/containers/podman/issues/15556)).
- Fixed a bug where Podman could leave lingering network namespace mounts on the system if cleaning up the network failed.
- Fixed a bug where specifying an unsupported URI scheme for `podman system service` to listen at would result in a panic.
- Fixed a bug where the `podman kill` command would sometimes not transition containers to the exited state ([#16142](https://github.com/containers/podman/issues/16142)).
  [#]## API
- Fixed a bug where the Compat DF endpoint reported incorrect reference counts for volumes ([#15720](https://github.com/containers/podman/issues/15720)).
- Fixed a bug in the Compat Inspect endpoint for Networks where an incorrect network option was displayed, causing issues with `docker-compose` ([#15580](https://github.com/containers/podman/issues/15580)).
- The Libpod Restore endpoint for Containers now features a new query parameter, `pod`, to set the pod that the container will be restored into ([#15018](https://github.com/containers/podman/issues/15018)).
- Fixed a bug where the REST API could panic while retrieving images.
- Fixed a bug where a cancelled connection to several endpoints could induce a memory leak.
  [#]## Misc
- Error messages when attempting to remove an image used by a non-Podman container have been improved ([#15006](https://github.com/containers/podman/issues/15006)).
- Podman will no longer print a warning that `/` is not a shared mount when run inside a container ([#15295](https://github.com/containers/podman/issues/15295)).
- Work is ongoing to port Podman to FreeBSD.
- The output of `podman generate systemd` has been adjusted to improve readability.
- A number of performance improvements have been made to `podman create` and `podman run`.
- A major reworking of the manpages to ensure duplicated options between commands have the same description text has been performed.
- Updated Buildah to v1.28.0
- Updated the containers/image library to v5.23.0
- Updated the containers/storage library to v1.43.0
- Updated the containers/common library to v0.50.1</changelog>
</package>
<package pkgid="f22427bee12ff15ec74145e119ded8842c22df4310773179b74726ebc67e2a17" name="podman" arch="x86_64">
  <version epoch="0" ver="4.3.1" rel="150400.4.11.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024 / bsc#1193166, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190 / bsc#1193273, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="rbrown@suse.com" date="1647432000">- Update to version 4.0.2:
  * Bump to v4.0.2
  * Update release notes for v4.0.2
  * Revert "use GetRuntimeDir() from c/common"
  * Revert "Option --url and --connection should imply --remote."
  * Option --url and --connection should imply --remote.
  * Bump to v4.0.2-dev
  * Bump to v4.0.1
  * Update release notes for v4.0.1
  * Fix a potential flake in volume plugins tests
  * Propagate $CONTAINERS_CONF to conmon
  * tests: Remove inaccurate comment
  * System tests: show one-line config overview
  * provide better error on invalid flag
  * use GetRuntimeDir() from c/common
  * kube: honor --build=false and make --build=true by default
  * system tests: cleanup networks on teardown
  * Remove the runtime lock
  * Don't log errors on removing volumes inuse, if container --volumes-from
  * kube: honor mount propagation mode
  * Load ip_tables modules at boot
  * Cirrus: Disable F34 aka prior-fedora testing
  * Cirrus: Update VM Images for 4.0 release
  * Bump to v4.0.1-dev
  * Bump to v4.0.0
  * Release notes for v4.0.0 final
  * Fix lint
  * Fix manifest 4.0 Endpoints Branch forced 4.0 only endpoints
  * Introduce podman machine init --root=t|f and podman machine set --root=t|f
  * Initial implementation of mac forwarding using a privileged docker sock claim helper
  * ignition: propagate proxy settings from a host into a vm
  * Update to podman4 copr stream
  * Unify ls --filter docs for networks and pods
  * e2e: merge after/since image-filter tests
  * podman network: add documentation for netavark
  * create: Fix key=value annotation in the flag output
  * enable netavark specific tests
  * Fix checkpoint/restore pod tests
  * Make sure building with relative paths work correctly.
  * Add 409 response to swagger godoc
  * Fix images since/after tests
  * Changes of docker descriptions
  * Temporarily pull machine images from side repo
  * Cirrus: TODO: netavark/aardvark release branches
  * Cirrus: Expand netavark testing to include rootless
  * Cirrus: Minor - limit release task applicability
  * Cirrus: Add [CI:BUILD] magic that only builds
  * CI: fix nightly builds
  * Cirrus: Log netavark/aardvark binary build info.
  * Cirrus: Add netavark/aardvark system test task
  * Cirrus: Also download aardvark-dns binary
  * Cirrus: Add e2e task w/ upstream netavark
  * Revert minimum API change
  * netavark e2e tests
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC5
  * Update release notes for v4.0.0-RC5
  * Modify /etc/resolv.conf when connecting/disconnecting
  * Do not set the network config dir to cni plugin dir
  * Show API doc for several versions
  * [NO NEW TEST NEEDED] Add schema for ImageCreate 200 response.
  * fix: Multiplication of durations
  * move rootless netns slirp4netns process to systemd user.slice
  * compat: endpoint /build must set header content type as application/json in reponse
  * Cleanup: remove obsolete/misleading bug workaround
  * tests: retrofit healthcheck system tests
  * healthcheck, libpod: Read healthcheck event output from os pipe
  * Fix: Do not print error when parsing journald log fails
  * Bump github.com/buger/goterm from 1.0.1 to 1.0.4
  * append podman dns search domain
  * Podman pod create --share-parent vs --share=cgroup
  * System tests: revert emergency skip of checkpoint tests
  * Add version guard to libpod API endpoints
  * [v4.0] Bump c/common to v0.47.4
  * idmap should be able to be specified along with other options
  * Vendor in containers/buildah v1.24.1
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC4
  * Disable failing E2E test
  * Revert "Move each search dns to its own line"
  * Move each search dns to its own line
  * Update release notes for v4.0.0-RC4
  * Document `schema` values in the `--url` flag
  * podman image scp syntax correction
  * system prune: remove all networks
  * Only change network fields if they were actually changed by the user
  * docs: clarify rootless net stats
  * Fix size to match Docker selection
  * libpod: enforce noexec,nosuid,nodev for /dev/shm
  * Clarify remote client means Mac and Windows
  * libpod: report slirp4netns network stats
  * Add notes to "--oom-kill-disable" not supported on cgroups V2
  * Fix use of infra image to clarify default
  * Adapt podman images ls filters docs to be aligned with prune filters docs
  * ignition, machine: delegate cpu,io cgroup controllers to machine's default users
  * pkg/bindings/images.Build(): slashify "dockerfile" values, too
  * Remove mention of IPv6 portfwd from release notes
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC3
  * Update release notes for v4.0.0-RC3
  * Fix Cirrus destination branch
  * volume: add support for non-volatile upperdir,workdir for overlay volumes
  * github: label issues based on os fix regex
  * github: label issues based on os
  * Cirrus: Fix get_ci_vm.sh initial setup
  * System tests: emergency skip of checkpoint tests
  * network create: allow multiple subnets
  * Update troubleshooting.md
  * Fix sort ordering of filters
  * Unify podman prune filter description: volumes, networks, system
  * Bump Buildah to v1.24.0
  * rootless: drop permission check for devices
  * switch podman image scp from depending on machinectl to just os/exec
  * Bump github.com/containers/image/v5 from 5.18.0 to 5.19.0
  * Bump github.com/containers/storage from 1.38.0 to 1.38.1
  * change location of where make outputs podman binary on osx
  * Github workflow: Fix parsing of GraphQL response JSON
  * Github-workflow: Fix YAML syntax
  * Update godoc, swagger using wrong struct
  * Makefile: install targets independent of build
  * [CI:DOCS] Fix typos and improve language
  * CI: enable rootless-remote system tests
  * pkg/specgen/generate/security: fix error message
  * Github workflow: Send e-mail on job error
  * Github workflow: Update Cirrus-cron GraphQL query
  * remote build: set rootless oci isolation correctly
  * [CI:DOCS] Fix typos and improve language
  * Fix handling of duplicate matches on id expansion
  * Show correct default values or show none
  * exec: retry rm -rf on ENOTEMPTY and EBUSY
  * container create: do not check for network dns support
  * libpod: fix leaking fd
  * libpod: fix connection leak
  * [CI:DOCS] fix typo subpordinate
  * Fix filter description and unify filters docs for containers/images prune
  * Remove unused param and clean API handlers
  * Restore machine start logic that was hanging
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC2
  * Final release notes for v4.0.0-rc2
  * Run codespell on code
  * Update release notes for Podman v4.0.0
  * Fix #2 for compat commit handling of --changes
  * Fix nil pointer dereference for configmap optional
  * Make error message matching in 030-run.bats less fragile
  * Don't explicitly check for crun|runc in package information
  * Don't segfault if an image layer has no creation timestamp
  * compat: remove hardcoded index from load images output report
  * compat: images/load must be able to load tar with multiple images
  * System tests: fix for new systemd on rawhide
  * Remove rootless_networking option from containers.conf
  * vendor c/psgo@v1.7.2 (fixes CVE-2022-1227 / bsc#1182428)
  * Engine.Remote from containers.conf
  * vendor: bump c/common and other vendors
  * rootless: report correctly the error
  * Implement API forwarding for podman machine on Windows
  * Implement env parsing on Windows
  * Handle changes in docker compat mode
  * Show package version when running on alpine
  * Handlers for `generate systemd` with custom dependencies
  * APIv2 tests: followup to recent log test
  * Add IndexConfigs to compat /info endpoint
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * apiv2 test: add regression test for #12904
  * SECURITY.md: fix the project name
  * rename --cni-config-dir to --network-config-dir
  * compat attach: fix write on closed channel
  * upgrade all dependencies
  * Revert "Cirrus: Temporarily disable OSX Cross task"
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * bump go module to version 4
  * [NO NEW TESTS NEEDED] add builddeps to copr template
  * CI: rootless user: also create in some root tests
  * [WIP] Tests for podman image scp (the sudo form)
  * Revamp Libpod state strings for Docker compat
  * Cirrus: Temporarily disable OSX Cross task
  * update c/common to latest
  * Use PODMAN_USERNS environment variable when running as a service
  * Unify the method of parsing filters in cmd
  * fix default branch links
  * [CI:DOCS] fix default branch links
  * [CI:DOCS] Unprivileged native overlayfs is now supported
  * [CI:DOCS] Fix typo in --env
  * Recursively copy cert files.
  * Refactor manifest list operations
  * Add rpkg template for COPR autobuild
  * Fix cgroup mode handling in api server
  * Standardize on capatalized Cgroups
  * test/system: podman run update /etc/hosts
  * Remove two GetImages functions from API
  * Use fully-qualified device name in CDI test
  * Use new CDI API
  * troubleshooting links to main branch
  * Podman Build use absolute filepath
  * Prohibit --uid/gid map and --pod for container create/run
  * podman container rm: remove pod
  * Manual fixes for PR #12642:
  * podman build enable --all-platforms and --unsetenv
  * use events_logfile_path from containers.conf for events log.
  * Podman Pod Create --sysctl support
  * Wait for podman stop to complete
  * libpod: fix check for systemd session
  * libpod: refine check for empty pod cgroup
  * fix buildah-bud test diff
  * upgrade test: check that network backend is cni
  * use netns package from c/common
  * update buildah to latest and use new network stack
  * podman image scp: implement --quiet
  * use libnetwork from c/common
  * Add --noout option to prevent the output of ids
  * remote events: convert TimeNano properly
  * Bump github.com/BurntSushi/toml from 0.4.1 to 1.0.0
  * vendor latest c/common
  * add additional fields to podman machine ls --json
  * buildah bud tests: skip failing tests
  * Fix permission on secrets directory
  * Add podman rm --depend
  * fix host.containers.internal entry for macvlan networks
  * It takes some time to start a VM
  * Pretty Print output of podman machine ls --format json
  * Use the InfraImage defined in containers.conf
  * Cirrus: Freshen VM images
  * Revert "Cirrus: Temp. ignore gitlab task failures"
  * pkg: use PROXY_VARS from c/common
  * ignition: add support from setting SSL_CERT_FILE
  * ignition: propogate HTTP proxy variables from host to remote
  * System tests: fix RHEL8 gating tests
  * vendor c/common
  * Remove dead RuntimeOption functions
  * Update docker cli message for case where user creates directory
  * Don't add env if optional and not found
  * Fix type-o in podman.wxs
  * [CI:DOCS] fixes indentation of example pod yaml
  * Prevent double decoding of storage options
  * Emergency system-test fixes
  * add OCI Runtime name to errors
  * fix healthcheck timeouts and ut8 coercion
  * Don't rename pod if container has the same name
  * Set volume NeedsCopyUp to false iff data was copied up
  * Fix CI
  * correct typo words in docs
  * Change Tests to ignore missing containers when removing --all
  * test/e2e/pod_initcontainers: fix a flake
  * test/e2e/run: don't use date +%N on Alpine
  * Support all volume mounts for rootless containers
  * Fix wrong 'podman search --format' placeholder
  * Fix Container List API call to return mount info
  * fix misleading comment regarding default value of cpu period [NO NEW TESTS NEEDED]
  * add --ip6 flag to podman create/run
  * legacy events: also set exitCode
  * Don't initialize the global RNG with GinkgoRandomSeed() in e2e tests
  * Avoid collisions on RemoteSocket paths
  * Refactor remote socket path determination in tests
  * fix doc
  * test/system: podman run image with filesystem permission
  * test/system: podman run with log-opt option
  * Update swagger documentation
  * Make it possible to select the volume driver
  * Check the mount type for future compatibility
  * Implement virtfs volumes for podman machine
  * [CI:DOCS] Add example of cpus to init command
  * prefix imageId with sha256: in containers list test for compat API ImageId
  * Pod Security Option support
  * ignition: add certs from current user into the machine while init
  * docs: sort swagger operations alpabetically
  * .service file removal on failure
  * Introduce Windows WSL implementation of podman machine
  * podman image scp never enter podman user NS
  * Allow users to add host user accounts to /etc/passwd
  * container creation: don't apply reserved annotations from image
  * [CI:DOCS] clarify `io.podman.annotations.seccomp`
  * Error out early if system does not support pre-copy checkpointing
  * Update go-criu to v5.3.0
  * [CI:DOCS] docs: document rootless userns mappings
  * Switch to a new installer approach using a path manipulation helper
  * e2e: Add dev/shm checkpoint/restore test
  * Enable checkpoint/restore for /dev/shm
  * Update github.com/checkpoint-restore/checkpointctl
  * Always run passwd management code when DB value is nil
  * Warn on use of --kernel-memory
  * support hosts without /etc/hosts
  * Podman run --passwd
  * ci: force scratch build for crun
  * Use hosts public ip address in rootless containers
  * compat: image normalization: handle sha256 prefix
  * specgen: honor userns=auto from containers.conf
  * [CI:DOCS] Small checkpoint/restore man page fixes
  * [CI:DOCS] Explicitly mention that checkpointing systemd containers might fail
  * vendor: update containers/storage
  * build: fix test for subid 4
  * test: add --rm to podman run commands
  * fix(generate): fix up podman generate kube missing env field bug
  * legacy events: also set Action="die"
  * rootless: include the args in the debug message
  * apiv2 tests: use quay.io/libpod/testimage:20210610 for platform tests
  * image rm: allow for force-remove infra images
  * tests: adjust old build test to expect exit code
  * Test for checkpoint specific inspect fields
  * Add more checkpoint/restore information to 'inspect'
  * build: relay exitcode from imagebuildah to registry
  * Removed .service file for healthchecks
  * Set machine timezone
  * MovePauseProcessToScope do not seed everytime
  * bindings rmi test: clarify behavior
  * bump cobra to 1.3.0
  * .github: revert to the old template
  * oci: configure the devices cgroup with default devices
  * kill: fix output
  * e2e: search flake: skip test on registry.redhat.io
  * APIv2 tests: fail on syntax/logic errors
  * Show --external containers even without --all option
  * apiv2 tests: refactor complicated curls
  * fix network id handling
  * Update Windows Install Doc
  * Fixes #12063 Add docker compatible output after image build.
  * pause scope: don't use the global math/rand RNG
  * specgen: check that networks are only set with bridge
  * container restore/import: store networks from db
  * play kube add support for multiple networks
  * support advanced network configuration via cli
  * Add new networks format to spegecen
  * fix incorrect swagger doc for network dis/connect
  * network connect allow ip, ipv6 and mac address
  * network db: add new strucutre to container create
  * remove unneeded return value from c.Networks()
  * network db rewrite: migrate existing settings
  * network ls: show networks in deterministic order
  * Bump github.com/docker/docker
  * pprof flakes: bump timeout to 20 seconds
  * Add secret list --filter to cli
  * Cirrus: Temp. ignore gitlab task failures
  * compat build: adhere to q/quiet
  * Make XRegistryAuthHeader and XRegistryConfigHeader private
  * Remove the authfile parameter of MakeXRegistryAuthHeader
  * Simplify the header decision in pkg/bindings/images.Build a bit
  * Remove the authfile parameter of MakeXRegistryConfigHeader
  * Remove no-longer-useful name variables
  * Consolidate creation of SystemContext with auth.json into a helper
  * Remove pkg/auth.Header
  * Call MakeXRegistryAuthHeader instead of Header(..., XRegistryAuthHeader)
  * Turn headerAuth into MakeXRegistryAuthHeader
  * Call MakeXRegistryConfigHeader instead of Header(..., XRegistryConfigHeader)
  * Turn headerConfig into MakeXRegistryConfigHeader
  * Move the auth file creation to GetCredentials
  * Consolidate the error handling path in GetCredentials
  * Only look up HTTP header values once in GetCredentials
  * Use Header.Values in GetCredentials.has
  * Beautify GetCredentials.has a bit
  * Pass a header value directly to parseSingleAuthHeader and parseMultiAuthHeader
  * Simplify parseSingleAuthHeader
  * Simplify the interface of parseSingleAuthHeader
  * Don't return a header name from auth.GetCredentials
  * Fix normalizeAuthFileKey to use the correct semantics
  * Rename normalize and a few variables
  * Add TestHeaderGetCredentialsRoundtrip
  * Add tests for auth.Header
  * Improve TestAuthConfigsToAuthFile
  * Add unit tests for singleAuthHeader
  * Add unit tests for multiAuthHeader
  * fix e2e test missing network cleanup
  * pprof CI flakes: enforce 5 seconds grace period
  * [NO NEW TESTS NEEDED] rootless: declare TEMP_FAILURE_RETRY before usage (Fixes: #12563)
  * --hostname should be set when using --pod new:foobar
  * Cirrus: Use cached swagger binary
  * inotify: make sure to remove files
  * System tests: remove rm_pause_image()
  * specgen: honor empty args for entrypoint
  * generate systemd: support entrypoint JSON strings
  * Bump github.com/uber/jaeger-client-go
  * remove runlabel test for global opts
  * utils: reintroduce moveToCgroup
  * autocopr: distro conditionals for containers-common
  * vendor c/image/v5@main
  * Update vendor or containers/common moving pkg/cgroups there
  * volume: apply exact permission of target directory without adding extra 0111
  * Cirrus: Remove remnants of nix-based static build
  * Refactor podman pods to report.Formatter
  * rootless netns: resolve all path components for resolv.conf
  * tests: clean up FIXMEs and noise
  * fix remote run/start flake
  * e2e: fix pprof flakes
  * Bump github.com/opencontainers/runc from 1.0.2 to 1.0.3
  * vendor c/common@main
  * Escape trailing slash in install directory location so the closing quote is not escaped
  * centos 9 stream cannot use %autochangelog
  * Refactor podman system to report.Formatter [NO NEW TESTS NEEDED]
  * add spec file for automated copr builds
  * Add restart-sec option to systemd generate
  * Fix documentation of (podman image save --compress --uncompressed)
  * Improve documentation of (podman image save --format)
  * Add support for configmap volumes to play kube
  * cmd, push: use the configured compression format
  * [CI:DOCS] logformatter: fix corner case with links
  * UPdate vendor of image-spec and containers/storage
  * vendor: update containers/common
  * Update doc to explictly mention using ed25519 in ssh keys
  * Refactor podman image command output
  * Manual fixes
  * Same thing, with BeNumerically("==", x)
  * Use HaveLen(x) instead of Expect(len(y)).To(Equal(x))
  * Same thing, for BeNumerically("==", 0)
  * Use BeEmpty() instead of len(x).To(Equal(0))
  * Same as previous, for assertions other than Equal()
  * e2e tests: a little more minor cleanup
  * compat API: push: report size of manifest
  * compat: images/json
  * Add ashley-cui, lsm5 and floutoc to owners
  * remove ARTIFACT_DIR and ArtifactPath
  * Image caches: allow overriding cache dir
  * Rename CrioRoot as just Root
  * Fix possible rootless netns cleanup race
  * [NO NEW TESTS NEEDED] Refactor podman container command output
  * Hostname in `spec.hostname` should be passed to infra ctr init opt
  * container, cgroup: detect pid termination
  * top: parse ps(1) args correctly
  * podman, push: expose --compression-format
  * e2e: yet more cleanup of BeTrue/BeFalse
  * Ensure the generated NodePort values are unique
  * Allow containerPortsToServicePorts to fail
  * Don't use the global math/rand RNG for service ports
  * Move a comment to the relevant place
  * a few more manual BeTrue cleanups
  * Convert strings.Contains() to Expect(ContainSubstring)
  * e2e tests: more cleanup of BeTrue()s
  * Implement 'podman run --blkio-weight-device'
  * systemd: replace multi-user with default.target
  * compat API: allow enforcing short-names resolution to Docker Hub
  * Fixed the containerfile not found during remote build.
  * podman-remote: prevent leaking secret into image
  * podman-remote: copy secret to contextdir is absolute path on host
  * api: allow build api to accept secrets
  * Only open save output file with WRONLY
  * List /etc/containers/certs.d as default for --cert-path
  * e2e tests: enable golint
  * fix: parsing of HostConfig.Mounts for container create
  * Move the chown to after the ADDs
  * fix: error reporting for archive endpoint
  * Bindings test: emit GIT_COMMIT, for links in logs
  * checkpoint do not modify XDG_RUNTIME_DIR
  * libpod: improve heuristic to detect cgroup
  * libpod, inspect: export cgroup path
  * stats: get the memory limit from the spec
  * compat: Add compatiblity with Docker/Moby API for scenarios where build fails
  * libpod: leave thread locked on errors
  * Find and fix empty Expect()s
  * Unset SocketLabel after system finishes checkpointing
  * Remove StringInSlice(), part 2
  * Remove StringInSlice(), part 1
  * e2e test cleanup, continued
  * Update basic_networking.md
  * Warn on failing to update container status
  * oci: ack crun output when container is not there
  * oci: exit gracefully if container is already dead
  * Support env variables based on ConfigMaps sent in payload
  * image lookup: do not match *any* tags
  * generate systemd: add --start-timeout flag
  * Oops! Manual edits to broken tests
  * e2e tests: clean up antihelpful BeTrue()s
  * Cirrus: Strip out static nix build
  * Rename pod on generate of container
  * [CI:DOCS] Update notes on java TZ in man page
  * Bump github.com/containers/image/v5 from 5.16.1 to 5.17.0
  * Fix netavark error handling and teardown issue
  * swagger: add layers to build api docs
  * compat: add layer caching compatiblity for non podman clients
  * Bump github.com/opencontainers/selinux from 1.9.1 to 1.10.0
  * Add note about volume with unprivileged container
  * Add EXPOSE e2e test
  * Support EXPOSE with port ranges
  * compat: Add subnet mask behind IP address to match Docker API
  * [CI:DOCS] Add java TZ note to run manpage
  * Bump github.com/rootless-containers/rootlesskit from 0.14.5 to 0.14.6
  * podman-remote does not support signature-policy
  * Add tests for restore runtime verification
  * Use same runtime to restore a container as during checkpointing
  * Force iptables driver for netavark tests
  * Make sure netavark output is logged to the syslog
  * filter: use filepath.Match to maintain consistency with other pattern matching in podman
  * Semiperiodic cleanup of obsolete Skip()s
  * [CI:DOCS]upload a translation file
  * api/handlers: Add checkpoint/restore FileLocks
  * test: Update error string for --file-locks test
  * fix duplicated logs command
  * Bump github.com/docker/docker
  * Bump k8s.io/api from 0.22.3 to 0.22.4
  * Do not store the exit command in container config
  * Add test for checkpoint/restore with --file-locks
  * Add --file-locks checkpoint/restore option
  * Cirrus: Bump Fedora to release 35
  * Cirrus: Partially revert catatonit --force install
  * Revert "Cirrus: Temp. disable prior-fedora testing"
  * Cirrus: Workaround log_driver=journald setting
  * Cirrus: Fix bindings test hang b/c logging config mismatch
  * Cirrus: Timeout bindings test after 30m
  * Cirrus: Log more things in bindings and unit tests
  * Minor Makefile fix
  * rootless netns, one netns per libpod tmp dir
  * Introduce Address type to be used in secondary IPv4 and IPv6 inspect data structure.
  * volumes: add new option idmap
  * remote checkpoint/restore: more fixes
  * fix CI
  * fix: take absolute path for dd on apple silicon
  * System tests: new checkpoint tests
  * rootless: use catatonit to maintain user+mnt namespace
  * rootless: drop strerror(errno) calls
  * rootless: reuse existing open_namespace function
  * rootless: use auto cleanup functions
  * utils: use podman-pause-$RANDOM.scope name
  * hack/bats: deal with new bin helpers
  * Change error message for compatibility with docker
  * rename libpod nettypes fields
  * podman machine start wait for ssh
  * fix remote checkpoint/restore
  * Add --unsetenv &amp; --unsetenv-all to remove def environment variables
  * Set config environment variables early in Podman init
  * journald logs: keep reading until the journal's end
  * secret: honor custom target for secrets with run
  * bindings: reuse context for API requests
  * podman machine improve port forwarding
  * Network test: fix podman-remote-rootless corner case
  * filter: add basic pattern matching for label keys
  * cirrus: force-install catatonit
  * infra container: replace pause with catatonit
  * Revert "add kubernetes pause"
  * Added test for checkpoint/restore --print-stats
  * Update man pages for checkpoint/restore --print-stats
  * Added optional container restore statistics
  * Added optional container checkpointing statistics
  * Error logs --follow if events-backend != journald, event-logger=journald
  * Enable 'podman run --memory-swappiness=0'
  * Fix network mode in play kube
  * Always create working directory when using compat API
  * play kube: don't force-pull infra image
  * Podman Image SCP transfer patch
  * --authfile command line argument for image sign command.
  * Cirrus: Temp. disable prior-fedora testing
  * Cirrus: Update to Ubuntu 21.10
  * Add failing run test for netavark
  * Add flag to overwrite network backend from config
  * libpod: create /etc/mtab safely
  * Add network backend to podman info
  * Add more netavark tests
  * select network backend based on config
  * Fix RUST_LOG envar for netavark
  * netavark IPAM assignment
  * netavark network interface
  * Make networking code reusable
  * Fix flake in upgrade tests
  * export adding id-specifier code to setContainerNameForTemplate
  * VOLUME must be declared after RUN chown command
  * network reload return error if we cannot reload ports
  * network reload without ports should not reload ports
  * Print headers for system connection ls
  * [CI:DOCS] Add CI check for SEE ALSO in man pages
  * podman load: support downloading files
  * Add links to all SEE ALSO sections
  * pod create: read infra image from containers.conf
  * rootless: adjust error message
  * Fix rootless networking with userns and ports
  * support health checks from image configs
  * change from run to create in 250-systemd.bats
  * Exclude already built sources for static build
  * shm_lock: Handle ENOSPC better in AllocateSemaphore
  * Fix Zsh completion command documentation
  * Match .c files in Makefile
  * Add Static Build download instructions to README
  * Add links to podman build,run, create see also
  * Minor test tweaks
  * pod create: read network mode from config
  * Bump Catatonit up to v0.1.7
  * test connection add
  * system: Adds support for removing all named destination via --all
  * pod/container create: resolve conflicts of generated names
  * podman-generate-kube - remove empty structs from YAML
  * Add some information about disabling SELinux when using system volumes
  * Fix swagger definition for the new mac address type
  * Log Apache access_log-like entries at Info level [NO NEW TESTS NEEDED]
  * Test to check for presence of 'stats-dump' in exported checkpoints
  * Add 'stats-dump' file to exported checkpoint
  * Podman Image SCP rootful to rootless transfer
  * rename rootless cni ns to rootless netns
  * mount full XDG_RUNTIME_DIR in rootless cni ns
  * Bump github.com/checkpoint-restore/go-criu/v5 from 5.1.0 to 5.2.0
  * Keep error semantics intact
  * Fix rootless cni netns cleanup logic
  * tweak a couple of flag descriptions in help output
  * Update swagger doc make filed optional
  * Fix bindings container log test
  * test: run --cgroups=split in new cgroup
  * MAC address json unmarshal should allow strings
  * Make stop message more similar to start
  * Implement top streaming for containers and pods
  * Handle HTTP 409 error messages properly for Pod actions
  * Add tests
  * Fix swagger definitions
  * More conforming libpod API and swagger types
  * More conforming libpod API and swagger types
  * Better emptiness test for custom JSON serializer
  * System tests: enhance volume test, add debug prints
  * add unit test to containers_test
  * Use correct swagger type in doc-comment
  * Cirrus: Authorize rootless user self-ssh
  * Fix libpod API conformance to swagger
  * Fix help message case for `podman version`
  * Fix pause usage example
  * Use systemctl in local system test
  * Allow label and labels when creating volumes
  * volumes: be more tolerant and fix infinite loop
  * Add information on how podman machine is updated
  * volumes: allow more options for devpts
  * volumes: do not pass mount opt as formatter string
  * Bump k8s.io/api from 0.22.2 to 0.22.3
  * runtime: change PID existence check
  * oci: rename sub-cgroup to runtime instead of supervisor
  * libpod: deduplicate ports in db
  * Set flags to test 'logs -f' with journald driver
  * Set Checkpointed state to false after restore
  * container create: fix --tls-verify parsing
  * runtime: check for pause pid existence
  * utils: do not overwrite the err variable
  * Fix systemd PID1 test
  * Record the image stream along with the path
  * cgroups: use SessionBusPrivateNoAutoStartup
  * vendor: update godbus to v5.0.6
  * Slirp4netns with ipv6 set net.ipv6.conf.default.accept_dad=0
  * Fix a few problems in 'podman logs --tail' with journald driver
  * Allow 'container restore' with '--ipc host'
  * Document to not set K8S envars for CNI
  * Bump github.com/docker/docker
  * pod create: remove need for pause image
  * add kubernetes pause
  * cirrus: containers: mount directory in /var/tmp to /tmp
  * overlay root fs: create mount on runtime dir
  * Update vendor github.com/opencontainers/runtime-tools
  * If Dockerfile exists in same directory as service, we should not use it.
  * Fix tests of podman image trust --raw and --json
  * Tighten the expected output of the "podman image trust show" test
  * Use INTEGRATION_ROOT instead of current directory
  * Add support to play kube for --log-opt
  * [NO NEW TESTS NEEDED] Fix off-by-one index comparision (reported by LGTM)
  * Fix some typos in documentation and comments (found by codespell)
  * Replace 'an user' =&gt; 'a user'
  * [CI:DOCS] Fix typo keep_id -&gt; keep-id
  * Set DOCKER_HOST in the VM
  * fuse-overlay probably means fuse-overlayfs.
  * Support template unit files in podman generate systemd
  * Remove --kernel-memory options
  * tag: Support tagging manifest list instead of resolving to images
  * Remove infra ID from DB before removing containers
  * System tests: confirm that -a and -l clash
  * systemd: compatible with rootless mode
  * system tests: CONTAINER_* and --help: cleanup
  * podman run --memory=0 ... should not set memory limit
  * Add information on how to discover default log driver
  * Add test for system connection
  * Generate Kube should not print default structs
  * libpod: change mountpoint ownership c.Root when using overlay on top of external rootfs
  * Change podman connection list to use default field
  * Allow API to specify size and inode quota
  * Use exponential backoff when waiting for a journal entry
  * Pod Rm Infra Improvements
  * system tests: socket activation: clean up
  * rootfs-overlay: fix overlaybase path for cleanups
  * Move CONTAINER_HOST and _CONNECTION to IsRemote Function
  * We should only be relabeling when on first run
  * If CONTAINER_HOST env variable is set default podman --remote=true
  * Set targetPort to the port value in the kube yaml
  * Do not add TCP to protocol in generated kube yaml
  * Use CGO_ENABLED=1 when building natively on darwin
  * Test-hang fix: Wait for ready + timeout on connect.
  * Checkpoint/Restore test fixes
  * Don't include ctr.log if not using file logging
  * Don't use docker/pkg/archive, use containers/storage/pkg/archive
  * Fix codespell errors
  * Adjust tests to verify all subcommands show the help message
  * Fix panic in container create compat api
  * Don't add image entrypoint to the generate kube yaml
  * Display help text on empty subcommand by default
  * podman search: display only name and description by default
  * codespell code
  * Add information about .containerignore to podman build man page
  * CNI: fix network create --ip-range
  * Kube Gen run as user/group issues
  * rootlessport: reduce memory usage of the process
  * No space in kube annotations for bind mounts
  * Fix CI flake on time of shutdown for API service
  * Refactor podman search to be more code friendly
  * Unit files: Use actual installed path for podman
  * Bump github.com/onsi/ginkgo from 1.16.4 to 1.16.5
  * cgroups: use cgroup.controllers to read controllers
  * builder: Add support for builder prune
  * Remove a volume with --force if container is running
  * Use SplitN(2) when copying env variables
  * podman stats: move cgroup validation to server
  * fix test
  * Support readonly rootfs contains colon
  * [CI:DOCS] oci-hooks.5.md: fixup section in header
  * Enable /debug/pprof API service endpoints
  * Not all fields in machine list were set properly
  * faster image inspection
  * Warn if podman stop timeout expires that sigkill was sent
  * [CI:DOCS] introduce --replace flag for play kube
  * [CI:DOCS] Include manifest example usage
  * Change podman.1 man page to show corret log-level default
  * Bump github.com/opencontainers/selinux from 1.8.5 to 1.9.1
  * Fixes #11668
  * libpod: fix race when closing STDIN
  * Ensure `podman ps --sync` functions
  * Allow `podman stop` to be run on Stopping containers
  * Bump github.com/containers/image/v5 from 5.16.0 to 5.16.1
  * Bump github.com/docker/docker
  * It really should be no **NEW** tests needed
  * README.md: Point to Podman's channels
  * Add podman-plugins to upstream image
  * CNI networks: reload networks if needed
  * bump c/common to latest and c/storage to 1.37.0
  * Add --time out for podman * rm  -f commands
  * Cirrus: Fix defunct package metadata breaking cache
  * Pod Events Logging Fix
  * [NO TESTS NEEDED] Ignore removed containers
  * Pod Volumes From Support
  * Add note about empty fields and null values for API responses
  * Bump github.com/containers/buildah from 1.23.0 to 1.23.1
  * Add podman play kube --no-hosts options
  * Gating tests: fix permissions error
  * pkg/specgen: cache image in generator
  * cirrus: gitlab: download packages
  * Add guard for BuildOptions.CommonBuildOpts
  * System tests: tighten 'is' operator
  * Update README and release notes for v3.4.0
  * sdnotify test: accept MAINPID anywhere
  * machine: silently cleanup dangling sockets before rm if possible
  * Add expose type map[uint16]string to description
  * [NO TESTS NEEDED] Fix typo in storage.conf file exists message
  * Support selinux options with bind mounts play/gen
  * kube: fix conversion from milliCPU to period/quota
  * Bump github.com/mattn/go-isatty from 0.0.12 to 0.0.14
  * test: use new helper
  * test: skip test on rootless cgroupsv1
  * machine: Info on successfully stopping qemu machine
  * Allow a value of -1 to set unlimited pids limit
  * Vendor in latest containers/storage
  * Storage can remove ErrNotAContainer as well
  * libpod: container create: init variable: do not deep copy spec
  * libpod: add GetConfigNoCopy()
  * libpod: add execSessionNoCopy
  * libpod: do not call (*container).Spec()
  * Pod Device-Read-BPS support
  * Remind user to check connection or use podman machine
  * Ensure pod ID bucket is properly updated on rename
  * Fix contributor make targets on Ubuntu and Debian
  * Implement PR template to assist review &amp; release
  * libpod: do not call (*container).Config()
  * [NO TESTS NEEDED] Add port configuration to first regular container
  * [CI:DOCS] cmd/podman: no dot for short descriptions
  * move network alias validation to container create
  * set --cni-config-dir for exit command
  * always add short container id as net alias
  * image prune: support removing external containers
  * System tests: speed up. They've gotten too slow.
  * Add dockerfile.5 as man link to containerfile man page
  * Set MSI to be 64-bit only.
  * fix podman network prune integration test flakes
  * Cirrus: Add gitlab podman runner test
  * CNI: network remove do not error for ENOENT
  * remote build: EvalSymlinks() the context directory
  * stop: Do nothing if container was never created in runtime
  * logging: new mode -l passthrough
  * Allow machine options to be set from containers.conf
  * Vendor in containers/common v0.46.0
  * podman machine: do not join userns
  * Disable docker and alias to podman in FCOS ignition
  * added healthcheck to ps command
  * Fix english on prune prompt
  * Document missing /images/search query parameters
  * rootful: do not set XDG_RUNTIME_DIR for cni plugins
  * Revert "rootful: unset XDG_RUNTIME_DIR"
  * Add completion for machine list format
  * Set context dir for play kube build
  * Makefile: use -ldflags/-gccgoflags depending on the go implemenatiton
  * Update docs for --platform in podman-build.1
  * shell completion: do not show images without tag
  * podman inspect add State.Health field for docker compat
  * podman save: enforce signature removal
  * Add JSON version of the machine list
  * Add support for :U flag with --mount option
  * [CI:DOCS] Add link to running ctrimage on enablesysadm
  * Ignore mount errors except ErrContainerUnknown when cleaningup container
  * standardize logrus messages to upper case
  * podman generate kube should not include images command
  * Fix machine image
  * sync container state before reading the healthcheck
  * Also show the (initial) disk size
  * Show cpus and memory in machine list
  * Eighty-six eighty-eighty
  * net types: remove omitempty from required fields
  * podman save: add `--uncompressed`
  * Bump CNI to v1.0.1
  * vendor c/psgo@v1.7.1
  * [CI:DOCS] Add network alias note in man pages
  * Add a backoff and retries to retrieving exited event
  * Cross-build release-archives w/ arch in filename
  * Fix Error, empty output for info: 'VERSION'
  * Generate kube should'd add podman default environment vars
  * volume: Add support for overlay on named volumes
  * Pod Device Support
  * Support --format tables in ps output
  * Remove references to kube being development
  * Add support for retrieving system service --timeout
  * Add podman image/container inspect man pages
  * [CI:DOCS] Add link to skopeo delete in podman rmi
  * vendor c/common@main
  * remote untag: support digests
  * Created MapOptions for PodCreate
  * Bump k8s.io/api from 0.22.1 to 0.22.2
  * compat API: /images/json prefix image id with sha256
  * podman machine: use gvproxy for host.containers.internal
  * utils: return error message from StartTransientUnit
  * utils: raise warning only on cgroupv2
  * Add podman machine init --now option
  * System tests: cleanup, and remove obsolete skips
  * Add username flag for machine ssh
  * Remove unused code from libpod
  * [CI:DOCS] markdown cleanup
  * Fix up build the docs site
  * Use a new markdown converter for sphinx
  * runtime: move pause process to scope
  * system: move MovePauseProcessToScope to utils
  * system: always move pause process when running on systemd
  * system: avoid reading pause pid file
  * Only add 127.0.0.1 entry to /etc/hosts with --net=none
  * Add no-trunc support to podman-events
  * CNI: add ipvlan driver
  * CNI: network create support macvlan modes
  * Do not allow network modes to be used as network names
  * fix inverted condition
  * Fix /auth compat endpoint
  * Add Drivers method to the Network Interface
  * CI: load ipv6 kernel modules for rootless tests
  * Drop OCICNI dependency
  * Wire network interface into libpod
  * cni network configs set ipv6 enables correctly
  * default network: do not validate the used subnets
  * network create: validate the input subnet
  * Set default storage from containers.conf for temporary images
  * container runlabel remove image tag from name
  * build.bats: fix copy tests after containers/buildah#3486
  * build: mirror --authfile to filesystem if pointing to FD instead of file
  * Fix example in podman machine init man page
  * vendor: Bump github.com/containers/buildah from 1.22.3 to 1.23.0
  * api: handle nil pointer dereference in rest endpoints
  * build: take advantage of --platform lists
  * Document `all` query parameter for /libpod/images/prune
  * Show variant and codename of the distribution
  * Use new aarch64 fcos repos
  * Enhance bindings for IDE hints
  * Pod Volumes Support
  * test: enable --cgroup-parent test
  * libpod: honor --cgroups=split also with pods
  * tests: enable --cgroups=disabled test for rootless
  * tests: simplify --cgroups=disabled test
  * libpod: rootful close binded ports
  * Search gvproxy with config.FindHelperBinary()
  * rootfs: Add support for rootfs-overlay and bump to buildah v1.22.1-0.202108
  * fix restart always with rootlessport
  * Cirrus: NM/CNI workaround + Remove prior-Ubuntu
  * If container exits with 125 podman should exit with 125
  * Bump github.com/json-iterator/go from 1.1.11 to 1.1.12
  * bump c/common to v0.44.0
  * remove rootlessport socket to prevent EADDRINUSE
  * Add deprecated fields for 1.22+ clients that still expect them
  * Use default username for podman machine ssh</changelog>
  <changelog author="michael@stroeder.com" date="1648814400">- Update to version 4.0.3:
  * Security
  - This release fixes CVE-2022-27649, where containers run by Podman would have excess inheritable capabilities set.
  * Changes
  - The podman machine rm --force command will now remove running machines as well (such machines are shut down first, then removed) (#13448).
  - When a podman machine VM is started that is using a too-old VM image, it will now start in a reduced functionality mode, and provide instructions on how to recreate it (previously, VMs were effectively unusable) (#13510).
  * Bugfixes
  - Fixed a bug where devices added to containers by the --device option to podman run and podman create would not be accessible within the container.
  - Fixed a bug where Podman would refuse to create containers when the working directory in the container was a symlink (#13346).
  - Fixed a bug where pods would be created with cgroups even if cgroups were disabled in containers.conf (#13411).
  - Fixed a bug where the podman play kube command would produce confusing errors if invalid YAML with duplicated container named was passed (#13332).
  - Fixed a bug where the podman machine rm command would not remove the Podman API socket on the host that was associated with the VM.
  - Fixed a bug where the remote Podman client was unable to properly resize the TTYs of containers on non-Linux OSes.
  - Fixed a bug where rootless Podman could hang indefinitely when starting containers on systems with IPv6 disabled (#13388).
  - Fixed a bug where the podman version command could sometimes print excess blank lines as part of its output.
  - Fixed a bug where the podman generate systemd command would sometimes generate systemd services with names beginning with a hyphen (#13272).
  - Fixed a bug where locally building the pause image could fail if the current directory contained a .dockerignore file (#13529).
  - Fixed a bug where root containers in VMs created by podman machine could not bind ports to specific IPs on the host (#13543).
  - Fixed a bug where the storage utilization percentages displayed by podman system df were incorrect (#13516).
  - Fixed a bug where the CPU utilization percentages displayed by podman stats were incorrect (#13597).
  - Fixed a bug where containers created with the --no-healthcheck option would still display healthcheck status in podman inspect (#13578).
  - Fixed a bug where the podman pod rm command could print a warning about a missing cgroup (#13382).
  - Fixed a bug where the podman exec command could sometimes print a timed out waiting for file error after the process in the container exited (#13227).
  - Fixed a bug where virtual machines created by podman machine were not tolerant of changes to the path to the qemu binary on the host (#13394).
  - Fixed a bug where the remote Podman client's podman build command did not properly handle the context directory if a Containerfile was manually specified using -f (#13293).
  - Fixed a bug where Podman would not properly detect the use of systemd as PID 1 in a container when the entrypoint was prefixed with /bin/sh -c (#13324).
  - Fixed a bug where rootless Podman could, on systems that do not use systemd as init, print a warning message about the rootless network namespace (#13703).
  - Fixed a bug where the default systemd unit file for podman system service did not delegate all cgroup controllers, resulting in podman info queries against the remote API returning incorrect cgroup controllers (#13710).
  - Fixed a bug where the slirp4netns port forwarder for rootless Podman would only publish the first port of a range (#13643).
  * API
  - Fixed a bug where the Compat Create API for containers did not properly handle permissions for tmpfs mounts (#13108).
  * Misc
  - The static binary for Linux is now built with CGo disabled to avoid panics due to a Golang bug (#13557).
  - Updated Buildah to v1.24.3
  - Updated the containers/storage library to v1.38.3
  - Updated the containers/image library to v5.19.2
  - Updated the containers/common library to v0.47.5</changelog>
  <changelog author="fvogt@suse.com" date="1649332800">- Add patch to fix starting containers on btrfs with SELinux
  (gh#opencontainers/selinux#172):
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
- Add patch to fix starting containers as user service with systemd 250
  (boo#1197672, gh#containers/podman#13731):
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch</changelog>
  <changelog author="fvogt@suse.com" date="1649332801">- Add patch to make buildah happy after selinux change:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch</changelog>
  <changelog author="rbrown@suse.com" date="1649764800">- Require catatonit &gt;= 0.1.7 for pause functionality needed by pods</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport upstream commit be5abf03ababc ("fix: Container.cGroupPath()
  skip empty line to avoid false error logging") for fixing "Error parsing
  cgroup: expected 3 fields but got 1" (see bsc#1199790, as it applies
  to Factory/Tumbleweed too)
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="rbrown@suse.com" date="1655899200">- Update to version 4.1.1:
  * The output of the podman load command now mirrors that of docker load.
  * Podman now supports Docker Compose v2.2 and higher. Please note that it may be necessary to disable the use of Buildkit by setting the environment variable DOCKER_BUILDKIT=0.
  * A new container command has been added, podman container clone. This command makes a copy of an existing container, with the ability to change some settings (e.g. resource limits) while doing so.
  * Podman now supports sending JSON events related to machines to a Unix socket named machine_events.*\.sock in XDG_RUNTIME_DIR/podman or to a socket whose path is set in the PODMAN_MACHINE_EVENTS_SOCK environment variable.
  * Two new volume commands have been added, podman volume mount and podman volume unmount. These allow for Podman-managed named volumes to be mounted and accessed from outside containers.
  * The podman container checkpoint and podman container restore options now support checkpointing to and restoring from OCI images. This allows checkpoints to be distributed via standard image registries.
  * The podman play kube command now supports environment variables that are specified using the fieldRef and resourceFieldRef sources.
  * The podman play kube command will now set default resource limits when the provided YAML does not include them.
  * The podman play kube command now supports a new option, --annotation, to add annotations to created containers.
  * The podman play kube --build command now supports a new option, --context-dir, which allows the user to specify the context directory to use when building the Containerfile.
  * The podman container commit command now supports a new option, --squash, which squashes the generated image into a single layer.
  * The podman pod logs command now supports two new options, --names, which identifies which container generated a log message by name, instead of ID and --color, which colors messages based on what container generated them.
  * The podman rmi command now supports a new option, --ignore, which will ignore errors caused by missing images.
  * The podman network create command now features a new option, --ipam-driver, to specify details about how IP addresses are assigned to containers in the network.
  * The podman machine list command now features a new option, --quiet, to print only the names of configured VMs and no other information.
  * The --ipc option to the podman create, podman run, and podman pod create commands now supports three new modes: none, private, and shareable. The default IPC mode is now shareable, indicating the the IPC namespace can be shared with other containers.
  * The --mount option to the podman create and podman run commands can now set options for created named volumes via the volume-opt parameter.
  * The --mount option to the podman create and podman run commands now allows parameters to be passed in CSV format.
  * The --userns option to the podman create and podman run commands now supports a new option, nomap, that (only for rootless containers) does not map the UID of the user that started the container into the container, increasing security.
  * The podman import command now supports three new options, --arch, --os, and --variant, to specify what system the imported image was built for.
  * The podman inspect command now includes information on the network configuration of containers that joined a pre-configured network namespace with the --net ns: option to podman run, podman create, and podman pod create.
  * The podman run and podman create commands now support a new option, --chrootdirs, which specifies additional locations where container-specific files managed by Podman (e.g. /etc/hosts, `/etc/resolv.conf, etc) will be mounted inside the container (#12961).
  * The podman run and podman create commands now support a new option, --passwd-entry, allowing entries to be added to the container's /etc/passwd file.
  * The podman images --format command now accepts two new format directives: {{.CreatedAt}} and {{.CreatedSince}}.
  * The podman volume create command's -o option now accepts a new argument, o=noquota, to disable XFS quotas entirely and avoid potential issues when Podman is run on an XFS filesystem with existing quotas defined.
  * The podman info command now includes additional information on the machine Podman is running on, including disk utilization on the drive Podman is storing containers and images on, and CPU utilization.
  * Fix CVE-2022-27191 / bsc#1197284
- Drop obsolete patches:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="predivan@mts.rs" date="1656676800">- Fix build on Leap
    Use libexec macro to set correct, per-distribution specific, directory.</changelog>
  <changelog author="michael@stroeder.com" date="1660219200">- Update to version 4.2.0:
  * Features
  - Podman now supports the Gitlab Runner (using the Docker executor), allowing its use in Gitlab CI/CD pipelines.
  - A new command has been added, podman pod clone, to create a copy of an existing pod. It supports several options, including --start to start the new pod, --destroy to remove the original pod, and --name to change the name of the new pod (#12843).
  - A new command has been added, podman volume reload, to sync changes in state between Podman's database and any configured volume plugins (#14207).
  - A new command has been added, podman machine info, which displays information about the host and the versions of various machine components.
  - Pods created by podman play kube can now be managed by systemd unit files. This can be done via a new systemd service, podman-kube@.service - e.g. systemctl --user start podman-play-kube@$(systemd-escape my.yaml).service will run the Kubernetes pod or deployment contained in my.yaml under systemd.
  - The podman play kube command now honors the RunAsUser, RunAsGroup, and SupplementalGroups setting from the Kubernetes pod's security context.
  - The podman play kube command now supports volumes with the BlockDevice and CharDevice types (#13951).
  - The podman play kube command now features a new flag, --userns, to set the user namespace of created pods. Two values are allowed at present: host and auto (#7504).
  - The podman play kube command now supports setting the type of created init containers via the io.podman.annotations.init.container.type annotation.
  - Pods now have include an exit policy (configurable via the --exit-policy option to podman pod create), which determines what will happen to the pod's infra container when the entire pod stops. The default, continue, acts as Podman currently does, while a new option, stop, stops the infra container after the last container in the pod stops, and is used by default for pods from podman play kube (#13464).
  - The podman pod create command now allows the pod's name to be specified as an argument, instead of using the --name option - for example, podman pod create mypod instead of the prior podman pod create --name mypod. Please note that the --name option is not deprecated and will continue to work.
  - The podman pod create command's --share option now supports adding namespaces to the set by prefacing them with + (as opposed to specifying all namespaces that should be shared) (#13422).
  - The podman pod create command has a new option, --shm-size, to specify the size of the /dev/shm mount that will be shared if the pod shares its UTS namespace (#14609).
  - The podman pod create command has a new option, --uts, to configure the UTS namespace that will be shared by containers in the pod.
  - The podman pod create command now supports setting pod-level resource limits via the --cpus, --cpuset-cpus, and --memory options. These will set a limit for all containers in the pod, while individual containers within the pod are allowed to set further limits. Look forward to more options for resource limits in our next release!
  - The podman create and podman run commands now include the -c short option for the --cpu-shares option.
  - The podman create and podman run commands can now create containers from a manifest list (and not an image) as long as the --platform option is specified (#14773).
  - The podman build command now supports a new option, --cpp-flag, to specify options for the C preprocessor when using Containerfile.in files that require preprocessing.
  - The podman build command now supports a new option, --build-context, allowing the user to specify an additional build context.
  - The podman machine inspect command now prints the location of the VM's Podman API socket on the host (#14231).
  - The podman machine init command on Windows now fetches an image with packages pre-installed (#14698).
  - Unused, cached Podman machine VM images are now cleaned up automatically. Note that because Podman now caches in a different directory, this will not clean up old images pulled before this change (#14697).
  - The default for the --image-volume option to podman run and podman create can now have its default set through the image_volume_mode setting in containers.conf (#14230).
  - Overlay volumes now support two new options, workdir and upperdir, to allow multiple overlay volumes from different containers to reuse the same workdir or upperdir (#14427).
  - The podman volume create command now supports two new options, copy and nocopy, to control whether contents from the overmounted folder in a container will be copied into the newly-created named volume (copy-up).
  - Volumes created using a volume plugin can now specify a timeout for all operations that contact the volume plugin (replacing the standard 5 second timeout) via the --opt o=timeout= option to podman volume create (BZ 2080458).
  - The podman volume ls command's --filter name= option now supports regular expression matching for volume names (#14583).
  - When used with a podman machine VM, volumes now support specification of the 9p security model using the security_model option to podman create -v and podman run -v.
  - The remote Podman client's podman push command now supports the --remove-signatures option (#14558).
  - The remote Podman client now supports the podman image scp command.
  - The podman image scp command now supports tagging the transferred image with a new name.
  - The podman network ls command supports a new filter, --filter dangling=, to list networks not presently used by any containers (#14595).
  - The --condition option to podman wait can now be specified multiple times to wait on any one of multiple conditions.
  - The podman events command now includes the -f short option for the --filter option.
  - The podman pull command now includes the -a short option for the --all-tags option.
  - The podman stop command now includes a new flag, --filter, to filter which containers will be stopped (e.g. podman stop --all --filter label=COM.MY.APP).
  - The Podman global option --url now has two aliases: -H and --host.
  - The podman network create command now supports a new option with the default bridge driver, --opt isolate=, which isolates the network by blocking any traffic from it to any other network with the isolate option enabled. This option is enabled by default for networks created using the Docker-compatible API.
  - Added the ability to create sigstore signatures in podman push and podman manifest push.
  - Added an option to read image signing passphrase from a file.
  * Changes
  - Paused containers can now be killed with the podman kill command.
  - The podman system prune command now removes unused networks.
  - The --userns=keep-id and --userns=nomap options to the podman run and podman create commands are no longer allowed (instead of simply being ignored) with root Podman.
  - If the /run directory for a container is part of a volume, Podman will not create the /run/.containerenv file (#14577).
  - The podman machine stop command on macOS now waits for the machine to be completely stopped to exit (#14148).
  - All podman machine commands now only support being run as rootless, given that VMs only functioned when run rootless.
  - The podman unpause --all command will now only attempt to unpause containers that are paused, not all containers.
  - Init containers created with podman play kube now default to the once type (#14877).
  - Pods created with no shared namespaces will no longer create an infra container unless one is explicitly requested (#15048).
  - The podman create, podman run, and podman cp commands can now autocomplete paths in the image or container via the shell completion.
  - The libpod/common package has been removed as it's not used anywhere.
  - The --userns option to podman create and podman run is no longer accepted when an explicit UID or GID mapping is specified (#15233).
  * Bugfixes
  - Fixed a bug where bind-mounting /dev into a container which used the --init flag would cause the container to fail to start (#14251).
  - Fixed a bug where the podman image mount command would not pretty-print its output when multiple images were mounted.
  - Fixed a bug where the podman volume import command would print an unrelated error when attempting to import into a nonexistent volume (#14411).
  - Fixed a bug where the podman system reset command could race against other Podman commands (#9075).
  - Fixed a bug where privileged containers were not able to restart if the layout of host devices changed (#13899).
  - Fixed a bug where the podman cp command would overwrite directories with non-directories and vice versa. A new --overwrite flag to podman cp allows for retaining the old behavior if needed (#14420).
  - Fixed a bug where the podman machine ssh command would not preserve the exit code from the command run via ssh (#14401).
  - Fixed a bug where VMs created by podman machine would fail to start when created with more than 3072MB of RAM on Macs with M1 CPUs (#14303).
  - Fixed a bug where the podman machine init command would fail when run from C:\Windows\System32 on Windows systems (#14416).
  - Fixed a bug where the podman machine init --now did not respect proxy environment variables (#14640).
  - Fixed a bug where the podman machine init command would fail if there is no $HOME/.ssh dir (#14572).
  - Fixed a bug where the podman machine init command would add a connection even if creating the VM failed (#15154).
  - Fixed a bug where interrupting the podman machine start command could render the VM unable to start.
  - Fixed a bug where the podman machine list --format command would still print a heading.
  - Fixed a bug where the podman machine list command did not properly set the Starting field (#14738).
  - Fixed a bug where the podman machine start command could fail to start QEMU VMs when the machine name started with a number.
  - Fixed a bug where Podman Machine VMs with proxy variables could not be started more than once (#14636 and #14837).
  - Fixed a bug where containers created using the Podman API would, when the Podman API service was managed by systemd, be killed when the API service was stopped (BZ 2052697).
  - Fixed a bug where the podman -h command did not show help output.
  - Fixed a bug where the podman wait command (and the associated REST API endpoint) could return before a container had fully exited, breaking some tools like the Gitlab Runner.
  - Fixed a bug where healthchecks generated exec events, instead of health_status events (#13493).
  - Fixed a bug where the podman pod ps command could return an error when run at the same time as podman pod rm (#14736).
  - Fixed a bug where the podman systemd df command incorrectly calculated reclaimable storage for volumes (#13516).
  - Fixed a bug where an exported container checkpoint using a non-default OCI runtime could not be restored.
  - Fixed a bug where Podman, when used with a recent runc version, could not remove paused containers.
  - Fixed a bug where the remote Podman client's podman manifest rm command would remove images, not manifests (#14763).
  - Fixed a bug where Podman did not correctly parse wildcards for device major number in the podman run and podman create commands' --device-cgroup-rule option.
  - Fixed a bug where the podman play kube command on 32 bit systems where the total memory was calculated incorrectly (#14819).
  - Fixed a bug where the podman generate kube command could set ports and hostname incorrectly in generated YAML (#13030).
  - Fixed a bug where the podman system df --format "{{ json . }}" command would not output the Size and Reclaimable fields (#14769).
  - Fixed a bug where the remote Podman client's podman pull command would display duplicate progress output.
  - Fixed a bug where the podman system service command could leak memory when a client unexpectedly closed a connection when reading events or logs (#14879).
  - Fixed a bug where Podman containers could fail to run if the image did not contain an /etc/passwd file (#14966).
  - Fixed a bug where the remote Podman client's podman push command did not display progress information (#14971).
  - Fixed a bug where a lock ordering issue could cause podman pod rm to deadlock if it was run at the same time as a command that attempted to lock multiple containers at once (#14929).
  - Fixed a bug where the podman rm --force command would exit with a non-0 code if the container in question did not exist (#14612).
  - Fixed a bug where the podman container restore command would fail when attempting to restore a checkpoint for a container with the same name as an image (#15055).
  - Fixed a bug where the podman manifest push --rm command could remove image, instead of manifest lists (#15033).
  - Fixed a bug where the podman run --rm command could fail to remove the container if it failed to start (#15049).
  - Fixed a bug where the podman generate systemd --new command would create incorrect unit files when the container was created with the --sdnotify parameter (#15052).
  - Fixed a bug where the podman generate systemd --new command would fail when -h &lt;hostname&gt; was used to create the container (#15124).
  * API
  - The Docker-compatible API now supports API version v1.41 (#14204).
  - Fixed a bug where containers created via the Libpod API had an incorrect umask set (#15036).
  - Fixed a bug where the remote parameter to the Libpod API's Build endpoint for Images was nonfunctional (#13831).
  - Fixed a bug where the Libpod List endpoint for Containers did not return the application/json content type header when there were no containers present (#14647).
  - Fixed a bug where the Compat Stats endpoint for Containers could return incorrect memory limits (#14676).
  - Fixed a bug where the Compat List and Inspect endpoints for Containers could return incorrect strings for container status.
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle disabling healthchecks (#14493).
  - Fixed a bug where the Compat Create endpoint for Networks did not support the mtu, name, mode, and parent options (#14482).
  - Fixed a bug where the Compat Create endpoint for Networks did not allow the creation of networks name bridge (#14983).
  - Fixed a bug where the Compat Inspect endpoint for Networks did not properly set netmasks in the SecondaryIPAddresses and SecondaryIPv6Addresses fields (#14674).
  - The Libpod Stats endpoint for Pods now supports streaming output via two new parameters, stream and delay (#14674).
  * Misc
  - Podman will now check for nameservers in /run/NetworkManager/no-stub-resolv.conf if the /etc/resolv.conf file only contains a localhost server.
  - The podman build command now supports caching with builds that specify --squash-all by allowing the --layers flag to be used at the same time.
  - Podman Machine support for QEMU installations at non-default paths has been improved.
  - The podman machine ssh command no longer prints spurious warnings every time it is run.
  - When accessing the WSL prompt on Windows, the rootless user will be preferred.
  - The podman info command now includes a field for information on supported authentication plugins for improved Docker compatibility. Authentication plugins are not presently supported by Podman, so this field is always empty.
  - The podman system prune command now no longer prints the Deleted Images header if no images were pruned.
  - The podman system service command now automatically creates and moves to a sub-cgroup when running in the root cgroup (#14573).
  - Updated Buildah to v1.27.0 (fixes CVE-2022-21698 / bsc#1196338)
  - Updated the containers/image library to v5.22.0
  - Updated the containers/storage library to v1.42.0 (fixes bsc#1196751)
  - Updated the containers/common library to v0.49.1
  - Podman will automatically create a sub-cgroup and move itself into it when it detects that it is running inside a container (#14884).
  - Fixed an incorrect release note about regexp.
  - A new MacOS installer (via pkginstaller) is now supported.</changelog>
  <changelog author="asarai@suse.com" date="1663761600">- Update to version 4.2.1:
  * Bump to v4.2.1
  * Add release notes for v4.2.1
  * remove SkipIfNotFedora() from events test
  * fix podman events with custom format
  * Drop stale config value resulting in asymmetric config
  * Fix list of default capabilities
  * Add container GID to additional groups (CVE-2022-2989 / bsc#1202809, removes patch 0001-Add-container-GID-to-additional-groups.patch)
  * libpod: Ensure that generated container names are random
  * Fix bind-mount-option annotation in gen/play kube
  * Improved Windows compatibility for machine command
  * updated apiv2 tests to reflect hash compat fix
  * api: return imageID instead of imageName, for "Image" when Podman API is queried
  * Inhibit SIGTERM during Conmon startup
  * Fix example sections to follow the same format
  * Fix template name inconsistency
  * service: make move to sub-cgroup non fatal
  * Remove duplicate annotations in generated service yaml
  * Compat API image remove events now have 'delete' status
  * [CI:DOCS] Automatically set podman version in pkginstaller
  * Allow colons in windows file paths
  * Fixes isRootfull check using qemu machine on Windows
  * vendor containers/psgo@v1.7.3
  * Allow podman to run in an environment with keys containing spaces
  * Document restrictions on transport in FROM
  * Improved Windows compatibility
  * pass environment variables to container clone
  * podman save: update --compress validation
  * sort hc.Binds returned from compat api
  * Cirrus: Update podman-machine comment
  * podman images and friends can take one image as argument
  * [CI:DOCS] Add .DS_Store to gitignore
  * podman-kube@.service.in: Remove Restart=never option with typo
  * Fix #15499 already connected network
  * [CI:DOCS] Cirrus: Update meta-task for EC2 image
  * fix CI: remove hardcodeded alpine version
  * fix CI: remove hardcodeded alpine version
  * Preserve all unknown PolicyRequirement fields on (podman image trust set)
  * Reorganize the types in policy.go a bit
  * Add support for showing keyPaths in (podman image trust show)
  * Support (image trust show) for sigstoreSigned entries
  * BREAKING CHANGE: Change how (podman image trust show) represents multiple requirements
  * Reorganize descriptionsOfPolicyRequirements a bit
  * Use the full descriptionsOfPolicyRequirements for the default scope
  * Rename haveMatchRegistry to registriesDConfigurationForScope
  * Rename tempTrustShowOutput to entry
  * Split descriptionsOfPolicyRequirements out of getPolicyShowOutput
  * Recognize the new lookaside names for simple signing sigstore
  * Add a unit test for trust.PolicyDescription
  * Make the output of (podman image trust show) deterministic
  * Make most of pkg/trust package-private
  * Move most of ImageEngine.ShowTrust into pkg/trust.PolicyDescription
  * Add support for sigstoreSigned in (podman image trust set)
  * Create new policy entries together with validating input
  * Improve validation of data in ImageEngine.SetTrust
  * Move most of imageEngine.SetTrust to pkg/trust.AddPolicyEntries
  * Add a variable for scope
  * Make trust.CreateTempFile private
  * Reorganize pkg/trust
  * Remove an unused trust.ShowOutput type
  * Remove commented out code
  * libpod: UpdateContainerStatus: do not wait for container
  * Skip / update some tests under runc
  * Bump to v4.2.1-dev
  * test: update apply-podman-deltas for new tests
  * build: implement --cache-to,--cache-from and --cache-ttl
  * vendor: bump buildah to v1.27.0</changelog>
  <changelog author="dcermak@suse.com" date="1669118400">- switch to building with go 1.17
- use %%make_* macros
- drop /usr/share/user-tmpfiles.d/podman-docker.conf on SLE &amp; Leap
- remove rpmlintrc (contained only obsolete filters)
- remove obsolete with_libostree (we don't build on anything older than SLE 15)
- add patch: 0001-Revert-Default-missing-hostPort-to-containerPort-is-.patch
  (hotfix for https://github.com/containers/podman/issues/16765)
- Update to version 4.3.1:
  4.3.1:
  [#]## Bugfixes
- Fixed a deadlock between the `podman ps` and `podman container inspect` commands
  [#]## Misc
- Updated the containers/image library to v5.23.1
  4.3.0:
  [#]## Features
- A new command, `podman generate spec`, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
- A new command, `podman update`, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted ([#15067](https://github.com/containers/podman/issues/15067)).
- A new command, `podman kube down`, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to `podman kube play --down`, but it now has its own command).
- The `podman kube play` command now supports Kubernetes secrets using Podman's secrets backend.
- Systemd-managed pods created by the `podman kube play` command now integrate with sd-notify, using the `io.containers.sdnotify` annotation (or `io.containers.sdnotify/$name` for specific containers).
- Systemd-managed pods created by `podman kube play` can now be auto-updated, using the `io.containers.auto-update` annotation (or `io.containers.auto-update/$name` for specific containers).
- The `podman kube play` command can now read YAML from URLs, e.g. `podman kube play https://example.com/demo.yml` ([#14955](https://github.com/containers/podman/issues/14955)).
- The `podman kube play` command now supports the `emptyDir` volume type ([#13309](https://github.com/containers/podman/issues/13309)).
- The `podman kube play` command now supports the `HostUsers` field in the pod spec.
- The `podman play kube` command now supports `binaryData` in ConfigMaps.
- The `podman pod create` command can now set additional resource limits for pods using the new `--memory-swap`, `--cpuset-mems`, `--device-read-bps`, `--device-write-bps`, `--blkio-weight`, `--blkio-weight-device`, and `--cpu-shares` options.
- The `podman machine init` command now supports a new option, `--username`, to set the username that will be used to connect to the VM as a non-root user ([#15402](https://github.com/containers/podman/issues/15402)).
- The `podman volume create` command's `-o timeout=` option can now set a timeout of 0, indicating volume plugin operations will never time out.
- Added support for a new volume driver, `image`, which allows volumes to be created that are backed by images.
- The `podman run` and `podman create` commands support a new option, `--env-merge`, allowing environment variables to be specified relative to other environment variables in the image (e.g. `podman run --env-merge "PATH=$PATH:/my/app" ...`) ([#15288](https://github.com/containers/podman/issues/15288)).
- The `podman run` and `podman create` commands support a new option, `--on-failure`, to allow action to be taken when a container fails health checks, with the following supported actions: `none` (take no action, the default), `kill` (kill the container), `restart` (restart the container), and `stop` (stop the container).
- The `--keep-id` option to `podman create` and `podman run` now supports new options, `uid` and `gid`, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. `--userns=keep-id:uid=11` will made the user running Podman to UID 11 in the container) ([#15294](https://github.com/containers/podman/issues/15294)).
- The `podman generate systemd` command now supports a new option, `--env`/`-e`, to set environment variables in the generated unit file ([#15523](https://github.com/containers/podman/issues/15523)).
- The `podman pause` and `podman unpause` commands now support the `--latest`, `--cidfile`, and `--filter` options.
- The `podman restart` command now supports the `--cidfile` and `--filter` options.
- The `podman rm` command now supports the `--filter` option to select which containers will be removed.
- The `podman rmi` command now supports a new option, `--no-prune`, to prevent the removal of dangling parents of removed images.
- The `--dns-opt` option to `podman create`, `podman run`, and `podman pod create` has received a new alias, `--dns-option`, to improve Docker compatibility.
- The `podman` command now features a new global flag, `--debug`/`-D`, which enables debug-level logging (identical to `--log-level=debug`), improving Docker compatibility.
- The `podman` command now features a new global flag, `--config`. This flag is ignored, and is only included for Docker compatibility ([#14767](https://github.com/containers/podman/issues/14767)).
- The `podman manifest create` command now accepts a new option, `--amend`/`-a`.
- The `podman manifest create`, `podman manifest add` and `podman manifest push` commands now accept a new option, `--insecure` (identical to `--tls-verify=false`), improving Docker compatibility.
- The `podman secret create` command's `--driver` and `--format` options now have new aliases, `-d` for `--driver` and `-f` for `--format`.
- The `podman secret create` command now supports a new option, `--label`/`-l`, to add labels to created secrets.
- The `podman secret ls` command now accepts the `--quiet`/`-q` option.
- The `podman secret inspect` command now accepts a new option, `--pretty`, to print output in human-readable format.
- The `podman stats` command now accepts the `--no-trunc` option.
- The `podman save` command now accepts the `--signature-policy` option ([#15869](https://github.com/containers/podman/issues/15869)).
- The `podman pod inspect` command now allows multiple arguments to be passed. If so, it will return a JSON array of the inspected pods ([#15674](https://github.com/containers/podman/issues/15674)).
- A series of new hidden commands have been added under `podman context` as aliases to existing `podman system connection` commands, to improve Docker compatibility.
- The remote Podman client now supports proxying signals for attach sessions when the `--sig-proxy` option is set ([#14707](https://github.com/containers/podman/issues/14707)).
  [#]## Changes
- Duplicate volume mounts are now allowed with the `-v` option to `podman run`, `podman create`, and `podman pod create`, so long as source, destination, and options all match ([#4217](https://github.com/containers/podman/issues/4217)).
- The `podman generate kube` and `podman play kube` commands have been renamed to `podman kube generate` and `podman kube play` to group Kubernetes-related commands. Aliases have been added to ensure the old command names still function.
- A number of Podman commands (`podman init`, `podman container checkpoint`, `podman container restore`, `podman container cleanup`) now print the user-inputted name of the container, instead of its full ID, on success.
- When an unsupported option (e.g. resource limit) is specified for a rootless container on a cgroups v1 system, a warning message is now printed that the limit will not be honored.
- The installer for the Windows Podman client has been improved.
- The `--cpu-rt-period` and `--cpu-rt-runtime` options to `podman run` and `podman create` now print a warning and are ignored on cgroups v2 systems (cgroups v2 having dropped support for these controllers) ([#15666](https://github.com/containers/podman/issues/15666)).
- Privileged containers running systemd will no longer mount `/dev/tty*` devices other than `/dev/tty` itself into the container ([#15878](https://github.com/containers/podman/issues/15878)).
- Events for containers that are part of a pod now include the ID of the pod in the event.
- SSH functionality for `podman machine` commands has seen a thorough rework, addressing many issues about authentication.
- The `--network` option to `podman kube play` now allows passing `host` to set the pod to use host networking, even if the YAML does not request this.
- The `podman inspect` command on containers now includes the digest of the image used to create the container.
- Pods created by `podman play kube` are now, by default, placed into a network named `podman-kube`. If the `podman-kube` network does not exist, it will be created. This ensures pods can connect to each other by their names, as the network has DNS enabled.
  [#]## Bugfixes
- Fixed a bug where the `podman network prune` and `podman container prune` commands did not properly support the `--filter label!=` option ([#14182](https://github.com/containers/podman/issues/14182)).
- Fixed a bug where the `podman kube generate` command added an unnecessary `Secret: null` line to generated YAML ([#15156](https://github.com/containers/podman/issues/15156)).
- Fixed a bug where the `podman kube generate` command did not set `enableServiceLinks` and `automountServiceAccountToken` to false in generated YAML ([#15478](https://github.com/containers/podman/issues/15478) and [#15243](https://github.com/containers/podman/issues/15243)).
- Fixed a bug where the `podman kube play` command did not properly handle CPU limits ([#15726](https://github.com/containers/podman/issues/15726)).
- Fixed a bug where the `podman kube play` command did not respect default values for liveness probes ([#15855](https://github.com/containers/podman/issues/15855)).
- Fixed a bug where the `podman kube play` command did not bind ports if `hostPort` was not specified but `containerPort` was ([#15942](https://github.com/containers/podman/issues/15942)).
- Fixed a bug where the `podman kube play` command sometimes did not create directories on the host for `hostPath` volumes.
- Fixed a bug where the remote Podman client's `podman manifest push` command did not display progress.
- Fixed a bug where the `--filter "{{.Config.Healthcheck}}"` option to `podman image inspect` did not print the image's configured healthcheck ([#14661](https://github.com/containers/podman/issues/14661)).
- Fixed a bug where the `podman volume create -o timeout=` option could be specified even when no volume plugin was in use.
- Fixed a bug where the `podman rmi` command did not emit `untag` events when removing tagged images ([#15485](https://github.com/containers/podman/issues/15485)).
- Fixed a bug where API forwarding with `podman machine` VMs on windows could sometimes fail because the pipe was not created in time ([#14811](https://github.com/containers/podman/issues/14811)).
- Fixed a bug where the `podman pod rm` command could error if removal of a container in the pod was interrupted by a reboot.
- Fixed a bug where the `exited` and `exec died` events for containers did not include the container's labels ([#15617](https://github.com/containers/podman/issues/15617)).
- Fixed a bug where running Systemd containers on a system not using Systemd as PID 1 could fail ([#15647](https://github.com/containers/podman/issues/15647)).
- Fixed a bug where Podman did not pass all necessary environment variables (including `$PATH`) to Conmon when starting containers ([#15707](https://github.com/containers/podman/issues/15707)).
- Fixed a bug where the `podman events` command could function improperly when no events were present ([#15688](https://github.com/containers/podman/issues/15688)).
- Fixed a bug where the `--format` flag to various Podman commands did not properly handle template strings including a newline (`\n`) ([#13446](https://github.com/containers/podman/issues/13446)).
- Fixed a bug where Systemd-managed pods would kill every container in a pod when a single container exited ([#14546](https://github.com/containers/podman/issues/14546)).
- Fixed a bug where the `podman generate systemd` command would generate incorrect YAML for pods created without the `--name` option.
- Fixed a bug where the `podman generate systemd --new` command did not properly set stop timeout ([#16149](https://github.com/containers/podman/issues/16149)).
- Fixed a bug where a broken OCI spec resulting from the system rebooting while a container is being started could cause the `podman inspect` command to be unable to inspect the container until it was restarted.
- Fixed a bug where creating a container with a working directory on an overlay volume would result in the container being unable to start ([#15789](https://github.com/containers/podman/issues/15789)).
- Fixed a bug where attempting to remove a pod with running containers without `--force` would not error and instead would result in the pod, and its remaining containers, being placed in an unusable state ([#15526](https://github.com/containers/podman/issues/15526)).
- Fixed a bug where memory limits reported by `podman stats` could exceed the maximum memory available on the system ([#15765](https://github.com/containers/podman/issues/15765)).
- Fixed a bug where the `podman container clone` command did not properly handle environment variables whose value contained an `=` character ([#15836](https://github.com/containers/podman/issues/15836)).
- Fixed a bug where the remote Podman client would not print the container ID when running the `podman-remote run --attach stdin` command.
- Fixed a bug where the `podman machine list --format json` command did not properly show machine starting status.
- Fixed a bug where automatic updates would not error when attempting to update a container with a non-fully qualified image name ([#15879](https://github.com/containers/podman/issues/15879)).
- Fixed a bug where the `podman pod logs --latest` command could panic ([#15556](https://github.com/containers/podman/issues/15556)).
- Fixed a bug where Podman could leave lingering network namespace mounts on the system if cleaning up the network failed.
- Fixed a bug where specifying an unsupported URI scheme for `podman system service` to listen at would result in a panic.
- Fixed a bug where the `podman kill` command would sometimes not transition containers to the exited state ([#16142](https://github.com/containers/podman/issues/16142)).
  [#]## API
- Fixed a bug where the Compat DF endpoint reported incorrect reference counts for volumes ([#15720](https://github.com/containers/podman/issues/15720)).
- Fixed a bug in the Compat Inspect endpoint for Networks where an incorrect network option was displayed, causing issues with `docker-compose` ([#15580](https://github.com/containers/podman/issues/15580)).
- The Libpod Restore endpoint for Containers now features a new query parameter, `pod`, to set the pod that the container will be restored into ([#15018](https://github.com/containers/podman/issues/15018)).
- Fixed a bug where the REST API could panic while retrieving images.
- Fixed a bug where a cancelled connection to several endpoints could induce a memory leak.
  [#]## Misc
- Error messages when attempting to remove an image used by a non-Podman container have been improved ([#15006](https://github.com/containers/podman/issues/15006)).
- Podman will no longer print a warning that `/` is not a shared mount when run inside a container ([#15295](https://github.com/containers/podman/issues/15295)).
- Work is ongoing to port Podman to FreeBSD.
- The output of `podman generate systemd` has been adjusted to improve readability.
- A number of performance improvements have been made to `podman create` and `podman run`.
- A major reworking of the manpages to ensure duplicated options between commands have the same description text has been performed.
- Updated Buildah to v1.28.0
- Updated the containers/image library to v5.23.0
- Updated the containers/storage library to v1.43.0
- Updated the containers/common library to v0.50.1</changelog>
</package>
<package pkgid="24978faaa409d91803c0a08cb00369087aed83ad9f686be730479f9ed31e39bf" name="podman-cni-config" arch="noarch">
  <version epoch="0" ver="4.3.1" rel="150400.4.11.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024 / bsc#1193166, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190 / bsc#1193273, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="rbrown@suse.com" date="1647432000">- Update to version 4.0.2:
  * Bump to v4.0.2
  * Update release notes for v4.0.2
  * Revert "use GetRuntimeDir() from c/common"
  * Revert "Option --url and --connection should imply --remote."
  * Option --url and --connection should imply --remote.
  * Bump to v4.0.2-dev
  * Bump to v4.0.1
  * Update release notes for v4.0.1
  * Fix a potential flake in volume plugins tests
  * Propagate $CONTAINERS_CONF to conmon
  * tests: Remove inaccurate comment
  * System tests: show one-line config overview
  * provide better error on invalid flag
  * use GetRuntimeDir() from c/common
  * kube: honor --build=false and make --build=true by default
  * system tests: cleanup networks on teardown
  * Remove the runtime lock
  * Don't log errors on removing volumes inuse, if container --volumes-from
  * kube: honor mount propagation mode
  * Load ip_tables modules at boot
  * Cirrus: Disable F34 aka prior-fedora testing
  * Cirrus: Update VM Images for 4.0 release
  * Bump to v4.0.1-dev
  * Bump to v4.0.0
  * Release notes for v4.0.0 final
  * Fix lint
  * Fix manifest 4.0 Endpoints Branch forced 4.0 only endpoints
  * Introduce podman machine init --root=t|f and podman machine set --root=t|f
  * Initial implementation of mac forwarding using a privileged docker sock claim helper
  * ignition: propagate proxy settings from a host into a vm
  * Update to podman4 copr stream
  * Unify ls --filter docs for networks and pods
  * e2e: merge after/since image-filter tests
  * podman network: add documentation for netavark
  * create: Fix key=value annotation in the flag output
  * enable netavark specific tests
  * Fix checkpoint/restore pod tests
  * Make sure building with relative paths work correctly.
  * Add 409 response to swagger godoc
  * Fix images since/after tests
  * Changes of docker descriptions
  * Temporarily pull machine images from side repo
  * Cirrus: TODO: netavark/aardvark release branches
  * Cirrus: Expand netavark testing to include rootless
  * Cirrus: Minor - limit release task applicability
  * Cirrus: Add [CI:BUILD] magic that only builds
  * CI: fix nightly builds
  * Cirrus: Log netavark/aardvark binary build info.
  * Cirrus: Add netavark/aardvark system test task
  * Cirrus: Also download aardvark-dns binary
  * Cirrus: Add e2e task w/ upstream netavark
  * Revert minimum API change
  * netavark e2e tests
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC5
  * Update release notes for v4.0.0-RC5
  * Modify /etc/resolv.conf when connecting/disconnecting
  * Do not set the network config dir to cni plugin dir
  * Show API doc for several versions
  * [NO NEW TEST NEEDED] Add schema for ImageCreate 200 response.
  * fix: Multiplication of durations
  * move rootless netns slirp4netns process to systemd user.slice
  * compat: endpoint /build must set header content type as application/json in reponse
  * Cleanup: remove obsolete/misleading bug workaround
  * tests: retrofit healthcheck system tests
  * healthcheck, libpod: Read healthcheck event output from os pipe
  * Fix: Do not print error when parsing journald log fails
  * Bump github.com/buger/goterm from 1.0.1 to 1.0.4
  * append podman dns search domain
  * Podman pod create --share-parent vs --share=cgroup
  * System tests: revert emergency skip of checkpoint tests
  * Add version guard to libpod API endpoints
  * [v4.0] Bump c/common to v0.47.4
  * idmap should be able to be specified along with other options
  * Vendor in containers/buildah v1.24.1
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC4
  * Disable failing E2E test
  * Revert "Move each search dns to its own line"
  * Move each search dns to its own line
  * Update release notes for v4.0.0-RC4
  * Document `schema` values in the `--url` flag
  * podman image scp syntax correction
  * system prune: remove all networks
  * Only change network fields if they were actually changed by the user
  * docs: clarify rootless net stats
  * Fix size to match Docker selection
  * libpod: enforce noexec,nosuid,nodev for /dev/shm
  * Clarify remote client means Mac and Windows
  * libpod: report slirp4netns network stats
  * Add notes to "--oom-kill-disable" not supported on cgroups V2
  * Fix use of infra image to clarify default
  * Adapt podman images ls filters docs to be aligned with prune filters docs
  * ignition, machine: delegate cpu,io cgroup controllers to machine's default users
  * pkg/bindings/images.Build(): slashify "dockerfile" values, too
  * Remove mention of IPv6 portfwd from release notes
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC3
  * Update release notes for v4.0.0-RC3
  * Fix Cirrus destination branch
  * volume: add support for non-volatile upperdir,workdir for overlay volumes
  * github: label issues based on os fix regex
  * github: label issues based on os
  * Cirrus: Fix get_ci_vm.sh initial setup
  * System tests: emergency skip of checkpoint tests
  * network create: allow multiple subnets
  * Update troubleshooting.md
  * Fix sort ordering of filters
  * Unify podman prune filter description: volumes, networks, system
  * Bump Buildah to v1.24.0
  * rootless: drop permission check for devices
  * switch podman image scp from depending on machinectl to just os/exec
  * Bump github.com/containers/image/v5 from 5.18.0 to 5.19.0
  * Bump github.com/containers/storage from 1.38.0 to 1.38.1
  * change location of where make outputs podman binary on osx
  * Github workflow: Fix parsing of GraphQL response JSON
  * Github-workflow: Fix YAML syntax
  * Update godoc, swagger using wrong struct
  * Makefile: install targets independent of build
  * [CI:DOCS] Fix typos and improve language
  * CI: enable rootless-remote system tests
  * pkg/specgen/generate/security: fix error message
  * Github workflow: Send e-mail on job error
  * Github workflow: Update Cirrus-cron GraphQL query
  * remote build: set rootless oci isolation correctly
  * [CI:DOCS] Fix typos and improve language
  * Fix handling of duplicate matches on id expansion
  * Show correct default values or show none
  * exec: retry rm -rf on ENOTEMPTY and EBUSY
  * container create: do not check for network dns support
  * libpod: fix leaking fd
  * libpod: fix connection leak
  * [CI:DOCS] fix typo subpordinate
  * Fix filter description and unify filters docs for containers/images prune
  * Remove unused param and clean API handlers
  * Restore machine start logic that was hanging
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC2
  * Final release notes for v4.0.0-rc2
  * Run codespell on code
  * Update release notes for Podman v4.0.0
  * Fix #2 for compat commit handling of --changes
  * Fix nil pointer dereference for configmap optional
  * Make error message matching in 030-run.bats less fragile
  * Don't explicitly check for crun|runc in package information
  * Don't segfault if an image layer has no creation timestamp
  * compat: remove hardcoded index from load images output report
  * compat: images/load must be able to load tar with multiple images
  * System tests: fix for new systemd on rawhide
  * Remove rootless_networking option from containers.conf
  * vendor c/psgo@v1.7.2 (fixes CVE-2022-1227 / bsc#1182428)
  * Engine.Remote from containers.conf
  * vendor: bump c/common and other vendors
  * rootless: report correctly the error
  * Implement API forwarding for podman machine on Windows
  * Implement env parsing on Windows
  * Handle changes in docker compat mode
  * Show package version when running on alpine
  * Handlers for `generate systemd` with custom dependencies
  * APIv2 tests: followup to recent log test
  * Add IndexConfigs to compat /info endpoint
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * apiv2 test: add regression test for #12904
  * SECURITY.md: fix the project name
  * rename --cni-config-dir to --network-config-dir
  * compat attach: fix write on closed channel
  * upgrade all dependencies
  * Revert "Cirrus: Temporarily disable OSX Cross task"
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * bump go module to version 4
  * [NO NEW TESTS NEEDED] add builddeps to copr template
  * CI: rootless user: also create in some root tests
  * [WIP] Tests for podman image scp (the sudo form)
  * Revamp Libpod state strings for Docker compat
  * Cirrus: Temporarily disable OSX Cross task
  * update c/common to latest
  * Use PODMAN_USERNS environment variable when running as a service
  * Unify the method of parsing filters in cmd
  * fix default branch links
  * [CI:DOCS] fix default branch links
  * [CI:DOCS] Unprivileged native overlayfs is now supported
  * [CI:DOCS] Fix typo in --env
  * Recursively copy cert files.
  * Refactor manifest list operations
  * Add rpkg template for COPR autobuild
  * Fix cgroup mode handling in api server
  * Standardize on capatalized Cgroups
  * test/system: podman run update /etc/hosts
  * Remove two GetImages functions from API
  * Use fully-qualified device name in CDI test
  * Use new CDI API
  * troubleshooting links to main branch
  * Podman Build use absolute filepath
  * Prohibit --uid/gid map and --pod for container create/run
  * podman container rm: remove pod
  * Manual fixes for PR #12642:
  * podman build enable --all-platforms and --unsetenv
  * use events_logfile_path from containers.conf for events log.
  * Podman Pod Create --sysctl support
  * Wait for podman stop to complete
  * libpod: fix check for systemd session
  * libpod: refine check for empty pod cgroup
  * fix buildah-bud test diff
  * upgrade test: check that network backend is cni
  * use netns package from c/common
  * update buildah to latest and use new network stack
  * podman image scp: implement --quiet
  * use libnetwork from c/common
  * Add --noout option to prevent the output of ids
  * remote events: convert TimeNano properly
  * Bump github.com/BurntSushi/toml from 0.4.1 to 1.0.0
  * vendor latest c/common
  * add additional fields to podman machine ls --json
  * buildah bud tests: skip failing tests
  * Fix permission on secrets directory
  * Add podman rm --depend
  * fix host.containers.internal entry for macvlan networks
  * It takes some time to start a VM
  * Pretty Print output of podman machine ls --format json
  * Use the InfraImage defined in containers.conf
  * Cirrus: Freshen VM images
  * Revert "Cirrus: Temp. ignore gitlab task failures"
  * pkg: use PROXY_VARS from c/common
  * ignition: add support from setting SSL_CERT_FILE
  * ignition: propogate HTTP proxy variables from host to remote
  * System tests: fix RHEL8 gating tests
  * vendor c/common
  * Remove dead RuntimeOption functions
  * Update docker cli message for case where user creates directory
  * Don't add env if optional and not found
  * Fix type-o in podman.wxs
  * [CI:DOCS] fixes indentation of example pod yaml
  * Prevent double decoding of storage options
  * Emergency system-test fixes
  * add OCI Runtime name to errors
  * fix healthcheck timeouts and ut8 coercion
  * Don't rename pod if container has the same name
  * Set volume NeedsCopyUp to false iff data was copied up
  * Fix CI
  * correct typo words in docs
  * Change Tests to ignore missing containers when removing --all
  * test/e2e/pod_initcontainers: fix a flake
  * test/e2e/run: don't use date +%N on Alpine
  * Support all volume mounts for rootless containers
  * Fix wrong 'podman search --format' placeholder
  * Fix Container List API call to return mount info
  * fix misleading comment regarding default value of cpu period [NO NEW TESTS NEEDED]
  * add --ip6 flag to podman create/run
  * legacy events: also set exitCode
  * Don't initialize the global RNG with GinkgoRandomSeed() in e2e tests
  * Avoid collisions on RemoteSocket paths
  * Refactor remote socket path determination in tests
  * fix doc
  * test/system: podman run image with filesystem permission
  * test/system: podman run with log-opt option
  * Update swagger documentation
  * Make it possible to select the volume driver
  * Check the mount type for future compatibility
  * Implement virtfs volumes for podman machine
  * [CI:DOCS] Add example of cpus to init command
  * prefix imageId with sha256: in containers list test for compat API ImageId
  * Pod Security Option support
  * ignition: add certs from current user into the machine while init
  * docs: sort swagger operations alpabetically
  * .service file removal on failure
  * Introduce Windows WSL implementation of podman machine
  * podman image scp never enter podman user NS
  * Allow users to add host user accounts to /etc/passwd
  * container creation: don't apply reserved annotations from image
  * [CI:DOCS] clarify `io.podman.annotations.seccomp`
  * Error out early if system does not support pre-copy checkpointing
  * Update go-criu to v5.3.0
  * [CI:DOCS] docs: document rootless userns mappings
  * Switch to a new installer approach using a path manipulation helper
  * e2e: Add dev/shm checkpoint/restore test
  * Enable checkpoint/restore for /dev/shm
  * Update github.com/checkpoint-restore/checkpointctl
  * Always run passwd management code when DB value is nil
  * Warn on use of --kernel-memory
  * support hosts without /etc/hosts
  * Podman run --passwd
  * ci: force scratch build for crun
  * Use hosts public ip address in rootless containers
  * compat: image normalization: handle sha256 prefix
  * specgen: honor userns=auto from containers.conf
  * [CI:DOCS] Small checkpoint/restore man page fixes
  * [CI:DOCS] Explicitly mention that checkpointing systemd containers might fail
  * vendor: update containers/storage
  * build: fix test for subid 4
  * test: add --rm to podman run commands
  * fix(generate): fix up podman generate kube missing env field bug
  * legacy events: also set Action="die"
  * rootless: include the args in the debug message
  * apiv2 tests: use quay.io/libpod/testimage:20210610 for platform tests
  * image rm: allow for force-remove infra images
  * tests: adjust old build test to expect exit code
  * Test for checkpoint specific inspect fields
  * Add more checkpoint/restore information to 'inspect'
  * build: relay exitcode from imagebuildah to registry
  * Removed .service file for healthchecks
  * Set machine timezone
  * MovePauseProcessToScope do not seed everytime
  * bindings rmi test: clarify behavior
  * bump cobra to 1.3.0
  * .github: revert to the old template
  * oci: configure the devices cgroup with default devices
  * kill: fix output
  * e2e: search flake: skip test on registry.redhat.io
  * APIv2 tests: fail on syntax/logic errors
  * Show --external containers even without --all option
  * apiv2 tests: refactor complicated curls
  * fix network id handling
  * Update Windows Install Doc
  * Fixes #12063 Add docker compatible output after image build.
  * pause scope: don't use the global math/rand RNG
  * specgen: check that networks are only set with bridge
  * container restore/import: store networks from db
  * play kube add support for multiple networks
  * support advanced network configuration via cli
  * Add new networks format to spegecen
  * fix incorrect swagger doc for network dis/connect
  * network connect allow ip, ipv6 and mac address
  * network db: add new strucutre to container create
  * remove unneeded return value from c.Networks()
  * network db rewrite: migrate existing settings
  * network ls: show networks in deterministic order
  * Bump github.com/docker/docker
  * pprof flakes: bump timeout to 20 seconds
  * Add secret list --filter to cli
  * Cirrus: Temp. ignore gitlab task failures
  * compat build: adhere to q/quiet
  * Make XRegistryAuthHeader and XRegistryConfigHeader private
  * Remove the authfile parameter of MakeXRegistryAuthHeader
  * Simplify the header decision in pkg/bindings/images.Build a bit
  * Remove the authfile parameter of MakeXRegistryConfigHeader
  * Remove no-longer-useful name variables
  * Consolidate creation of SystemContext with auth.json into a helper
  * Remove pkg/auth.Header
  * Call MakeXRegistryAuthHeader instead of Header(..., XRegistryAuthHeader)
  * Turn headerAuth into MakeXRegistryAuthHeader
  * Call MakeXRegistryConfigHeader instead of Header(..., XRegistryConfigHeader)
  * Turn headerConfig into MakeXRegistryConfigHeader
  * Move the auth file creation to GetCredentials
  * Consolidate the error handling path in GetCredentials
  * Only look up HTTP header values once in GetCredentials
  * Use Header.Values in GetCredentials.has
  * Beautify GetCredentials.has a bit
  * Pass a header value directly to parseSingleAuthHeader and parseMultiAuthHeader
  * Simplify parseSingleAuthHeader
  * Simplify the interface of parseSingleAuthHeader
  * Don't return a header name from auth.GetCredentials
  * Fix normalizeAuthFileKey to use the correct semantics
  * Rename normalize and a few variables
  * Add TestHeaderGetCredentialsRoundtrip
  * Add tests for auth.Header
  * Improve TestAuthConfigsToAuthFile
  * Add unit tests for singleAuthHeader
  * Add unit tests for multiAuthHeader
  * fix e2e test missing network cleanup
  * pprof CI flakes: enforce 5 seconds grace period
  * [NO NEW TESTS NEEDED] rootless: declare TEMP_FAILURE_RETRY before usage (Fixes: #12563)
  * --hostname should be set when using --pod new:foobar
  * Cirrus: Use cached swagger binary
  * inotify: make sure to remove files
  * System tests: remove rm_pause_image()
  * specgen: honor empty args for entrypoint
  * generate systemd: support entrypoint JSON strings
  * Bump github.com/uber/jaeger-client-go
  * remove runlabel test for global opts
  * utils: reintroduce moveToCgroup
  * autocopr: distro conditionals for containers-common
  * vendor c/image/v5@main
  * Update vendor or containers/common moving pkg/cgroups there
  * volume: apply exact permission of target directory without adding extra 0111
  * Cirrus: Remove remnants of nix-based static build
  * Refactor podman pods to report.Formatter
  * rootless netns: resolve all path components for resolv.conf
  * tests: clean up FIXMEs and noise
  * fix remote run/start flake
  * e2e: fix pprof flakes
  * Bump github.com/opencontainers/runc from 1.0.2 to 1.0.3
  * vendor c/common@main
  * Escape trailing slash in install directory location so the closing quote is not escaped
  * centos 9 stream cannot use %autochangelog
  * Refactor podman system to report.Formatter [NO NEW TESTS NEEDED]
  * add spec file for automated copr builds
  * Add restart-sec option to systemd generate
  * Fix documentation of (podman image save --compress --uncompressed)
  * Improve documentation of (podman image save --format)
  * Add support for configmap volumes to play kube
  * cmd, push: use the configured compression format
  * [CI:DOCS] logformatter: fix corner case with links
  * UPdate vendor of image-spec and containers/storage
  * vendor: update containers/common
  * Update doc to explictly mention using ed25519 in ssh keys
  * Refactor podman image command output
  * Manual fixes
  * Same thing, with BeNumerically("==", x)
  * Use HaveLen(x) instead of Expect(len(y)).To(Equal(x))
  * Same thing, for BeNumerically("==", 0)
  * Use BeEmpty() instead of len(x).To(Equal(0))
  * Same as previous, for assertions other than Equal()
  * e2e tests: a little more minor cleanup
  * compat API: push: report size of manifest
  * compat: images/json
  * Add ashley-cui, lsm5 and floutoc to owners
  * remove ARTIFACT_DIR and ArtifactPath
  * Image caches: allow overriding cache dir
  * Rename CrioRoot as just Root
  * Fix possible rootless netns cleanup race
  * [NO NEW TESTS NEEDED] Refactor podman container command output
  * Hostname in `spec.hostname` should be passed to infra ctr init opt
  * container, cgroup: detect pid termination
  * top: parse ps(1) args correctly
  * podman, push: expose --compression-format
  * e2e: yet more cleanup of BeTrue/BeFalse
  * Ensure the generated NodePort values are unique
  * Allow containerPortsToServicePorts to fail
  * Don't use the global math/rand RNG for service ports
  * Move a comment to the relevant place
  * a few more manual BeTrue cleanups
  * Convert strings.Contains() to Expect(ContainSubstring)
  * e2e tests: more cleanup of BeTrue()s
  * Implement 'podman run --blkio-weight-device'
  * systemd: replace multi-user with default.target
  * compat API: allow enforcing short-names resolution to Docker Hub
  * Fixed the containerfile not found during remote build.
  * podman-remote: prevent leaking secret into image
  * podman-remote: copy secret to contextdir is absolute path on host
  * api: allow build api to accept secrets
  * Only open save output file with WRONLY
  * List /etc/containers/certs.d as default for --cert-path
  * e2e tests: enable golint
  * fix: parsing of HostConfig.Mounts for container create
  * Move the chown to after the ADDs
  * fix: error reporting for archive endpoint
  * Bindings test: emit GIT_COMMIT, for links in logs
  * checkpoint do not modify XDG_RUNTIME_DIR
  * libpod: improve heuristic to detect cgroup
  * libpod, inspect: export cgroup path
  * stats: get the memory limit from the spec
  * compat: Add compatiblity with Docker/Moby API for scenarios where build fails
  * libpod: leave thread locked on errors
  * Find and fix empty Expect()s
  * Unset SocketLabel after system finishes checkpointing
  * Remove StringInSlice(), part 2
  * Remove StringInSlice(), part 1
  * e2e test cleanup, continued
  * Update basic_networking.md
  * Warn on failing to update container status
  * oci: ack crun output when container is not there
  * oci: exit gracefully if container is already dead
  * Support env variables based on ConfigMaps sent in payload
  * image lookup: do not match *any* tags
  * generate systemd: add --start-timeout flag
  * Oops! Manual edits to broken tests
  * e2e tests: clean up antihelpful BeTrue()s
  * Cirrus: Strip out static nix build
  * Rename pod on generate of container
  * [CI:DOCS] Update notes on java TZ in man page
  * Bump github.com/containers/image/v5 from 5.16.1 to 5.17.0
  * Fix netavark error handling and teardown issue
  * swagger: add layers to build api docs
  * compat: add layer caching compatiblity for non podman clients
  * Bump github.com/opencontainers/selinux from 1.9.1 to 1.10.0
  * Add note about volume with unprivileged container
  * Add EXPOSE e2e test
  * Support EXPOSE with port ranges
  * compat: Add subnet mask behind IP address to match Docker API
  * [CI:DOCS] Add java TZ note to run manpage
  * Bump github.com/rootless-containers/rootlesskit from 0.14.5 to 0.14.6
  * podman-remote does not support signature-policy
  * Add tests for restore runtime verification
  * Use same runtime to restore a container as during checkpointing
  * Force iptables driver for netavark tests
  * Make sure netavark output is logged to the syslog
  * filter: use filepath.Match to maintain consistency with other pattern matching in podman
  * Semiperiodic cleanup of obsolete Skip()s
  * [CI:DOCS]upload a translation file
  * api/handlers: Add checkpoint/restore FileLocks
  * test: Update error string for --file-locks test
  * fix duplicated logs command
  * Bump github.com/docker/docker
  * Bump k8s.io/api from 0.22.3 to 0.22.4
  * Do not store the exit command in container config
  * Add test for checkpoint/restore with --file-locks
  * Add --file-locks checkpoint/restore option
  * Cirrus: Bump Fedora to release 35
  * Cirrus: Partially revert catatonit --force install
  * Revert "Cirrus: Temp. disable prior-fedora testing"
  * Cirrus: Workaround log_driver=journald setting
  * Cirrus: Fix bindings test hang b/c logging config mismatch
  * Cirrus: Timeout bindings test after 30m
  * Cirrus: Log more things in bindings and unit tests
  * Minor Makefile fix
  * rootless netns, one netns per libpod tmp dir
  * Introduce Address type to be used in secondary IPv4 and IPv6 inspect data structure.
  * volumes: add new option idmap
  * remote checkpoint/restore: more fixes
  * fix CI
  * fix: take absolute path for dd on apple silicon
  * System tests: new checkpoint tests
  * rootless: use catatonit to maintain user+mnt namespace
  * rootless: drop strerror(errno) calls
  * rootless: reuse existing open_namespace function
  * rootless: use auto cleanup functions
  * utils: use podman-pause-$RANDOM.scope name
  * hack/bats: deal with new bin helpers
  * Change error message for compatibility with docker
  * rename libpod nettypes fields
  * podman machine start wait for ssh
  * fix remote checkpoint/restore
  * Add --unsetenv &amp; --unsetenv-all to remove def environment variables
  * Set config environment variables early in Podman init
  * journald logs: keep reading until the journal's end
  * secret: honor custom target for secrets with run
  * bindings: reuse context for API requests
  * podman machine improve port forwarding
  * Network test: fix podman-remote-rootless corner case
  * filter: add basic pattern matching for label keys
  * cirrus: force-install catatonit
  * infra container: replace pause with catatonit
  * Revert "add kubernetes pause"
  * Added test for checkpoint/restore --print-stats
  * Update man pages for checkpoint/restore --print-stats
  * Added optional container restore statistics
  * Added optional container checkpointing statistics
  * Error logs --follow if events-backend != journald, event-logger=journald
  * Enable 'podman run --memory-swappiness=0'
  * Fix network mode in play kube
  * Always create working directory when using compat API
  * play kube: don't force-pull infra image
  * Podman Image SCP transfer patch
  * --authfile command line argument for image sign command.
  * Cirrus: Temp. disable prior-fedora testing
  * Cirrus: Update to Ubuntu 21.10
  * Add failing run test for netavark
  * Add flag to overwrite network backend from config
  * libpod: create /etc/mtab safely
  * Add network backend to podman info
  * Add more netavark tests
  * select network backend based on config
  * Fix RUST_LOG envar for netavark
  * netavark IPAM assignment
  * netavark network interface
  * Make networking code reusable
  * Fix flake in upgrade tests
  * export adding id-specifier code to setContainerNameForTemplate
  * VOLUME must be declared after RUN chown command
  * network reload return error if we cannot reload ports
  * network reload without ports should not reload ports
  * Print headers for system connection ls
  * [CI:DOCS] Add CI check for SEE ALSO in man pages
  * podman load: support downloading files
  * Add links to all SEE ALSO sections
  * pod create: read infra image from containers.conf
  * rootless: adjust error message
  * Fix rootless networking with userns and ports
  * support health checks from image configs
  * change from run to create in 250-systemd.bats
  * Exclude already built sources for static build
  * shm_lock: Handle ENOSPC better in AllocateSemaphore
  * Fix Zsh completion command documentation
  * Match .c files in Makefile
  * Add Static Build download instructions to README
  * Add links to podman build,run, create see also
  * Minor test tweaks
  * pod create: read network mode from config
  * Bump Catatonit up to v0.1.7
  * test connection add
  * system: Adds support for removing all named destination via --all
  * pod/container create: resolve conflicts of generated names
  * podman-generate-kube - remove empty structs from YAML
  * Add some information about disabling SELinux when using system volumes
  * Fix swagger definition for the new mac address type
  * Log Apache access_log-like entries at Info level [NO NEW TESTS NEEDED]
  * Test to check for presence of 'stats-dump' in exported checkpoints
  * Add 'stats-dump' file to exported checkpoint
  * Podman Image SCP rootful to rootless transfer
  * rename rootless cni ns to rootless netns
  * mount full XDG_RUNTIME_DIR in rootless cni ns
  * Bump github.com/checkpoint-restore/go-criu/v5 from 5.1.0 to 5.2.0
  * Keep error semantics intact
  * Fix rootless cni netns cleanup logic
  * tweak a couple of flag descriptions in help output
  * Update swagger doc make filed optional
  * Fix bindings container log test
  * test: run --cgroups=split in new cgroup
  * MAC address json unmarshal should allow strings
  * Make stop message more similar to start
  * Implement top streaming for containers and pods
  * Handle HTTP 409 error messages properly for Pod actions
  * Add tests
  * Fix swagger definitions
  * More conforming libpod API and swagger types
  * More conforming libpod API and swagger types
  * Better emptiness test for custom JSON serializer
  * System tests: enhance volume test, add debug prints
  * add unit test to containers_test
  * Use correct swagger type in doc-comment
  * Cirrus: Authorize rootless user self-ssh
  * Fix libpod API conformance to swagger
  * Fix help message case for `podman version`
  * Fix pause usage example
  * Use systemctl in local system test
  * Allow label and labels when creating volumes
  * volumes: be more tolerant and fix infinite loop
  * Add information on how podman machine is updated
  * volumes: allow more options for devpts
  * volumes: do not pass mount opt as formatter string
  * Bump k8s.io/api from 0.22.2 to 0.22.3
  * runtime: change PID existence check
  * oci: rename sub-cgroup to runtime instead of supervisor
  * libpod: deduplicate ports in db
  * Set flags to test 'logs -f' with journald driver
  * Set Checkpointed state to false after restore
  * container create: fix --tls-verify parsing
  * runtime: check for pause pid existence
  * utils: do not overwrite the err variable
  * Fix systemd PID1 test
  * Record the image stream along with the path
  * cgroups: use SessionBusPrivateNoAutoStartup
  * vendor: update godbus to v5.0.6
  * Slirp4netns with ipv6 set net.ipv6.conf.default.accept_dad=0
  * Fix a few problems in 'podman logs --tail' with journald driver
  * Allow 'container restore' with '--ipc host'
  * Document to not set K8S envars for CNI
  * Bump github.com/docker/docker
  * pod create: remove need for pause image
  * add kubernetes pause
  * cirrus: containers: mount directory in /var/tmp to /tmp
  * overlay root fs: create mount on runtime dir
  * Update vendor github.com/opencontainers/runtime-tools
  * If Dockerfile exists in same directory as service, we should not use it.
  * Fix tests of podman image trust --raw and --json
  * Tighten the expected output of the "podman image trust show" test
  * Use INTEGRATION_ROOT instead of current directory
  * Add support to play kube for --log-opt
  * [NO NEW TESTS NEEDED] Fix off-by-one index comparision (reported by LGTM)
  * Fix some typos in documentation and comments (found by codespell)
  * Replace 'an user' =&gt; 'a user'
  * [CI:DOCS] Fix typo keep_id -&gt; keep-id
  * Set DOCKER_HOST in the VM
  * fuse-overlay probably means fuse-overlayfs.
  * Support template unit files in podman generate systemd
  * Remove --kernel-memory options
  * tag: Support tagging manifest list instead of resolving to images
  * Remove infra ID from DB before removing containers
  * System tests: confirm that -a and -l clash
  * systemd: compatible with rootless mode
  * system tests: CONTAINER_* and --help: cleanup
  * podman run --memory=0 ... should not set memory limit
  * Add information on how to discover default log driver
  * Add test for system connection
  * Generate Kube should not print default structs
  * libpod: change mountpoint ownership c.Root when using overlay on top of external rootfs
  * Change podman connection list to use default field
  * Allow API to specify size and inode quota
  * Use exponential backoff when waiting for a journal entry
  * Pod Rm Infra Improvements
  * system tests: socket activation: clean up
  * rootfs-overlay: fix overlaybase path for cleanups
  * Move CONTAINER_HOST and _CONNECTION to IsRemote Function
  * We should only be relabeling when on first run
  * If CONTAINER_HOST env variable is set default podman --remote=true
  * Set targetPort to the port value in the kube yaml
  * Do not add TCP to protocol in generated kube yaml
  * Use CGO_ENABLED=1 when building natively on darwin
  * Test-hang fix: Wait for ready + timeout on connect.
  * Checkpoint/Restore test fixes
  * Don't include ctr.log if not using file logging
  * Don't use docker/pkg/archive, use containers/storage/pkg/archive
  * Fix codespell errors
  * Adjust tests to verify all subcommands show the help message
  * Fix panic in container create compat api
  * Don't add image entrypoint to the generate kube yaml
  * Display help text on empty subcommand by default
  * podman search: display only name and description by default
  * codespell code
  * Add information about .containerignore to podman build man page
  * CNI: fix network create --ip-range
  * Kube Gen run as user/group issues
  * rootlessport: reduce memory usage of the process
  * No space in kube annotations for bind mounts
  * Fix CI flake on time of shutdown for API service
  * Refactor podman search to be more code friendly
  * Unit files: Use actual installed path for podman
  * Bump github.com/onsi/ginkgo from 1.16.4 to 1.16.5
  * cgroups: use cgroup.controllers to read controllers
  * builder: Add support for builder prune
  * Remove a volume with --force if container is running
  * Use SplitN(2) when copying env variables
  * podman stats: move cgroup validation to server
  * fix test
  * Support readonly rootfs contains colon
  * [CI:DOCS] oci-hooks.5.md: fixup section in header
  * Enable /debug/pprof API service endpoints
  * Not all fields in machine list were set properly
  * faster image inspection
  * Warn if podman stop timeout expires that sigkill was sent
  * [CI:DOCS] introduce --replace flag for play kube
  * [CI:DOCS] Include manifest example usage
  * Change podman.1 man page to show corret log-level default
  * Bump github.com/opencontainers/selinux from 1.8.5 to 1.9.1
  * Fixes #11668
  * libpod: fix race when closing STDIN
  * Ensure `podman ps --sync` functions
  * Allow `podman stop` to be run on Stopping containers
  * Bump github.com/containers/image/v5 from 5.16.0 to 5.16.1
  * Bump github.com/docker/docker
  * It really should be no **NEW** tests needed
  * README.md: Point to Podman's channels
  * Add podman-plugins to upstream image
  * CNI networks: reload networks if needed
  * bump c/common to latest and c/storage to 1.37.0
  * Add --time out for podman * rm  -f commands
  * Cirrus: Fix defunct package metadata breaking cache
  * Pod Events Logging Fix
  * [NO TESTS NEEDED] Ignore removed containers
  * Pod Volumes From Support
  * Add note about empty fields and null values for API responses
  * Bump github.com/containers/buildah from 1.23.0 to 1.23.1
  * Add podman play kube --no-hosts options
  * Gating tests: fix permissions error
  * pkg/specgen: cache image in generator
  * cirrus: gitlab: download packages
  * Add guard for BuildOptions.CommonBuildOpts
  * System tests: tighten 'is' operator
  * Update README and release notes for v3.4.0
  * sdnotify test: accept MAINPID anywhere
  * machine: silently cleanup dangling sockets before rm if possible
  * Add expose type map[uint16]string to description
  * [NO TESTS NEEDED] Fix typo in storage.conf file exists message
  * Support selinux options with bind mounts play/gen
  * kube: fix conversion from milliCPU to period/quota
  * Bump github.com/mattn/go-isatty from 0.0.12 to 0.0.14
  * test: use new helper
  * test: skip test on rootless cgroupsv1
  * machine: Info on successfully stopping qemu machine
  * Allow a value of -1 to set unlimited pids limit
  * Vendor in latest containers/storage
  * Storage can remove ErrNotAContainer as well
  * libpod: container create: init variable: do not deep copy spec
  * libpod: add GetConfigNoCopy()
  * libpod: add execSessionNoCopy
  * libpod: do not call (*container).Spec()
  * Pod Device-Read-BPS support
  * Remind user to check connection or use podman machine
  * Ensure pod ID bucket is properly updated on rename
  * Fix contributor make targets on Ubuntu and Debian
  * Implement PR template to assist review &amp; release
  * libpod: do not call (*container).Config()
  * [NO TESTS NEEDED] Add port configuration to first regular container
  * [CI:DOCS] cmd/podman: no dot for short descriptions
  * move network alias validation to container create
  * set --cni-config-dir for exit command
  * always add short container id as net alias
  * image prune: support removing external containers
  * System tests: speed up. They've gotten too slow.
  * Add dockerfile.5 as man link to containerfile man page
  * Set MSI to be 64-bit only.
  * fix podman network prune integration test flakes
  * Cirrus: Add gitlab podman runner test
  * CNI: network remove do not error for ENOENT
  * remote build: EvalSymlinks() the context directory
  * stop: Do nothing if container was never created in runtime
  * logging: new mode -l passthrough
  * Allow machine options to be set from containers.conf
  * Vendor in containers/common v0.46.0
  * podman machine: do not join userns
  * Disable docker and alias to podman in FCOS ignition
  * added healthcheck to ps command
  * Fix english on prune prompt
  * Document missing /images/search query parameters
  * rootful: do not set XDG_RUNTIME_DIR for cni plugins
  * Revert "rootful: unset XDG_RUNTIME_DIR"
  * Add completion for machine list format
  * Set context dir for play kube build
  * Makefile: use -ldflags/-gccgoflags depending on the go implemenatiton
  * Update docs for --platform in podman-build.1
  * shell completion: do not show images without tag
  * podman inspect add State.Health field for docker compat
  * podman save: enforce signature removal
  * Add JSON version of the machine list
  * Add support for :U flag with --mount option
  * [CI:DOCS] Add link to running ctrimage on enablesysadm
  * Ignore mount errors except ErrContainerUnknown when cleaningup container
  * standardize logrus messages to upper case
  * podman generate kube should not include images command
  * Fix machine image
  * sync container state before reading the healthcheck
  * Also show the (initial) disk size
  * Show cpus and memory in machine list
  * Eighty-six eighty-eighty
  * net types: remove omitempty from required fields
  * podman save: add `--uncompressed`
  * Bump CNI to v1.0.1
  * vendor c/psgo@v1.7.1
  * [CI:DOCS] Add network alias note in man pages
  * Add a backoff and retries to retrieving exited event
  * Cross-build release-archives w/ arch in filename
  * Fix Error, empty output for info: 'VERSION'
  * Generate kube should'd add podman default environment vars
  * volume: Add support for overlay on named volumes
  * Pod Device Support
  * Support --format tables in ps output
  * Remove references to kube being development
  * Add support for retrieving system service --timeout
  * Add podman image/container inspect man pages
  * [CI:DOCS] Add link to skopeo delete in podman rmi
  * vendor c/common@main
  * remote untag: support digests
  * Created MapOptions for PodCreate
  * Bump k8s.io/api from 0.22.1 to 0.22.2
  * compat API: /images/json prefix image id with sha256
  * podman machine: use gvproxy for host.containers.internal
  * utils: return error message from StartTransientUnit
  * utils: raise warning only on cgroupv2
  * Add podman machine init --now option
  * System tests: cleanup, and remove obsolete skips
  * Add username flag for machine ssh
  * Remove unused code from libpod
  * [CI:DOCS] markdown cleanup
  * Fix up build the docs site
  * Use a new markdown converter for sphinx
  * runtime: move pause process to scope
  * system: move MovePauseProcessToScope to utils
  * system: always move pause process when running on systemd
  * system: avoid reading pause pid file
  * Only add 127.0.0.1 entry to /etc/hosts with --net=none
  * Add no-trunc support to podman-events
  * CNI: add ipvlan driver
  * CNI: network create support macvlan modes
  * Do not allow network modes to be used as network names
  * fix inverted condition
  * Fix /auth compat endpoint
  * Add Drivers method to the Network Interface
  * CI: load ipv6 kernel modules for rootless tests
  * Drop OCICNI dependency
  * Wire network interface into libpod
  * cni network configs set ipv6 enables correctly
  * default network: do not validate the used subnets
  * network create: validate the input subnet
  * Set default storage from containers.conf for temporary images
  * container runlabel remove image tag from name
  * build.bats: fix copy tests after containers/buildah#3486
  * build: mirror --authfile to filesystem if pointing to FD instead of file
  * Fix example in podman machine init man page
  * vendor: Bump github.com/containers/buildah from 1.22.3 to 1.23.0
  * api: handle nil pointer dereference in rest endpoints
  * build: take advantage of --platform lists
  * Document `all` query parameter for /libpod/images/prune
  * Show variant and codename of the distribution
  * Use new aarch64 fcos repos
  * Enhance bindings for IDE hints
  * Pod Volumes Support
  * test: enable --cgroup-parent test
  * libpod: honor --cgroups=split also with pods
  * tests: enable --cgroups=disabled test for rootless
  * tests: simplify --cgroups=disabled test
  * libpod: rootful close binded ports
  * Search gvproxy with config.FindHelperBinary()
  * rootfs: Add support for rootfs-overlay and bump to buildah v1.22.1-0.202108
  * fix restart always with rootlessport
  * Cirrus: NM/CNI workaround + Remove prior-Ubuntu
  * If container exits with 125 podman should exit with 125
  * Bump github.com/json-iterator/go from 1.1.11 to 1.1.12
  * bump c/common to v0.44.0
  * remove rootlessport socket to prevent EADDRINUSE
  * Add deprecated fields for 1.22+ clients that still expect them
  * Use default username for podman machine ssh</changelog>
  <changelog author="michael@stroeder.com" date="1648814400">- Update to version 4.0.3:
  * Security
  - This release fixes CVE-2022-27649, where containers run by Podman would have excess inheritable capabilities set.
  * Changes
  - The podman machine rm --force command will now remove running machines as well (such machines are shut down first, then removed) (#13448).
  - When a podman machine VM is started that is using a too-old VM image, it will now start in a reduced functionality mode, and provide instructions on how to recreate it (previously, VMs were effectively unusable) (#13510).
  * Bugfixes
  - Fixed a bug where devices added to containers by the --device option to podman run and podman create would not be accessible within the container.
  - Fixed a bug where Podman would refuse to create containers when the working directory in the container was a symlink (#13346).
  - Fixed a bug where pods would be created with cgroups even if cgroups were disabled in containers.conf (#13411).
  - Fixed a bug where the podman play kube command would produce confusing errors if invalid YAML with duplicated container named was passed (#13332).
  - Fixed a bug where the podman machine rm command would not remove the Podman API socket on the host that was associated with the VM.
  - Fixed a bug where the remote Podman client was unable to properly resize the TTYs of containers on non-Linux OSes.
  - Fixed a bug where rootless Podman could hang indefinitely when starting containers on systems with IPv6 disabled (#13388).
  - Fixed a bug where the podman version command could sometimes print excess blank lines as part of its output.
  - Fixed a bug where the podman generate systemd command would sometimes generate systemd services with names beginning with a hyphen (#13272).
  - Fixed a bug where locally building the pause image could fail if the current directory contained a .dockerignore file (#13529).
  - Fixed a bug where root containers in VMs created by podman machine could not bind ports to specific IPs on the host (#13543).
  - Fixed a bug where the storage utilization percentages displayed by podman system df were incorrect (#13516).
  - Fixed a bug where the CPU utilization percentages displayed by podman stats were incorrect (#13597).
  - Fixed a bug where containers created with the --no-healthcheck option would still display healthcheck status in podman inspect (#13578).
  - Fixed a bug where the podman pod rm command could print a warning about a missing cgroup (#13382).
  - Fixed a bug where the podman exec command could sometimes print a timed out waiting for file error after the process in the container exited (#13227).
  - Fixed a bug where virtual machines created by podman machine were not tolerant of changes to the path to the qemu binary on the host (#13394).
  - Fixed a bug where the remote Podman client's podman build command did not properly handle the context directory if a Containerfile was manually specified using -f (#13293).
  - Fixed a bug where Podman would not properly detect the use of systemd as PID 1 in a container when the entrypoint was prefixed with /bin/sh -c (#13324).
  - Fixed a bug where rootless Podman could, on systems that do not use systemd as init, print a warning message about the rootless network namespace (#13703).
  - Fixed a bug where the default systemd unit file for podman system service did not delegate all cgroup controllers, resulting in podman info queries against the remote API returning incorrect cgroup controllers (#13710).
  - Fixed a bug where the slirp4netns port forwarder for rootless Podman would only publish the first port of a range (#13643).
  * API
  - Fixed a bug where the Compat Create API for containers did not properly handle permissions for tmpfs mounts (#13108).
  * Misc
  - The static binary for Linux is now built with CGo disabled to avoid panics due to a Golang bug (#13557).
  - Updated Buildah to v1.24.3
  - Updated the containers/storage library to v1.38.3
  - Updated the containers/image library to v5.19.2
  - Updated the containers/common library to v0.47.5</changelog>
  <changelog author="fvogt@suse.com" date="1649332800">- Add patch to fix starting containers on btrfs with SELinux
  (gh#opencontainers/selinux#172):
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
- Add patch to fix starting containers as user service with systemd 250
  (boo#1197672, gh#containers/podman#13731):
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch</changelog>
  <changelog author="fvogt@suse.com" date="1649332801">- Add patch to make buildah happy after selinux change:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch</changelog>
  <changelog author="rbrown@suse.com" date="1649764800">- Require catatonit &gt;= 0.1.7 for pause functionality needed by pods</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport upstream commit be5abf03ababc ("fix: Container.cGroupPath()
  skip empty line to avoid false error logging") for fixing "Error parsing
  cgroup: expected 3 fields but got 1" (see bsc#1199790, as it applies
  to Factory/Tumbleweed too)
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="rbrown@suse.com" date="1655899200">- Update to version 4.1.1:
  * The output of the podman load command now mirrors that of docker load.
  * Podman now supports Docker Compose v2.2 and higher. Please note that it may be necessary to disable the use of Buildkit by setting the environment variable DOCKER_BUILDKIT=0.
  * A new container command has been added, podman container clone. This command makes a copy of an existing container, with the ability to change some settings (e.g. resource limits) while doing so.
  * Podman now supports sending JSON events related to machines to a Unix socket named machine_events.*\.sock in XDG_RUNTIME_DIR/podman or to a socket whose path is set in the PODMAN_MACHINE_EVENTS_SOCK environment variable.
  * Two new volume commands have been added, podman volume mount and podman volume unmount. These allow for Podman-managed named volumes to be mounted and accessed from outside containers.
  * The podman container checkpoint and podman container restore options now support checkpointing to and restoring from OCI images. This allows checkpoints to be distributed via standard image registries.
  * The podman play kube command now supports environment variables that are specified using the fieldRef and resourceFieldRef sources.
  * The podman play kube command will now set default resource limits when the provided YAML does not include them.
  * The podman play kube command now supports a new option, --annotation, to add annotations to created containers.
  * The podman play kube --build command now supports a new option, --context-dir, which allows the user to specify the context directory to use when building the Containerfile.
  * The podman container commit command now supports a new option, --squash, which squashes the generated image into a single layer.
  * The podman pod logs command now supports two new options, --names, which identifies which container generated a log message by name, instead of ID and --color, which colors messages based on what container generated them.
  * The podman rmi command now supports a new option, --ignore, which will ignore errors caused by missing images.
  * The podman network create command now features a new option, --ipam-driver, to specify details about how IP addresses are assigned to containers in the network.
  * The podman machine list command now features a new option, --quiet, to print only the names of configured VMs and no other information.
  * The --ipc option to the podman create, podman run, and podman pod create commands now supports three new modes: none, private, and shareable. The default IPC mode is now shareable, indicating the the IPC namespace can be shared with other containers.
  * The --mount option to the podman create and podman run commands can now set options for created named volumes via the volume-opt parameter.
  * The --mount option to the podman create and podman run commands now allows parameters to be passed in CSV format.
  * The --userns option to the podman create and podman run commands now supports a new option, nomap, that (only for rootless containers) does not map the UID of the user that started the container into the container, increasing security.
  * The podman import command now supports three new options, --arch, --os, and --variant, to specify what system the imported image was built for.
  * The podman inspect command now includes information on the network configuration of containers that joined a pre-configured network namespace with the --net ns: option to podman run, podman create, and podman pod create.
  * The podman run and podman create commands now support a new option, --chrootdirs, which specifies additional locations where container-specific files managed by Podman (e.g. /etc/hosts, `/etc/resolv.conf, etc) will be mounted inside the container (#12961).
  * The podman run and podman create commands now support a new option, --passwd-entry, allowing entries to be added to the container's /etc/passwd file.
  * The podman images --format command now accepts two new format directives: {{.CreatedAt}} and {{.CreatedSince}}.
  * The podman volume create command's -o option now accepts a new argument, o=noquota, to disable XFS quotas entirely and avoid potential issues when Podman is run on an XFS filesystem with existing quotas defined.
  * The podman info command now includes additional information on the machine Podman is running on, including disk utilization on the drive Podman is storing containers and images on, and CPU utilization.
  * Fix CVE-2022-27191 / bsc#1197284
- Drop obsolete patches:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="predivan@mts.rs" date="1656676800">- Fix build on Leap
    Use libexec macro to set correct, per-distribution specific, directory.</changelog>
  <changelog author="michael@stroeder.com" date="1660219200">- Update to version 4.2.0:
  * Features
  - Podman now supports the Gitlab Runner (using the Docker executor), allowing its use in Gitlab CI/CD pipelines.
  - A new command has been added, podman pod clone, to create a copy of an existing pod. It supports several options, including --start to start the new pod, --destroy to remove the original pod, and --name to change the name of the new pod (#12843).
  - A new command has been added, podman volume reload, to sync changes in state between Podman's database and any configured volume plugins (#14207).
  - A new command has been added, podman machine info, which displays information about the host and the versions of various machine components.
  - Pods created by podman play kube can now be managed by systemd unit files. This can be done via a new systemd service, podman-kube@.service - e.g. systemctl --user start podman-play-kube@$(systemd-escape my.yaml).service will run the Kubernetes pod or deployment contained in my.yaml under systemd.
  - The podman play kube command now honors the RunAsUser, RunAsGroup, and SupplementalGroups setting from the Kubernetes pod's security context.
  - The podman play kube command now supports volumes with the BlockDevice and CharDevice types (#13951).
  - The podman play kube command now features a new flag, --userns, to set the user namespace of created pods. Two values are allowed at present: host and auto (#7504).
  - The podman play kube command now supports setting the type of created init containers via the io.podman.annotations.init.container.type annotation.
  - Pods now have include an exit policy (configurable via the --exit-policy option to podman pod create), which determines what will happen to the pod's infra container when the entire pod stops. The default, continue, acts as Podman currently does, while a new option, stop, stops the infra container after the last container in the pod stops, and is used by default for pods from podman play kube (#13464).
  - The podman pod create command now allows the pod's name to be specified as an argument, instead of using the --name option - for example, podman pod create mypod instead of the prior podman pod create --name mypod. Please note that the --name option is not deprecated and will continue to work.
  - The podman pod create command's --share option now supports adding namespaces to the set by prefacing them with + (as opposed to specifying all namespaces that should be shared) (#13422).
  - The podman pod create command has a new option, --shm-size, to specify the size of the /dev/shm mount that will be shared if the pod shares its UTS namespace (#14609).
  - The podman pod create command has a new option, --uts, to configure the UTS namespace that will be shared by containers in the pod.
  - The podman pod create command now supports setting pod-level resource limits via the --cpus, --cpuset-cpus, and --memory options. These will set a limit for all containers in the pod, while individual containers within the pod are allowed to set further limits. Look forward to more options for resource limits in our next release!
  - The podman create and podman run commands now include the -c short option for the --cpu-shares option.
  - The podman create and podman run commands can now create containers from a manifest list (and not an image) as long as the --platform option is specified (#14773).
  - The podman build command now supports a new option, --cpp-flag, to specify options for the C preprocessor when using Containerfile.in files that require preprocessing.
  - The podman build command now supports a new option, --build-context, allowing the user to specify an additional build context.
  - The podman machine inspect command now prints the location of the VM's Podman API socket on the host (#14231).
  - The podman machine init command on Windows now fetches an image with packages pre-installed (#14698).
  - Unused, cached Podman machine VM images are now cleaned up automatically. Note that because Podman now caches in a different directory, this will not clean up old images pulled before this change (#14697).
  - The default for the --image-volume option to podman run and podman create can now have its default set through the image_volume_mode setting in containers.conf (#14230).
  - Overlay volumes now support two new options, workdir and upperdir, to allow multiple overlay volumes from different containers to reuse the same workdir or upperdir (#14427).
  - The podman volume create command now supports two new options, copy and nocopy, to control whether contents from the overmounted folder in a container will be copied into the newly-created named volume (copy-up).
  - Volumes created using a volume plugin can now specify a timeout for all operations that contact the volume plugin (replacing the standard 5 second timeout) via the --opt o=timeout= option to podman volume create (BZ 2080458).
  - The podman volume ls command's --filter name= option now supports regular expression matching for volume names (#14583).
  - When used with a podman machine VM, volumes now support specification of the 9p security model using the security_model option to podman create -v and podman run -v.
  - The remote Podman client's podman push command now supports the --remove-signatures option (#14558).
  - The remote Podman client now supports the podman image scp command.
  - The podman image scp command now supports tagging the transferred image with a new name.
  - The podman network ls command supports a new filter, --filter dangling=, to list networks not presently used by any containers (#14595).
  - The --condition option to podman wait can now be specified multiple times to wait on any one of multiple conditions.
  - The podman events command now includes the -f short option for the --filter option.
  - The podman pull command now includes the -a short option for the --all-tags option.
  - The podman stop command now includes a new flag, --filter, to filter which containers will be stopped (e.g. podman stop --all --filter label=COM.MY.APP).
  - The Podman global option --url now has two aliases: -H and --host.
  - The podman network create command now supports a new option with the default bridge driver, --opt isolate=, which isolates the network by blocking any traffic from it to any other network with the isolate option enabled. This option is enabled by default for networks created using the Docker-compatible API.
  - Added the ability to create sigstore signatures in podman push and podman manifest push.
  - Added an option to read image signing passphrase from a file.
  * Changes
  - Paused containers can now be killed with the podman kill command.
  - The podman system prune command now removes unused networks.
  - The --userns=keep-id and --userns=nomap options to the podman run and podman create commands are no longer allowed (instead of simply being ignored) with root Podman.
  - If the /run directory for a container is part of a volume, Podman will not create the /run/.containerenv file (#14577).
  - The podman machine stop command on macOS now waits for the machine to be completely stopped to exit (#14148).
  - All podman machine commands now only support being run as rootless, given that VMs only functioned when run rootless.
  - The podman unpause --all command will now only attempt to unpause containers that are paused, not all containers.
  - Init containers created with podman play kube now default to the once type (#14877).
  - Pods created with no shared namespaces will no longer create an infra container unless one is explicitly requested (#15048).
  - The podman create, podman run, and podman cp commands can now autocomplete paths in the image or container via the shell completion.
  - The libpod/common package has been removed as it's not used anywhere.
  - The --userns option to podman create and podman run is no longer accepted when an explicit UID or GID mapping is specified (#15233).
  * Bugfixes
  - Fixed a bug where bind-mounting /dev into a container which used the --init flag would cause the container to fail to start (#14251).
  - Fixed a bug where the podman image mount command would not pretty-print its output when multiple images were mounted.
  - Fixed a bug where the podman volume import command would print an unrelated error when attempting to import into a nonexistent volume (#14411).
  - Fixed a bug where the podman system reset command could race against other Podman commands (#9075).
  - Fixed a bug where privileged containers were not able to restart if the layout of host devices changed (#13899).
  - Fixed a bug where the podman cp command would overwrite directories with non-directories and vice versa. A new --overwrite flag to podman cp allows for retaining the old behavior if needed (#14420).
  - Fixed a bug where the podman machine ssh command would not preserve the exit code from the command run via ssh (#14401).
  - Fixed a bug where VMs created by podman machine would fail to start when created with more than 3072MB of RAM on Macs with M1 CPUs (#14303).
  - Fixed a bug where the podman machine init command would fail when run from C:\Windows\System32 on Windows systems (#14416).
  - Fixed a bug where the podman machine init --now did not respect proxy environment variables (#14640).
  - Fixed a bug where the podman machine init command would fail if there is no $HOME/.ssh dir (#14572).
  - Fixed a bug where the podman machine init command would add a connection even if creating the VM failed (#15154).
  - Fixed a bug where interrupting the podman machine start command could render the VM unable to start.
  - Fixed a bug where the podman machine list --format command would still print a heading.
  - Fixed a bug where the podman machine list command did not properly set the Starting field (#14738).
  - Fixed a bug where the podman machine start command could fail to start QEMU VMs when the machine name started with a number.
  - Fixed a bug where Podman Machine VMs with proxy variables could not be started more than once (#14636 and #14837).
  - Fixed a bug where containers created using the Podman API would, when the Podman API service was managed by systemd, be killed when the API service was stopped (BZ 2052697).
  - Fixed a bug where the podman -h command did not show help output.
  - Fixed a bug where the podman wait command (and the associated REST API endpoint) could return before a container had fully exited, breaking some tools like the Gitlab Runner.
  - Fixed a bug where healthchecks generated exec events, instead of health_status events (#13493).
  - Fixed a bug where the podman pod ps command could return an error when run at the same time as podman pod rm (#14736).
  - Fixed a bug where the podman systemd df command incorrectly calculated reclaimable storage for volumes (#13516).
  - Fixed a bug where an exported container checkpoint using a non-default OCI runtime could not be restored.
  - Fixed a bug where Podman, when used with a recent runc version, could not remove paused containers.
  - Fixed a bug where the remote Podman client's podman manifest rm command would remove images, not manifests (#14763).
  - Fixed a bug where Podman did not correctly parse wildcards for device major number in the podman run and podman create commands' --device-cgroup-rule option.
  - Fixed a bug where the podman play kube command on 32 bit systems where the total memory was calculated incorrectly (#14819).
  - Fixed a bug where the podman generate kube command could set ports and hostname incorrectly in generated YAML (#13030).
  - Fixed a bug where the podman system df --format "{{ json . }}" command would not output the Size and Reclaimable fields (#14769).
  - Fixed a bug where the remote Podman client's podman pull command would display duplicate progress output.
  - Fixed a bug where the podman system service command could leak memory when a client unexpectedly closed a connection when reading events or logs (#14879).
  - Fixed a bug where Podman containers could fail to run if the image did not contain an /etc/passwd file (#14966).
  - Fixed a bug where the remote Podman client's podman push command did not display progress information (#14971).
  - Fixed a bug where a lock ordering issue could cause podman pod rm to deadlock if it was run at the same time as a command that attempted to lock multiple containers at once (#14929).
  - Fixed a bug where the podman rm --force command would exit with a non-0 code if the container in question did not exist (#14612).
  - Fixed a bug where the podman container restore command would fail when attempting to restore a checkpoint for a container with the same name as an image (#15055).
  - Fixed a bug where the podman manifest push --rm command could remove image, instead of manifest lists (#15033).
  - Fixed a bug where the podman run --rm command could fail to remove the container if it failed to start (#15049).
  - Fixed a bug where the podman generate systemd --new command would create incorrect unit files when the container was created with the --sdnotify parameter (#15052).
  - Fixed a bug where the podman generate systemd --new command would fail when -h &lt;hostname&gt; was used to create the container (#15124).
  * API
  - The Docker-compatible API now supports API version v1.41 (#14204).
  - Fixed a bug where containers created via the Libpod API had an incorrect umask set (#15036).
  - Fixed a bug where the remote parameter to the Libpod API's Build endpoint for Images was nonfunctional (#13831).
  - Fixed a bug where the Libpod List endpoint for Containers did not return the application/json content type header when there were no containers present (#14647).
  - Fixed a bug where the Compat Stats endpoint for Containers could return incorrect memory limits (#14676).
  - Fixed a bug where the Compat List and Inspect endpoints for Containers could return incorrect strings for container status.
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle disabling healthchecks (#14493).
  - Fixed a bug where the Compat Create endpoint for Networks did not support the mtu, name, mode, and parent options (#14482).
  - Fixed a bug where the Compat Create endpoint for Networks did not allow the creation of networks name bridge (#14983).
  - Fixed a bug where the Compat Inspect endpoint for Networks did not properly set netmasks in the SecondaryIPAddresses and SecondaryIPv6Addresses fields (#14674).
  - The Libpod Stats endpoint for Pods now supports streaming output via two new parameters, stream and delay (#14674).
  * Misc
  - Podman will now check for nameservers in /run/NetworkManager/no-stub-resolv.conf if the /etc/resolv.conf file only contains a localhost server.
  - The podman build command now supports caching with builds that specify --squash-all by allowing the --layers flag to be used at the same time.
  - Podman Machine support for QEMU installations at non-default paths has been improved.
  - The podman machine ssh command no longer prints spurious warnings every time it is run.
  - When accessing the WSL prompt on Windows, the rootless user will be preferred.
  - The podman info command now includes a field for information on supported authentication plugins for improved Docker compatibility. Authentication plugins are not presently supported by Podman, so this field is always empty.
  - The podman system prune command now no longer prints the Deleted Images header if no images were pruned.
  - The podman system service command now automatically creates and moves to a sub-cgroup when running in the root cgroup (#14573).
  - Updated Buildah to v1.27.0 (fixes CVE-2022-21698 / bsc#1196338)
  - Updated the containers/image library to v5.22.0
  - Updated the containers/storage library to v1.42.0 (fixes bsc#1196751)
  - Updated the containers/common library to v0.49.1
  - Podman will automatically create a sub-cgroup and move itself into it when it detects that it is running inside a container (#14884).
  - Fixed an incorrect release note about regexp.
  - A new MacOS installer (via pkginstaller) is now supported.</changelog>
  <changelog author="asarai@suse.com" date="1663761600">- Update to version 4.2.1:
  * Bump to v4.2.1
  * Add release notes for v4.2.1
  * remove SkipIfNotFedora() from events test
  * fix podman events with custom format
  * Drop stale config value resulting in asymmetric config
  * Fix list of default capabilities
  * Add container GID to additional groups (CVE-2022-2989 / bsc#1202809, removes patch 0001-Add-container-GID-to-additional-groups.patch)
  * libpod: Ensure that generated container names are random
  * Fix bind-mount-option annotation in gen/play kube
  * Improved Windows compatibility for machine command
  * updated apiv2 tests to reflect hash compat fix
  * api: return imageID instead of imageName, for "Image" when Podman API is queried
  * Inhibit SIGTERM during Conmon startup
  * Fix example sections to follow the same format
  * Fix template name inconsistency
  * service: make move to sub-cgroup non fatal
  * Remove duplicate annotations in generated service yaml
  * Compat API image remove events now have 'delete' status
  * [CI:DOCS] Automatically set podman version in pkginstaller
  * Allow colons in windows file paths
  * Fixes isRootfull check using qemu machine on Windows
  * vendor containers/psgo@v1.7.3
  * Allow podman to run in an environment with keys containing spaces
  * Document restrictions on transport in FROM
  * Improved Windows compatibility
  * pass environment variables to container clone
  * podman save: update --compress validation
  * sort hc.Binds returned from compat api
  * Cirrus: Update podman-machine comment
  * podman images and friends can take one image as argument
  * [CI:DOCS] Add .DS_Store to gitignore
  * podman-kube@.service.in: Remove Restart=never option with typo
  * Fix #15499 already connected network
  * [CI:DOCS] Cirrus: Update meta-task for EC2 image
  * fix CI: remove hardcodeded alpine version
  * fix CI: remove hardcodeded alpine version
  * Preserve all unknown PolicyRequirement fields on (podman image trust set)
  * Reorganize the types in policy.go a bit
  * Add support for showing keyPaths in (podman image trust show)
  * Support (image trust show) for sigstoreSigned entries
  * BREAKING CHANGE: Change how (podman image trust show) represents multiple requirements
  * Reorganize descriptionsOfPolicyRequirements a bit
  * Use the full descriptionsOfPolicyRequirements for the default scope
  * Rename haveMatchRegistry to registriesDConfigurationForScope
  * Rename tempTrustShowOutput to entry
  * Split descriptionsOfPolicyRequirements out of getPolicyShowOutput
  * Recognize the new lookaside names for simple signing sigstore
  * Add a unit test for trust.PolicyDescription
  * Make the output of (podman image trust show) deterministic
  * Make most of pkg/trust package-private
  * Move most of ImageEngine.ShowTrust into pkg/trust.PolicyDescription
  * Add support for sigstoreSigned in (podman image trust set)
  * Create new policy entries together with validating input
  * Improve validation of data in ImageEngine.SetTrust
  * Move most of imageEngine.SetTrust to pkg/trust.AddPolicyEntries
  * Add a variable for scope
  * Make trust.CreateTempFile private
  * Reorganize pkg/trust
  * Remove an unused trust.ShowOutput type
  * Remove commented out code
  * libpod: UpdateContainerStatus: do not wait for container
  * Skip / update some tests under runc
  * Bump to v4.2.1-dev
  * test: update apply-podman-deltas for new tests
  * build: implement --cache-to,--cache-from and --cache-ttl
  * vendor: bump buildah to v1.27.0</changelog>
  <changelog author="dcermak@suse.com" date="1669118400">- switch to building with go 1.17
- use %%make_* macros
- drop /usr/share/user-tmpfiles.d/podman-docker.conf on SLE &amp; Leap
- remove rpmlintrc (contained only obsolete filters)
- remove obsolete with_libostree (we don't build on anything older than SLE 15)
- add patch: 0001-Revert-Default-missing-hostPort-to-containerPort-is-.patch
  (hotfix for https://github.com/containers/podman/issues/16765)
- Update to version 4.3.1:
  4.3.1:
  [#]## Bugfixes
- Fixed a deadlock between the `podman ps` and `podman container inspect` commands
  [#]## Misc
- Updated the containers/image library to v5.23.1
  4.3.0:
  [#]## Features
- A new command, `podman generate spec`, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
- A new command, `podman update`, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted ([#15067](https://github.com/containers/podman/issues/15067)).
- A new command, `podman kube down`, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to `podman kube play --down`, but it now has its own command).
- The `podman kube play` command now supports Kubernetes secrets using Podman's secrets backend.
- Systemd-managed pods created by the `podman kube play` command now integrate with sd-notify, using the `io.containers.sdnotify` annotation (or `io.containers.sdnotify/$name` for specific containers).
- Systemd-managed pods created by `podman kube play` can now be auto-updated, using the `io.containers.auto-update` annotation (or `io.containers.auto-update/$name` for specific containers).
- The `podman kube play` command can now read YAML from URLs, e.g. `podman kube play https://example.com/demo.yml` ([#14955](https://github.com/containers/podman/issues/14955)).
- The `podman kube play` command now supports the `emptyDir` volume type ([#13309](https://github.com/containers/podman/issues/13309)).
- The `podman kube play` command now supports the `HostUsers` field in the pod spec.
- The `podman play kube` command now supports `binaryData` in ConfigMaps.
- The `podman pod create` command can now set additional resource limits for pods using the new `--memory-swap`, `--cpuset-mems`, `--device-read-bps`, `--device-write-bps`, `--blkio-weight`, `--blkio-weight-device`, and `--cpu-shares` options.
- The `podman machine init` command now supports a new option, `--username`, to set the username that will be used to connect to the VM as a non-root user ([#15402](https://github.com/containers/podman/issues/15402)).
- The `podman volume create` command's `-o timeout=` option can now set a timeout of 0, indicating volume plugin operations will never time out.
- Added support for a new volume driver, `image`, which allows volumes to be created that are backed by images.
- The `podman run` and `podman create` commands support a new option, `--env-merge`, allowing environment variables to be specified relative to other environment variables in the image (e.g. `podman run --env-merge "PATH=$PATH:/my/app" ...`) ([#15288](https://github.com/containers/podman/issues/15288)).
- The `podman run` and `podman create` commands support a new option, `--on-failure`, to allow action to be taken when a container fails health checks, with the following supported actions: `none` (take no action, the default), `kill` (kill the container), `restart` (restart the container), and `stop` (stop the container).
- The `--keep-id` option to `podman create` and `podman run` now supports new options, `uid` and `gid`, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. `--userns=keep-id:uid=11` will made the user running Podman to UID 11 in the container) ([#15294](https://github.com/containers/podman/issues/15294)).
- The `podman generate systemd` command now supports a new option, `--env`/`-e`, to set environment variables in the generated unit file ([#15523](https://github.com/containers/podman/issues/15523)).
- The `podman pause` and `podman unpause` commands now support the `--latest`, `--cidfile`, and `--filter` options.
- The `podman restart` command now supports the `--cidfile` and `--filter` options.
- The `podman rm` command now supports the `--filter` option to select which containers will be removed.
- The `podman rmi` command now supports a new option, `--no-prune`, to prevent the removal of dangling parents of removed images.
- The `--dns-opt` option to `podman create`, `podman run`, and `podman pod create` has received a new alias, `--dns-option`, to improve Docker compatibility.
- The `podman` command now features a new global flag, `--debug`/`-D`, which enables debug-level logging (identical to `--log-level=debug`), improving Docker compatibility.
- The `podman` command now features a new global flag, `--config`. This flag is ignored, and is only included for Docker compatibility ([#14767](https://github.com/containers/podman/issues/14767)).
- The `podman manifest create` command now accepts a new option, `--amend`/`-a`.
- The `podman manifest create`, `podman manifest add` and `podman manifest push` commands now accept a new option, `--insecure` (identical to `--tls-verify=false`), improving Docker compatibility.
- The `podman secret create` command's `--driver` and `--format` options now have new aliases, `-d` for `--driver` and `-f` for `--format`.
- The `podman secret create` command now supports a new option, `--label`/`-l`, to add labels to created secrets.
- The `podman secret ls` command now accepts the `--quiet`/`-q` option.
- The `podman secret inspect` command now accepts a new option, `--pretty`, to print output in human-readable format.
- The `podman stats` command now accepts the `--no-trunc` option.
- The `podman save` command now accepts the `--signature-policy` option ([#15869](https://github.com/containers/podman/issues/15869)).
- The `podman pod inspect` command now allows multiple arguments to be passed. If so, it will return a JSON array of the inspected pods ([#15674](https://github.com/containers/podman/issues/15674)).
- A series of new hidden commands have been added under `podman context` as aliases to existing `podman system connection` commands, to improve Docker compatibility.
- The remote Podman client now supports proxying signals for attach sessions when the `--sig-proxy` option is set ([#14707](https://github.com/containers/podman/issues/14707)).
  [#]## Changes
- Duplicate volume mounts are now allowed with the `-v` option to `podman run`, `podman create`, and `podman pod create`, so long as source, destination, and options all match ([#4217](https://github.com/containers/podman/issues/4217)).
- The `podman generate kube` and `podman play kube` commands have been renamed to `podman kube generate` and `podman kube play` to group Kubernetes-related commands. Aliases have been added to ensure the old command names still function.
- A number of Podman commands (`podman init`, `podman container checkpoint`, `podman container restore`, `podman container cleanup`) now print the user-inputted name of the container, instead of its full ID, on success.
- When an unsupported option (e.g. resource limit) is specified for a rootless container on a cgroups v1 system, a warning message is now printed that the limit will not be honored.
- The installer for the Windows Podman client has been improved.
- The `--cpu-rt-period` and `--cpu-rt-runtime` options to `podman run` and `podman create` now print a warning and are ignored on cgroups v2 systems (cgroups v2 having dropped support for these controllers) ([#15666](https://github.com/containers/podman/issues/15666)).
- Privileged containers running systemd will no longer mount `/dev/tty*` devices other than `/dev/tty` itself into the container ([#15878](https://github.com/containers/podman/issues/15878)).
- Events for containers that are part of a pod now include the ID of the pod in the event.
- SSH functionality for `podman machine` commands has seen a thorough rework, addressing many issues about authentication.
- The `--network` option to `podman kube play` now allows passing `host` to set the pod to use host networking, even if the YAML does not request this.
- The `podman inspect` command on containers now includes the digest of the image used to create the container.
- Pods created by `podman play kube` are now, by default, placed into a network named `podman-kube`. If the `podman-kube` network does not exist, it will be created. This ensures pods can connect to each other by their names, as the network has DNS enabled.
  [#]## Bugfixes
- Fixed a bug where the `podman network prune` and `podman container prune` commands did not properly support the `--filter label!=` option ([#14182](https://github.com/containers/podman/issues/14182)).
- Fixed a bug where the `podman kube generate` command added an unnecessary `Secret: null` line to generated YAML ([#15156](https://github.com/containers/podman/issues/15156)).
- Fixed a bug where the `podman kube generate` command did not set `enableServiceLinks` and `automountServiceAccountToken` to false in generated YAML ([#15478](https://github.com/containers/podman/issues/15478) and [#15243](https://github.com/containers/podman/issues/15243)).
- Fixed a bug where the `podman kube play` command did not properly handle CPU limits ([#15726](https://github.com/containers/podman/issues/15726)).
- Fixed a bug where the `podman kube play` command did not respect default values for liveness probes ([#15855](https://github.com/containers/podman/issues/15855)).
- Fixed a bug where the `podman kube play` command did not bind ports if `hostPort` was not specified but `containerPort` was ([#15942](https://github.com/containers/podman/issues/15942)).
- Fixed a bug where the `podman kube play` command sometimes did not create directories on the host for `hostPath` volumes.
- Fixed a bug where the remote Podman client's `podman manifest push` command did not display progress.
- Fixed a bug where the `--filter "{{.Config.Healthcheck}}"` option to `podman image inspect` did not print the image's configured healthcheck ([#14661](https://github.com/containers/podman/issues/14661)).
- Fixed a bug where the `podman volume create -o timeout=` option could be specified even when no volume plugin was in use.
- Fixed a bug where the `podman rmi` command did not emit `untag` events when removing tagged images ([#15485](https://github.com/containers/podman/issues/15485)).
- Fixed a bug where API forwarding with `podman machine` VMs on windows could sometimes fail because the pipe was not created in time ([#14811](https://github.com/containers/podman/issues/14811)).
- Fixed a bug where the `podman pod rm` command could error if removal of a container in the pod was interrupted by a reboot.
- Fixed a bug where the `exited` and `exec died` events for containers did not include the container's labels ([#15617](https://github.com/containers/podman/issues/15617)).
- Fixed a bug where running Systemd containers on a system not using Systemd as PID 1 could fail ([#15647](https://github.com/containers/podman/issues/15647)).
- Fixed a bug where Podman did not pass all necessary environment variables (including `$PATH`) to Conmon when starting containers ([#15707](https://github.com/containers/podman/issues/15707)).
- Fixed a bug where the `podman events` command could function improperly when no events were present ([#15688](https://github.com/containers/podman/issues/15688)).
- Fixed a bug where the `--format` flag to various Podman commands did not properly handle template strings including a newline (`\n`) ([#13446](https://github.com/containers/podman/issues/13446)).
- Fixed a bug where Systemd-managed pods would kill every container in a pod when a single container exited ([#14546](https://github.com/containers/podman/issues/14546)).
- Fixed a bug where the `podman generate systemd` command would generate incorrect YAML for pods created without the `--name` option.
- Fixed a bug where the `podman generate systemd --new` command did not properly set stop timeout ([#16149](https://github.com/containers/podman/issues/16149)).
- Fixed a bug where a broken OCI spec resulting from the system rebooting while a container is being started could cause the `podman inspect` command to be unable to inspect the container until it was restarted.
- Fixed a bug where creating a container with a working directory on an overlay volume would result in the container being unable to start ([#15789](https://github.com/containers/podman/issues/15789)).
- Fixed a bug where attempting to remove a pod with running containers without `--force` would not error and instead would result in the pod, and its remaining containers, being placed in an unusable state ([#15526](https://github.com/containers/podman/issues/15526)).
- Fixed a bug where memory limits reported by `podman stats` could exceed the maximum memory available on the system ([#15765](https://github.com/containers/podman/issues/15765)).
- Fixed a bug where the `podman container clone` command did not properly handle environment variables whose value contained an `=` character ([#15836](https://github.com/containers/podman/issues/15836)).
- Fixed a bug where the remote Podman client would not print the container ID when running the `podman-remote run --attach stdin` command.
- Fixed a bug where the `podman machine list --format json` command did not properly show machine starting status.
- Fixed a bug where automatic updates would not error when attempting to update a container with a non-fully qualified image name ([#15879](https://github.com/containers/podman/issues/15879)).
- Fixed a bug where the `podman pod logs --latest` command could panic ([#15556](https://github.com/containers/podman/issues/15556)).
- Fixed a bug where Podman could leave lingering network namespace mounts on the system if cleaning up the network failed.
- Fixed a bug where specifying an unsupported URI scheme for `podman system service` to listen at would result in a panic.
- Fixed a bug where the `podman kill` command would sometimes not transition containers to the exited state ([#16142](https://github.com/containers/podman/issues/16142)).
  [#]## API
- Fixed a bug where the Compat DF endpoint reported incorrect reference counts for volumes ([#15720](https://github.com/containers/podman/issues/15720)).
- Fixed a bug in the Compat Inspect endpoint for Networks where an incorrect network option was displayed, causing issues with `docker-compose` ([#15580](https://github.com/containers/podman/issues/15580)).
- The Libpod Restore endpoint for Containers now features a new query parameter, `pod`, to set the pod that the container will be restored into ([#15018](https://github.com/containers/podman/issues/15018)).
- Fixed a bug where the REST API could panic while retrieving images.
- Fixed a bug where a cancelled connection to several endpoints could induce a memory leak.
  [#]## Misc
- Error messages when attempting to remove an image used by a non-Podman container have been improved ([#15006](https://github.com/containers/podman/issues/15006)).
- Podman will no longer print a warning that `/` is not a shared mount when run inside a container ([#15295](https://github.com/containers/podman/issues/15295)).
- Work is ongoing to port Podman to FreeBSD.
- The output of `podman generate systemd` has been adjusted to improve readability.
- A number of performance improvements have been made to `podman create` and `podman run`.
- A major reworking of the manpages to ensure duplicated options between commands have the same description text has been performed.
- Updated Buildah to v1.28.0
- Updated the containers/image library to v5.23.0
- Updated the containers/storage library to v1.43.0
- Updated the containers/common library to v0.50.1</changelog>
</package>
<package pkgid="a5c7887f524f767d35e18cc69f1b461d0893aadfedc08b1d7b0a6714ac19fc4b" name="procps" arch="aarch64">
  <version epoch="0" ver="3.3.15" rel="150000.7.28.1"/>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
  <changelog author="werner@suse.de" date="1671105600">- Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412)
- Make sure that correct library version is installed (bsc#1206412)</changelog>
</package>
<package pkgid="ea6a4d83252dc5523ccdd55e8e54502595dfb47d80f8d3c0e7a04abd691a4aef" name="procps" arch="src">
  <version epoch="0" ver="3.3.15" rel="150000.7.28.1"/>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
  <changelog author="werner@suse.de" date="1671105600">- Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412)
- Make sure that correct library version is installed (bsc#1206412)</changelog>
</package>
<package pkgid="169e6309fb8f6761e46704599c63fb70a5ed86978373ffc261beafc4450fb8dc" name="procps" arch="x86_64">
  <version epoch="0" ver="3.3.15" rel="150000.7.28.1"/>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
  <changelog author="werner@suse.de" date="1671105600">- Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412)
- Make sure that correct library version is installed (bsc#1206412)</changelog>
</package>
<package pkgid="884819dfce950c254f3fa95d6b5c7c579d5d65e8bfdd4391a093d8568eee1057" name="python-cairo" arch="src">
  <version epoch="0" ver="1.15.1" rel="150000.3.8.1"/>
  <changelog author="maw@suse.de" date="1172491200">- Don't package _cairo.la (#223703).</changelog>
  <changelog author="hpj@suse.de" date="1207224000">- Upgraded to version 1.4.12:
  * mingw32 compiler fixes.
  * New methods added.
  * The module cairo.gtk has been removed.
  * Allow cairo.Context to be subclassed.</changelog>
  <changelog author="jpr@suse.de" date="1216382400">- Remove libsvg-cairo-devel from BuildRequires, it hasn't been
  needed for a long time</changelog>
  <changelog author="maw@suse.de" date="1221220800">- Update to version 1.6.4:
  + Bugs fixed: bfo#16112
  + New methods: Context.has_current_point, Context.path_extents,
    ImageSurface.format_stride_for_width, PSSurface.get_eps,
    PSSurface.set_eps, PSSurface.ps_level_to_string,
    PSSurface.restrict_to_level, Surface.copy_page, and
    Surface.show_page
  + New Constants: cairo.PS_LEVEL_2, cairo.PS_LEVEL_3
  + Updated examples.</changelog>
  <changelog author="mboman@suse.de" date="1230120000">- Update to version 1.8.0:
  + General Changes:
  - Pycairo 1.8.0 requires cairo 1.8.0 (or later).
  - Add documentation (available separately)
  + Bug Fixes:
  - bfo#18101: Add support for threading
  - bfo#18947: cairo.SurfacePattern should INCREF the used surface
  + New Methods:
  - ScaledFont.get_scale_matrix
  - Surface.mark_dirty_rectangle
  - Surface.set_fallback_resolution
  + New Constants:
  - cairo.EXTEND_PAD
  - cairo.HAS_IMAGE_SURFACE
  - cairo.HAS_USER_FONT
  + API Changes:
  - Surface.mark_dirty: no longer accepts keyword arguments with default
    values.
  - PycairoPattern_FromPattern (C API): has a new 'base' argument
  + Other Changes:
  - Allow unknown cairo Pattern/Surface types to use the pycairo base
  - Pattern/Surface type.</changelog>
  <changelog author="mboman@suse.de" date="1233489600">- Update to version 1.8.2:
  + bfo#19287: Threading support results in crashes in
    cairo.ImageSurface
  + Context.set_scaled_font
  + API changes
  * Matrix multiplication:
  * old code: matrix3 = matrix1 * matrix2
  * new equivalent code: matrix3 = matrix1.multiply(matrix2)
  * matrix3 = matrix1 * matrix2
    is now equivalent to matrix3 = matrix2.multiply(matrix1)
    which is consistent with standard matrix multiplication.</changelog>
  <changelog author="vuntz@novell.com" date="1237464000">- Update to version 1.8.4:
  + General Changes:
  - Pycairo 1.8.4 requires cairo 1.8.4 (or later) and Python 2.6
  + Bug Fixes:
  - fdo#20674: Add get/set_extend for Gradient Patterns
  + New Classes:
  - cairo.ToyFontFace
  + New Methods:
  - Pattern.get_extend
  - Pattern.set_extend
  - ToyFontFace.get_family
  - ToyFontFace.get_slant
  - ToyFontFace.get_weight
  + Deleted Methods:
  - SurfacePattern.get_extend
  - SurfacePattern.set_extend
  + Other Changes:
  - Threading for surfaces with stream functions has been
    reenabled.
  - Documentation updates.
- Stop re-defining _prefix.
- Remove unneeded BuildRequires: gtk2-devel, libjpeg-devel,
  python-numeric, update-desktop-files.
- Add BuildRequires: cairo-devel, fdupes.
- Remove Suggests on python-numeric (Numeric support was removed).
- Remove Suggests on python-gtk since, well, there's no real reason
  to put it.
- Stop running suse_update_config.
- Use fdupes.</changelog>
  <changelog author="lmedinas@gmail.com" date="1248177600">- Update to version 1.8.6:
  + Bug Fixes:
  - ImageSurface.create_from_png _read_func fix
  - ToyFontFace type fix
  - fdo#19221: restore cairo.Matrix '*' operator to the way it
    originally worked.
  + Documentation completed</changelog>
  <changelog author="vuntz@opensuse.org" date="1259755200">- Update to version 1.8.8:
  + General Changes:
  - Pycairo 1.8.8 requires cairo 1.8.8 (or later).
  - Move from CVS to git.
  - Add support for the waf build tool.
  + Updated methods
  - The PDF/PS/SVGSurface constructors now accept None as a
    filename.</changelog>
  <changelog author="vuntz@opensuse.org" date="1284811200">- Update to version 1.8.10:
  + New Classes/Types:
  - Win32PrintingSurface
  - XCBSurface - add XCB support using xpyb
  + Bug Fixes:
  - Fix for libtool 2.2 (fdo#27974).
  - Mingw32 and pypy fixes (fdo#25203).
  + Other Changes:
  - Tests updated.</changelog>
  <changelog author="vuntz@opensuse.org" date="1308312000">- Update to version 1.10.0:
  + New Constants:
  - cairo.FORMAT_RGB16_565
  + Bug Fixes:
  - context.get_source().get_surface() fails (fdo#33013)
  + Improve/simplify unicode filename and text support.
  + Build related changes.
- Move to using waf for the build as the autotools support is
  broken.
- Recompile the generated byte-code with %py_compile, as the
  waf-generated byte-code references the build root. This is a bug
  in waf, see http://code.google.com/p/waf/issues/detail?id=986</changelog>
  <changelog author="coolo@suse.com" date="1326196800">- trying to get the license right for spdx</changelog>
  <changelog author="saschpe@suse.de" date="1328097600">- Add group to devel package</changelog>
  <changelog author="schwab@linux-m68k.org" date="1349697600">- Build with %{optflags}</changelog>
  <changelog author="idonmez@suse.com" date="1365163200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="toddrme2178@gmail.com" date="1488024000">- Add python2-cairo and python2-cairo-devel provides for
  compatibility with the new multipython spec file macros.</changelog>
  <changelog author="dimstar@opensuse.org" date="1497787200">- Update to version 1.13.3:
  + Fix ImageSurface leaking in case
    :meth:`get_data() &lt;ImageSurface.get_data&gt;` is used under
    Python 3 (gh#pygobject/pycairo#43).
- Changes from version 1.13.2:
  + Fix pip failing to install pycairo in some cases
    (gh#pygobject/pycairo#39).
- Changes from version 1.13.1:
  + setup.py install: Fix generated pkg-config file if ``--home``
    or ``--user`` is specified (gh#pygobject/pycairo#34).
  + Fix a build error on macOS Sierra (gh#pygobject/pycairo#36)
  + examples: Fix snippet examples when .pyc files are present
    (gh#pygobject/pycairo#35).
- For more changes since the last package update, see NEWS inside.
- Implement python single-spec packaging: since pycairo 1.11.0, the
  sources for python2 and python3 based bindings have been merged
  again.</changelog>
  <changelog author="jmatejek@suse.com" date="1498219200">- fix requires for devel subpackage</changelog>
  <changelog author="zaitor@opensuse.org" date="1503576000">- Update to version 1.15.1:
  + Fixes:
  - Improved support for Python filesystem paths including
    os.PathLike. See pathlike for details.
  - Various minor fixes.
  + Changes: Expose cairo.Path.
  + Tests: Improved test coverage from ~70% to ~90%.
- Changes from version 1.15.0:
  + New Features:
  - Add Surface.map_to_image() and Surface.unmap_image().
  - Add RasterSourcePattern.
  - Add Glyph.
  - Add Rectangle.
  - Add TextCluster.
  - Add ScaledFont.text_to_glyphs() and
    ScaledFont.glyph_extents().
  - Add Context.show_text_glyphs().
  - Add TextExtents.
  + Changes:
  - Pycairo instances wrapping the same underlying cairo object
    now hash and compare equally e.g. context.get_target() ==
    context.get_target().
  - Functions which returned a cairo error with Status.NO_MEMORY
    no longer raise MemoryError, but a subclass of Error and
    MemoryError. Similarly errors with Status.READ_ERROR and
    Status.WRITE_ERROR no longer raise IOError, but a subclass of
    Error and IOError.
  - Some functions which previously returned a tuple now return a
    tuple subclass like Rectangle, Glyph, TextCluster and
    TextExtents.
- Changes from version 1.14.1:
  + Fixes: Fix a crash with Surface.get_device().
- Changes from version 1.14.0:
  + General: Requires at least cairo 1.13.1.
  + Tests: Optional Hypothesis tests.
  + New Features:
  - Add Surface.set_device_scale() and
    Surface.get_device_scale().
  - Add Device.
  - Add Surface.get_device().
  - Add ScriptDevice and ScriptMode.
  - Add ScriptSurface.
  - Add Status.JBIG2_GLOBAL_MISSING.
  - Add Format.stride_for_width().
  - Add TextClusterFlags and SurfaceObserverMode.
  - Add Gradient.get_color_stops_rgba().
  - Add TeeSurface.
  - Add MeshPattern.
- Changes from version 1.13.4:
  + Fixes: Fix a rare crash with get_data() under Python 3 (1.13.3
    regression).</changelog>
  <changelog author="tchvatal@suse.com" date="1563969600">- Provide python-pycairo symbol to play nice with backporting
  python stack as new TW contains just this as a proper package
  name bsc#1142582</changelog>
</package>
<package pkgid="52eecdb1879185f28b5559d004ba6507c3bf77ac6836cc32a00707d5d3936047" name="python-certifi" arch="src">
  <version epoch="0" ver="2018.1.18" rel="150000.3.3.1"/>
  <changelog author="mcihar@suse.cz" date="1429704000">- Initial packaging</changelog>
  <changelog author="toddrme2178@gmail.com" date="1443268800">- Update to version 2015.9.6.2:
  * Actually ship weak cert bundle.
  * Provide old cert bundle.
  * Use secure roots by default.
  * Update scripts to use mkcert.org
  * Concatenate the two roots
  * Add the needed 1024-bit roots
  * Move mkcert output to non-core file
- Fix dependencies on SLES 11
- Certifi is released under MPL-2.0; fix the license tag
- Rebase python-certifi-shipped-requests-cabundle.patch</changelog>
  <changelog author="michael@stroeder.com" date="1453464000">- Update to version 2015.11.20.1</changelog>
  <changelog author="jacobwinski@gmail.com" date="1464955200">- Update to version 2016.2.28
- Update copyright year in spec file
- Fix executable warning (fix taken from python3-certifi)</changelog>
  <changelog author="aloisio@gmx.com" date="1491652800">- Updated to version 2017.1.23
- Converted to single-spec
- Updated source URL</changelog>
  <changelog author="dmueller@suse.com" date="1497096000">- update to 2017.4.17</changelog>
  <changelog author="dmueller@suse.com" date="1497182400">- require ca-certificates-mozilla, otherwise certifi does not
  provide any ca bundle (the bundled one that openSUSE patches
  out is the mozilla bundle as well)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1499688000">- Fix wrong-script-interpreter rpmlint error.
- Fix script-without-shebang rpmlint warning.</changelog>
  <changelog author="arun@gmx.de" date="1507032000">- updated patch
- update to version 2017.7.27.1:
  * Use a more expressive API for getting the dir a path is in
  * set zip_safe=False to help out setuptools (#63)
  * Change license from ISC to MPL-2.0 in setup.py
  * Add trove classifiers for missing supported Python versions
  * Rename [wheel] section to [bdist_wheel] as the former is legacy</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1507809600">- add patch to fix version string from 2017.07.27.1 to
  2017.7.27.1 to fix the build on SLE12_SP3 and earlier
  + python-certifi-fix-version-string.patch</changelog>
  <changelog author="jmatejek@suse.com" date="1508328000">- fix macros to support not having python2</changelog>
  <changelog author="dmueller@suse.com" date="1510660800">- update to 2017.11.5:
  * Sync with bundle mozilla release
- remove  python-certifi-fix-version-string.patch: obsolete</changelog>
  <changelog author="arun@gmx.de" date="1517745600">- specfile:
  * update copyright year
- update to version 2018.1.18:
  * Remove 1024-bit root certificates
  * Include license in the list of trove classifiers
  * Include license file in the generated wheel package</changelog>
  <changelog author="dbenini@suse.com" date="1672488000">- remove all TrustCor CAs, as TrustCor issued multiple man-in-the-middle
  certs (bsc#1206212 CVE-2022-23491)
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - TrustCor ECA-1
- Add removeTrustCor.patch</changelog>
</package>
<package pkgid="fc73a282bd89f970a6d258a18d19b22451be821e76b1fe0f2e7f0b1a52932cd2" name="python-cryptography" arch="src">
  <version epoch="0" ver="3.3.2" rel="150400.16.6.1"/>
  <changelog author="tchvatal@suse.com" date="1534852800">- Update to 2.3.1:
  * updated tests for upstream wycheproof changes
  * many other tiny test tweaks</changelog>
  <changelog author="tchvatal@suse.com" date="1544097600">- Fix fdupes call</changelog>
  <changelog author="mcepl@suse.com" date="1544097601">- Update to 2.4.1:
  * Dropped support for LibreSSL 2.4.x.
  * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no
    longer supported by the OpenSSL project. At this time there
    is no time table for dropping support, however we strongly
    encourage all users to upgrade or install cryptography from
    a wheel.
  * Added initial :doc:`OCSP &lt;/x509/ocsp&gt;` support.
  * Added support for cryptography.x509.PrecertPoison.</changelog>
  <changelog author="mpluskal@suse.com" date="1546516800">- Update to version 2.4.2:
  * Updated Windows, macOS, and manylinux1 wheels to be compiled
    with OpenSSL 1.1.0j.</changelog>
  <changelog author="michael@stroeder.com" date="1548417600">- Dependency on python-idna changed to "Recommends" aligned with
  change in upstream source (see below)
- update to 2.5:
  * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1,
    but this version removes the default idna dependency as well. If you still
    need this deprecated path please install cryptography with the idna extra:
    pip install cryptography[idna].
  * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4.
  * Numerous classes and functions have been updated to allow bytes-like
    types for keying material and passwords, including symmetric algorithms,
    AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a.
  * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1.
  * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1.
  * Added support for X448 key exchange when using OpenSSL 1.1.1.
  * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1.
  * Added initial support for parsing PKCS12 files with load_key_and_certificates().
  * Added support for IssuingDistributionPoint.
  * Added rfc4514_string() method to x509.Name,
    x509.RelativeDistinguishedName, and x509.NameAttribute to format the name
    or component an RFC 4514 Distinguished Name string.
  * Added from_encoded_point(), which immediately checks if the point is on
    the curve and supports compressed points. Deprecated the previous method
    from_encoded_point().
  * Added signature_hash_algorithm to OCSPResponse.
  * Updated X25519 key exchange support to allow additional serialization
    methods. Calling public_bytes() with no arguments has been deprecated.
  * Added support for encoding compressed and uncompressed points via
    public_bytes(). Deprecated the previous method encode_point().</changelog>
  <changelog author="michael@stroeder.com" date="1551355200">- update to 2.6.1:
  * BACKWARDS INCOMPATIBLE:
    Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature
    andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature,
    which had been deprecated for nearly 4 years. Use encode_dss_signature()
    and decode_dss_signature()instead.
  * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which
    had been deprecated for nearly 3 years. Use serial_number instead.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with
    OpenSSL 1.1.1b.
  * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer.
  * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer.
  * load_ssh_public_key() can now load ed25519 public keys.
  * Add support for easily mapping an object identifier to its elliptic curve
    class viaget_curve_for_oid().
  * Add support for OpenSSL when compiled with the no-engine
    (OPENSSL_NO_ENGINE) flag.</changelog>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1595937600">- update to 3.0
- refreshed disable-uneven-sizes-tests.patch and  skip_openssl_memleak_test.patch
  * Removed support for passing an Extension instance
    to from_issuer_subject_key_identifier(), as per our deprecation policy.
  * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed
  * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer.
  * RSA generate_private_key() no longer accepts public_exponent values except
    65537 and 3 (the latter for legacy purposes).
  * X.509 certificate parsing now enforces that the version field contains
    a valid value, rather than deferring this check until version is accessed.
  * Deprecated support for Python 2
  * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa
    private keys: load_ssh_private_key() for loading and OpenSSH for writing.
  * Added support for OpenSSH certificates to load_ssh_public_key().
  * Added encrypt_at_time() and decrypt_at_time() to Fernet.
  * Added support for the SubjectInformationAccess X.509 extension.
  * Added support for parsing SignedCertificateTimestamps in OCSP responses.
  * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().
  * Added support for encoding attributes in certificate signing requests via add_attribute().
  * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG
    instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.
  * Added initial support for creating PKCS12 files with serialize_key_and_certificates().</changelog>
  <changelog author="dmueller@suse.com" date="1600430400">- update to 3.1:
  * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
    :term:`U-label` parsing in various X.509 classes. This support was originally
    deprecated in version 2.1 and moved to an extra in 2.5.
  * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
    the OpenSSL project. The next version of ``cryptography`` will drop support
    for it.
  * Deprecated support for Python 3.5. This version sees very little use and will
    be removed in the next release.
  * ``backend`` arguments to functions are no longer required and the
    default backend will automatically be selected if no ``backend`` is provided.
  * Added initial support for parsing certificates from PKCS7 files with
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
    and
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
    .
  * Calling ``update`` or ``update_into`` on
    :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
    longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
    also resolves the same issue in :doc:`/fernet`.</changelog>
  <changelog author="dmueller@suse.com" date="1601294400">- update to 3.1.1:
  * wheels compiled with OpenSSL 1.1.1h.</changelog>
  <changelog author="michael@stroeder.com" date="1603713600">- update to 3.2 (bsc#1178168, CVE-2020-25659):
  * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,
    to protect against Bleichenbacher vulnerabilities. Due to limitations imposed
    by our API, we cannot completely mitigate this vulnerability.
  * Support for OpenSSL 1.0.2 has been removed.
  * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
- drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists</changelog>
  <changelog author="michael@stroeder.com" date="1603886400">- update to 3.2.1:
  Disable blinding on RSA public keys to address an error with
  some versions of OpenSSL.</changelog>
  <changelog author="mcepl@suse.com" date="1607256000">- Remove unnecessary dependency virtualenv.</changelog>
  <changelog author="mrueckert@suse.de" date="1607515200">- update to 3.3.0
  - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed
    due to low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit
    to 1024-bit (8 byte to 128 byte) initialization vectors. This
    change is to conform with an upcoming OpenSSL release that will
    no longer support sizes outside this window.
  - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we
    now raise ValueError rather than UnsupportedAlgorithm when an
    unsupported cipher is used. This change is to conform with an
    upcoming OpenSSL release that will no longer distinguish
    between error types.
  - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite
    field Diffie-Hellman parameters of less than 512 bits in
    length. This change is to conform with an upcoming OpenSSL
    release that no longer supports smaller sizes. These keys were
    already wildly insecure and should not have been used in any
    application outside of testing.
  - Updated Windows, macOS, and manylinux wheels to be compiled
    with OpenSSL 1.1.1i.
  - Python 2 support is deprecated in cryptography. This is the
    last release that will support Python 2.
  - Added the recover_data_from_signature() function to
    RSAPublicKey for recovering the signed data from an RSA
    signature.</changelog>
  <changelog author="dmueller@suse.com" date="1608465600">- update to 3.3.1:
  * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use</changelog>
  <changelog author="michael@stroeder.com" date="1612699200">- update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331):
  * SECURITY ISSUE: Fixed a bug where certain sequences of update()
    calls when symmetrically encrypting very large payloads (&gt;2GB) could
    result in an integer overflow, leading to buffer overflows.
    CVE-2020-36242
  - drops CVE-2020-36242-buffer-overflow.patch on older dists</changelog>
  <changelog author="daniel.garcia@suse.com" date="1676289600">- Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931)
  * Don't allow update_into to mutate immutable objects</changelog>
</package>
<package pkgid="8c1f1580ea91367b5c3defcc531aced843c5557429371c1e6b1a74b13d83650a" name="python-future" arch="src">
  <version epoch="0" ver="0.18.2" rel="150300.3.3.1"/>
  <changelog author="glin@suse.com" date="1450094400">- initial import: 0.15.2 (fate#320644)</changelog>
  <changelog author="glin@suse.com" date="1473422400">- Remove %ghost from %{_bindir}/futurize and %{_bindir}/pasteurize
  (fate#320644)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1473940800">- Fix update-alternatives usage.</changelog>
  <changelog author="okurz@suse.com" date="1474459200">- Fix rpm uninstall warnings by removing alternatives in postun as
  discussed in https://build.opensuse.org/request/show/427095</changelog>
  <changelog author="ms@suse.com" date="1476187200">- Tracker changelog entry to add python-future to SLE12 (bnc#999200)</changelog>
  <changelog author="mimi.vx@gmail.com" date="1480075200">- update to 0.16.0
  * Fix newbytes constructor bug.
  * Fix semantics of bool() with newobject.
  * Fix standard_library.install_aliases() on PyPy
  * Fix assertRaises for pow and compile` on Python 3.5.
  * Fix return argument of future.utils.ensure_new_type
  if conversion to new type does not exist.
  * Add missing cmp_to_key for Py2.6.
  * Allow the old_div fixer to be disabled.
  * Improve compatibility with Google App Engine.
  * Add some missing imports to the tkinter and tkinter.filedialog
  package namespaces
  * Fix raise_from on PY3 when the exception cannot be recreated from its repr.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1491480000">- Implement single-spec version</changelog>
  <changelog author="toddrme2178@gmail.com" date="1542369600">- Update to version 0.17.1
  * This release address a packaging error because of an erroneous declaration that
    any built wheels are universal.
- Update to version 0.17.0
  * Fix ``from collections import ChainMap`` after install_aliases() (issue #226)
  * Fix multiple import from ``__future__`` bug in futurize (issue #113)
  * Add support for proper %s formatting of newbytes
  * Properly implement iterator protocol for newrange object
  * Fix ``past.translation`` on read-only file systems
  * Fix Tkinter import bug introduced in Python 2.7.4 (issue #262)
  * Correct TypeError to ValueError in a specific edge case for newrange
  * Support inequality tests betwen newstrs and newbytes
  * Add type check to __get__ in newsuper
  * Fix fix_divsion_safe to support better conversion of complex expressions, and
    skip obvious float division.</changelog>
  <changelog author="mcepl@suse.com" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="jayvdb@gmail.com" date="1552305600">- Activate test suite</changelog>
  <changelog author="jayvdb@gmail.com" date="1557230400">- Change License from MIT to MIT and Python-2.0</changelog>
  <changelog author="mcepl@suse.com" date="1570017600">- Add python38-compat.patch to fix compatibility with Python 3.8
  gh#PythonCharmers/python-future#447
- Add python38-pow.patch not to expect exception on new available
  parameters for Python 3.8. gh#PythonCharmers/python-future#474</changelog>
  <changelog author="steven.kowalik@suse.com" date="1571054400">- Update to 0.18.0.
- Remove python38-compat.patch, already included.
- Add future-correct-mimetype.patch, since Python 3.8 is able to detect
  the MIME type now.</changelog>
  <changelog author="mcepl@suse.com" date="1575547200">- Update to 0.18.2:
  - Fix min/max functions with generators, and 'None' default (PR #514)
  - Use BaseException in raise_() (PR #515)
  - Fix builtins.round() for Decimals (Issue #501)
  - Fix raise_from() to prevent failures with immutable classes (PR #518)
  - Make FixInput idempotent (Issue #427)
  - Fix type in newround (PR #521)
  - Support mimetype guessing in urllib2 for Py3.8+ (Issue #508)
  - fix for raise_() when passed an exception that's not an
    Exception (e.g. BaseException subclasses)
- Rebase future-correct-mimetype.patch to revert incorrect fix in
  gh#PythonCharmers/python-future#508</changelog>
  <changelog author="daniel.garcia@suse.com" date="1672920000">- Add CVE-2022-40899.patch to fix REDoS in http.cookiejar
  gh#PythonCharmers/python-future#610
  bsc#1206673</changelog>
</package>
<package pkgid="e4205f2b10670f6e1fd2e42af2fdaa652f9042a54302bc5e4476d3109ba5f683" name="python-gobject" arch="src">
  <version epoch="0" ver="3.42.2" rel="150400.3.3.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1551960000">- Update to version 3.31.4:
  + docs: document GObject.Object.weak_ref().
  + cairo:
  - Add cairo pattern foreign struct support.
  - Add cairo_matrix_t converter to GValue.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552219200">- Update to version 3.32.0:
  + No changes since 3.31.4.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1555761600">- Update to version 3.32.1:
  + tests/gimarshallingtestsextra.c/h: relicense to LGPLv2.1+.
  + meson: add ``tests`` option for disabling tests.
  + meson: tests: pass ``--quiet`` to g-ir-scanner.
  + Fix a crash when marshalling a GError to Python fails.
  + Fix leak of transfer-full/container C arrays.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1561377600">- Update to version 3.32.2:
  + Python 3.8b1 compatibility fixes.
  + tests: fix a test error when run under wayland.
  + setup.py: specify python_requires.</changelog>
  <changelog author="mgorse@suse.com" date="1567252800">- Update to version 3.33.1:
  + Make GLib.Variant.unpack a bit less costly.
  + pygobject: ignore GParameter deprecations.
  + pygobject-object: fix refcount of floating return values.
  + pygi-info: remove some dead code.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + No changes since 3.33.1.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578744000">- Drop gnome-common Requires from python-gobject-common-devel
  sub-package, no longer needed, nor used since 3.29.1, where the
  BuildRequires was dropped, but the explicit Requires was not
  removed by mistake.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580472000">- Remove %{python_module gobject-devel = %{version}} from
  common-devel: Assuming that consumers of the .pc and include
  headers are not really using the python bindings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583668800">- Update to version 3.36.0:
  + This will be the last release supporting Python 2.
  + pygobject-object: Avoid checking whether NULL is floating.
  + Avoid various new glib deprecation warnings.
  + Port to g_object_new_with_properties().
  + Drop Python 2 support on Windows.
  + gtk overrides: Drop Menu, MenuItem for Gtk 4.
  + Docs:
  - Update openSUSE instructions.
  - Add Gaphor to Who is Using PyGObject.
  - Remove reference to a fixed bug.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1588766400">- Update to version 3.36.1:
  + tests: Fix failing tests with pytest 5.4.0+.
  + Gtk: Add override to make sure both
    TreeModelSort.new_with_model and TreeModel.sort_new_with_model
    exist independend of the gtk version.
  + Gtk.Template: Fix initialisation order errors with Widgets
    getting created from C (potentially through other templates).
  + Gtk.Template: Fix errors when calling init_template() multiple
    times.</changelog>
  <changelog author="dimstar@opensuse.org" date="1600084800">- Update to version 3.38.0:
  + meson: Make the `pycairo` option a feature.
  + gdk overrides: Fix wrapping of scroll events.
  + Add overrides for Gtk.Button set/get_focus_on_click.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Simplify the dependency exclusion from __init__.py to also match
  with multiple python3-flavors.
- Remove exec bit from all *.py files in examples, also
  subdirectories.</changelog>
  <changelog author="code@bnavigator.de" date="1610539201">- Recompile python cache files after removal of components, include
  cache files in correct subpackage
- Fix supplements declarations, where possible. Disable for -gdk.</changelog>
  <changelog author="mgorse@suse.com" date="1616155200">- Update to version 3.40.0:
  + GTK 4 compatibility fixes.
  + Python 3.9 and 3.10 compatibility fixes.
  + New minimal dependency requirements.
- Up glib2, gobject-introspection, and cairo required versions.</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 3.40.1:
  + Fix tests with glib 2.68.
  + Fix a regression with marshalling partial() objects.</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Adjust BuildRequires for python_module cairo to python-module
  pycairo: the module was renamed 2 years ago.
- Skip build for python2: not supported anymore since 3.38.0.</changelog>
  <changelog author="dimstar@opensuse.org" date="1632139200">- Update to version 3.42.0:
  + meson: Bump minimum meson_version to 0.47.0.
  + Expose GObject.Object.run_dispose().
  + docs: document Gtk.Template.
  + dev: Add poetry support.
  + meson: use main branch for glib subproject.
  + Fix some small memory leaks.</changelog>
  <changelog author="emilyyrose@gmail.com" date="1650542400">- Update to version 3.42.1:
  + Do not error out for unknown scopes.
  + gtk overrides: restore Gtk.ListStore.insert_with_valuesv with
    newer GTK4.
  + gtk overrides: Do not override Treeview.enable_model_drag_xx
    for GTK4.
  + Implement DynamicImporter.find_spec() to silence deprecation
    warning.
  + Some test/CI fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1654776000">- Add dependency on python-cairo to python-gobject-cairo: The
  introspection wrapper needs the actual pycairo underneath
  (boo#1179584).</changelog>
  <changelog author="yfjiang@suse.com" date="1664539200">- Update to version 3.42.2:
  * Error out instead of crashing when marshaling unsupported
    fundamental types in some cases :mr:`180`
  * Add a workaround for a PyPy 3.9+ bug when threads are used
    :mr:`200`
  * Fix crashes when marshaling zero terminated arrays for certain
    item types :mr:`191`
  * Fix a crash/refcounting error in case marshaling a hash table
    fails :mr:`191`
  * Make the test suite pass again with PyPy :mr:`191`
  * tests: support running tests with (MSVC) CPython 3.8+ on
    Windows :mr:`206`
  * interface: Fix leak when overriding GInterfaceInfo :mr:`204`
  * setup.py: look up pycairo headers without importing the module
    (helps with building on Windows and MSVC CPython 3.8+)
    :mr:`205`</changelog>
</package>
<package pkgid="6aad79326d9b9d15afabacc63acf076f01c77d28a804b12b190cf69635ba2822" name="python-kiwi" arch="src">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="476817cda7e65a1fe3f61df542a7c95131250475f67b504a313500f284aae174" name="python-msgpack" arch="src">
  <version epoch="0" ver="0.5.6" rel="150100.3.3.1"/>
  <changelog author="alexandre@exatati.com.br" date="1356177600">- Update to 0.2.4:
  - Fix SEGV when object_hook or object_pairs_hook raise Exception. (#39)</changelog>
  <changelog author="p.drouand@gmail.com" date="1357905600">- Initial python3 support</changelog>
  <changelog author="saschpe@suse.de" date="1358164800">- Simplify macro usage</changelog>
  <changelog author="alexandre@exatati.com.br" date="1361188800">- Update to 0.3.0:
  Incompatible Changes
  - Default value of use_list is True for now. (It was False for
    0.2.x) You should pass it explicitly for compatibility to 0.2.x.
  Changes
  - Pure Python fallback module is added. (thanks to bwesterb)
  - Add .skip() method to Unpacker (thanks to jnothman)
  - Add capturing feature. You can pass the writable object to
    Unpacker.unpack() as a second parameter.
  - Add Packer.pack_array_header and Packer.pack_map_header. These
    methods only pack header of each type.
  - Add autoreset option to Packer (default: True). Packer doesn't
    return packed bytes and clear internal buffer.
  - Add Packer.pack_map_pairs. It packs sequence of pair to map type.</changelog>
  <changelog author="speilicke@suse.com" date="1367496000">- Package COPYING and README.rst
- Run testsuite</changelog>
  <changelog author="speilicke@suse.com" date="1382616000">- Require python-setuptools instead of distribute (upstreams merged)</changelog>
  <changelog author="p.drouand@gmail.com" date="1386504000">- Update to version 0.4.0
  + Raises TypeError instead of ValueError when packer receives
    unsupported type.
  + Support New msgpack spec.
- Use download Url as source
- Add python-argparse requirement for SLE11SP3 to get tests working</changelog>
  <changelog author="toddrme2178@gmail.com" date="1416312000">- Update to 0.4.2
  Bugfixes
  - Unpacker doesn't increment refcount of ExtType hook.
  - Packer raises no exception for inputs doesn't fit to msgpack format.
- Update to 0.4.1
  Changes
  - fallback.Unpacker.feed() supports bytearray.
  Bugs fixed
  - Unpacker doesn't increment refcount of hooks. Hooks may be GCed while unpacking.
  - Unpacker may read unfilled internal buffer.</changelog>
  <changelog author="hpj@urpla.net" date="1426507200">- Update to version 0.4.6
  * fallback.Unpacker: Fix Data corruption when OutOfData. This bug
    only affects "Streaming unpacking."
- Changes from version 0.4.5
  * Fix test failure on pytest 2.3.
  * Fix typos in ChangeLog.
  * Improve README.rst
- Changes from version 0.4.4
  * Fix compile error.
- Changes from version 0.4.3
  * Unpacker may unpack wrong uint32 value on 32bit or LLP64
    environment. (#101)
  * Build failed on Windows Python 2.7.</changelog>
  <changelog author="mc@suse.com" date="1445083200">- build conditionally without tests</changelog>
  <changelog author="dmueller@suse.com" date="1479211200">- update to 0.4.8</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492603200">- Implement single-spec version.</changelog>
  <changelog author="dmueller@suse.com" date="1517054400">- update to 0.5.1:
  * Package name on PyPI was changed to msgpack from 0.5.
- rename from msgpack-python</changelog>
  <changelog author="jengelh@inai.de" date="1517313600">- Strip rheotrics from descriptions.</changelog>
  <changelog author="tbechtold@suse.com" date="1517918400">- update to version 0.5.4
  * packer: Use PyUnicode_AsUTF8AndSize() for utf-8 (#272)
  * Fix encoding and unicode_errors (#277)
  * Undeprecate unicode_errors (#278)
  * Packer.pack() reset buffer on exception (#274)
  * Use cython's cast for converting encoding and errors (#279)
  * 0.5.4
  * Add raw_as_bytes option to Unpacker. (#265)
  * s/raw_as_bytes/raw/g (#276)</changelog>
  <changelog author="dmueller@suse.com" date="1518436800">- fix typo in obsoletes</changelog>
  <changelog author="alarrosa@suse.com" date="1519646400">- Provide also python-msgpack-python in the python2 package to
  be able to obsolete the python2-msgpack-python package correctly.</changelog>
  <changelog author="alarrosa@suse.com" date="1519905600">- Update to version 0.5.6 (boo#1123558)
  * Fix fallback.Unpacker.feed() dropped unused data from buffer
  * Resurrect fallback.unpack() and _unpacker.unpack(). They were
    removed at 0.5.5 but it breaks backward compatibility.
- Update to version 0.5.5
  * Fix memory leak in pure Python Unpacker.feed()
  * Fix unpack() didn't support raw option</changelog>
  <changelog author="alarrosa@suse.com" date="1548763200">- Use %license</changelog>
  <changelog author="mcepl@suse.com" date="1664280000">- Loose the filelist for the package info to avoid FTBFS on
  SLE-15-SP5 (bsc#1203743).</changelog>
</package>
<package pkgid="23873738c1a42e2f3ba6114c66242f862989580271689645f96f011dc5ec8e08" name="python-py" arch="src">
  <version epoch="0" ver="1.10.0" rel="150100.5.12.1"/>
  <changelog author="jmatejek@suse.com" date="1475668800">- update for singlespec</changelog>
  <changelog author="jmatejek@suse.com" date="1487851200">- update to 1.4.32
  - fix issue70: added ability to copy all stat info in py.path.local.copy.
  - make TerminalWriter.fullwidth a property.  This results in the correct
    value when the terminal gets resized.
  - update supported html tags to include recent additions.
    Thanks Denis Afonso for the PR.
  - Remove internal code in ``Source.compile`` meant to support earlier Python 3 versions that produced the side effect
    of leaving ``None`` in ``sys.modules`` when called (see pytest-dev/pytest#2103).
    Thanks Bruno Oliveira for the PR.</changelog>
  <changelog author="aloisio@gmx.com" date="1498824000">- Update to 1.4.34
  * fix issue119 / pytest issue708 where tmpdir may fail to make
    numbered directories when the filesystem is case-insensitive.
  1.4.33:
  * avoid imports in calls to py.path.local().fnmatch(). Thanks
    Andreas Pelme for the PR.
  * fix issue106: Naive unicode encoding when calling fspath() in
    python2. Thanks Tiago Nobrega for the PR.
  * fix issue110: unittest.TestCase.assertWarns fails with py
    imported.</changelog>
  <changelog author="arun@gmx.de" date="1510747200">- update to version 1.5.0:
  * python 2.6 and 3.3 are no longer supported
  * deprecate py.std and remove all internal uses
  * fix #73 turn py.error into an actual module
  * path join to / no longer produces leading double slashes
  * fix #82 - remove unsupportable aliases
  * fix python37 compatibility of path.sysfind on windows by correctly
    replacing vars
  * turn iniconfig and apipkg into vendored packages and ease
    de-vendoring for distributions
  * fix #68 remove invalid py.test.ensuretemp references
  * fix #25 - deprecate path.listdir(sort=callable)
  * add TerminalWriter.chars_on_current_line read-only property that
    tracks how many characters have been written to the current line.</changelog>
  <changelog author="arun@gmx.de" date="1511092800">- specfile:
  * updated url
- update to version 1.5.2:
  * fix #169, #170: error importing py.log on Windows: no module named
    "syslog".
- changes from version 1.5.1:
  * fix #167 - prevent pip from installing py in unsupported Python
    versions.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1527768000">- update to version 1.5.3
  * - fix #179: ensure we can support 'from py.error import ...'</changelog>
  <changelog author="mimi.vx@gmail.com" date="1533211200">- update to 1.5.4
  * don't make assumptions about fs case sensitivity in ``make_numbered_dir``.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1540555200">- update to 1.7.0
  * use ``shutil.get_terminal_size()`` in Python 3.3+ to determine the size of the
  terminal, which produces more accurate results than the previous method.
  * introduce new ``PY_IGNORE_IMPORTMISMATCH`` environment variable
  that suppresses ``ImportMismatchError`` exceptions when set to ``1``.
  * add ``TerminalWriter.width_of_current_line`` (i18n version of
  ``TerminalWriter.chars_on_current_line``), a read-only property
  that tracks how wide the current line is, attempting to take
  into account international characters in the calculation.</changelog>
  <changelog author="tchvatal@suse.com" date="1549972800">- Drop the doc subpackage, no need for it really
- Make sure the tests are realy executed</changelog>
  <changelog author="tchvatal@suse.com" date="1550232000">- Make tests really pass on pytest 3.x series
- Add patch to operate better with serparators (from upstream git):
  * separators.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1550232001">- Make tests never fail as they are borked on pytest-4 with
  most probably no intention of being ever fixed</changelog>
  <changelog author="tchvatal@suse.com" date="1551268800">- Update to 1.8.0:
  * add ``"importlib"`` pyimport mode for python3.5+, allowing unimportable test suites
    to contain identically named modules.
  * fix ``LocalPath.as_cwd()`` not calling ``os.chdir()`` with ``None``, when
    being invoked from a non-existing directory.
- Drop merged patch separators.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1560945600">- Switch to multibuild to avoid cycle bsc#1138666</changelog>
  <changelog author="tchvatal@suse.com" date="1578312000">- Update to 1.8.1:
  - Handle ``FileNotFoundError`` when trying to import pathlib in
    ``path.common`` on Python 3.4 (#207).
  - ``py.path.local.samefile`` now works correctly in Python 3 on
    Windows when dealing with symlinks.</changelog>
  <changelog author="mcalabkova@suse.com" date="1593432000">- Update to 1.9.0
  * Add type annotation stubs</changelog>
  <changelog author="jayvdb@gmail.com" date="1602936000">- Devendor apipkg and iniconfig
- Add pr_222.patch to activate test suite</changelog>
  <changelog author="code@bnavigator.de" date="1613736000">- Update to 1.10.0
  * Fix a regular expression DoS vulnerability in the py.path.svnwc
    SVN blame functionality (CVE-2020-29651)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- CVE-2020-29651.patch (bsc#1179805, CVE-2020-29651, bsc#1184505)
  * python-py: regular expression denial of service in svnwc.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1647259200">- Update in SLE-15 (bsc#1195916, bsc#1196696, jsc#PM-3356, jsc#SLE-23972)
- Drop CVE-2020-29651.patch, issue fixed upstream in 1.10.0</changelog>
  <changelog author="steven.kowalik@suse.com" date="1673956800">- Remove all traces of py._path.svn{url,wc}. (bsc#1204364, CVE-2022-42969)
- Add patch remove-svn-remants.patch to help with that goal.
- Refresh pr_222.patch as needed for above.</changelog>
</package>
<package pkgid="b582e188b82ce71451237072fab01e2e3910dae928eb355bc5c7f6fb1bf00576" name="python-rpm" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="cthiel@suse.de" date="1223467200">- added libelf-devel to BuildRequires to fix build</changelog>
  <changelog author="ro@suse.de" date="1234440000">- adapt buildrequires</changelog>
  <changelog author="dmueller@suse.de" date="1287403200">- adapt buildrequires</changelog>
  <changelog author="coolo@novell.com" date="1287748800">- adapt second spec file to changes done to rpm.spec</changelog>
  <changelog author="mls@suse.de" date="1298462400">- drop standard python directories from filelist [bnc#229189]</changelog>
  <changelog author="coolo@suse.com" date="1323604800">- add libtool as explicit buildrequire</changelog>
  <changelog author="saschpe@suse.de" date="1326801600">- Spec file cleanup:
  * Don't rm -rf %{buildroot}
  * Removed %clean section
  * Removed authors from description</changelog>
  <changelog author="klaussfreire@gmail.com" date="1334145600">- Fix usage of deprecated AsVoidPtr Python/C API,
  replaced by Capsule API</changelog>
  <changelog author="mls@suse.de" date="1335182400">- modified capsule api diff to match rpm upstream</changelog>
  <changelog author="dmueller@suse.com" date="1357128000">- Update to 4.10.2</changelog>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="29c71682213246ddb08c7135fb925d3a1c918c3d4fac66644e6d4612d0309550" name="python-setuptools" arch="src">
  <version epoch="0" ver="44.1.1" rel="150400.3.3.1"/>
  <changelog author="arun@gmx.de" date="1556971200">- update to version 41.0.1:
  * #1671: Fixed issue with the PEP 517 backend that prevented
    building a wheel when the dist/ directory contained existing .whl
    files.
  * #1709: In test.paths_on_python_path, avoid adding unnecessary
    duplicates to the PYTHONPATH.
  * #1741: In package_index, now honor "current directory" during a
    checkout of git and hg repositories under Windows</changelog>
  <changelog author="tchvatal@suse.com" date="1566388800">- Update to 41.2.0:
  * #479: Remove some usage of the deprecated imp module.
  * #1565: Changed html_sidebars from string to list of string as per https://www.sphinx-doc.org/en/master/changes.html#id58
  * #1697: Moved most of the constants from setup.py to setup.cfg
  * #1756: Forse metadata-version &gt;= 1.2. when project urls are present.</changelog>
  <changelog author="tchvatal@suse.com" date="1566388801">- Switch to multibuild to enable testsuite</changelog>
  <changelog author="jayvdb@gmail.com" date="1568462400">- Define LANG in %check to fix openSUSE/SLE 15 testsuite</changelog>
  <changelog author="mcalabkova@suse.com" date="1570795200">- Update to 41.4.0
  * In declarative config, now traps errors when invalid python_requires
    values are supplied.
  * When storing extras, rely on OrderedSet to retain order of extras
    as indicated by the packager, which will also be deterministic
    on Python 2.7 (with PYTHONHASHSEED unset) and Python 3.6+.
  * Fixed failing integration test triggered by 'long_description_content_type' in packaging.</changelog>
  <changelog author="tchvatal@suse.com" date="1571227200">- Add patch to sort outputs for better reproducability:
  * sort-for-reproducibility.patch
- Add missing dep on ordered-set as it is now in the vendored
  dir too</changelog>
  <changelog author="tchvatal@suse.com" date="1571227201">- Try to use system packages rather than the vendored variants</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1571313600">- Remove runtime dependency for the full python3 package, as the
  actually required SSL module is in python3-base. For python(2),
  SSL is in the "full" python package. Avoids build loops and
  shortens the dependency chain for e.g. rust.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1573473600">- update to 41.6.0
- add importlib.patch
  * Replace usage of deprecated imp module with local
    re-implementation in setuptools._imp
  * Fix pkg_resources.Requirement hash/equality implementation
  * Fix tests when running under python3.10.
  * drop 'deprecated' documentation (test command, ez_setup, EasyInstall)</changelog>
  <changelog author="mimi.vx@gmail.com" date="1580817600">- update to 44.0.0
- last version with python2 support
- add testdata.tar.gz -&gt; missing data for testsuite
  * Drop support for Python 3.4.
  * include pyproject.toml in source distribution by default.
    Projects relying on the previous behavior where pyproject.toml
  * Setuptools once again declares 'setuptools' in the build-system.requires
    and adds PEP 517 build support by declaring itself as the build-backend
  * Fix support for easy_install's find-links option in setup.cfg
  * Build dependencies (setup_requires and tests_require) now install transitive
    dependencies indicated by extras.
  * Mark the easy_install script and setuptools command as deprecated, and use
    pip when available to fetch/build wheels for missing setup_requires/tests_require
    requirements, with the following differences in behavior:
    + support for python_requires
    + better support for wheels (proper handling of priority with respect to PEP 425 tags)
    + PEP 517/518 support
    + eggs are not supported
    + no support for the allow_hosts easy_install option (index_url/find_links are still honored)
    + pip environment variables are honored (and take precedence over easy_install options)
  * Removed the "upload" and "register" commands in favor of twine.
  * Add support for the license_files option in setup.cfg to automatically
    include multiple license files in a source distribution.
  * Update handling of wheels compatibility tags: * add support for manylinux2010
  * fix use of removed 'm' ABI flag in Python 3.8 on Windows
  * Fix empty namespace package installation from wheel.
  * Setuptools now exposes a new entry point hook "setuptools.finalize_distribution_options",
    enabling plugins like setuptools_scm to configure options on the distribution
    at finalization time.</changelog>
  <changelog author="tchvatal@suse.com" date="1584100800">- Fix build without python2</changelog>
  <changelog author="mcepl@suse.com" date="1586174400">- Fix License to the correct MIT</changelog>
  <changelog author="code@bnavigator.de" date="1592913600">- use local source dir for pytest imports
  gh#openSUSE/python-rpm-macros#48</changelog>
  <changelog author="mimi.vx@gmail.com" date="1597320000">- update to 44.1.0
  * Set sys.argv[0] in setup script run by build_meta.__legacy__
  * Fix for Python 4: replace unsafe six.PY3 with six.PY2
  * Fixed a bug in the ?setuptools.finalize_distribution_options? hook
    that lead to ignoring the order attribute of entry points managed
    by this hook.
  * Avoid loading working set during Distribution.finalize_options prior
    to invoking _install_setup_requires, broken since v42.0.0.</changelog>
  <changelog author="mcepl@suse.com" date="1605009600">- Add wheel subpackage with the generated wheel for this package
  (bsc#1176262, CVE-2019-20916).</changelog>
  <changelog author="mcepl@suse.com" date="1605182400">- Make wheel a separate build run to avoid the setuptools/wheel build
  cycle.</changelog>
  <changelog author="mcepl@suse.com" date="1605528000">- Avoid duplicite wheel name in the generated package, and we actually
  don't need a subpackage at all.</changelog>
  <changelog author="mcepl@suse.com" date="1607428800">- Add remove_mock.patch to remove dependency on the external mock
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1611316800">- We cannot remove vendored packages when generating setuptools
  wheel (bsc#1177127).</changelog>
  <changelog author="daniel.garcia@suse.com" date="1673265600">- Add CVE-2022-40897-ReDos.patch to fix Regular Expression Denial of Service
  (ReDoS) in package_index.py.
  bsc#1206667</changelog>
</package>
<package pkgid="6bf22b6c480d3dcd665ff86560a3c0c5ff45f4c88bc609e1eadb61858222c412" name="python3" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="329894139c4323fa49554ed55fca79308ffd405206e1824a1abcd3f2fe38a5a6" name="python3" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="2fa7e10c64dd44f1a9dd4f6e033e5b1a0393fbbc42125a8731b87e218454a69b" name="python3" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="6176cf102fed7d30d8482b71a16d8313cf844b25145dc7dea07ce1636a661a64" name="python3" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="345675e9061b2d2ceeacaae871d039478cce020a4d0f0de535d853b348e09792" name="python3" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="f1be5bb20099b345a8e8c3a85d82c409651c74cdf29d1951cdedfc9f7139c9b1" name="python3" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="3709b7c1def9bc958917eb66a61cb78963f62c98ec2bd8739780f55babb9be85" name="python3" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.45.1"/>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
</package>
<package pkgid="a264488cbf82a20c6790a9332e30530da3ce4314259fb0276f76ce69521fbfb7" name="python3" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.45.1"/>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
</package>
<package pkgid="679c62e4d65fbee4bb3d6d65d739fc72ea9a452f320406e3da5ecaa36821c75c" name="python3" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.45.1"/>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
</package>
<package pkgid="bf90cf80aaed9bd587236e9d500469f0e915a4fa64b7649dcd2ffaca3c111f28" name="python3-audit" arch="aarch64">
  <version epoch="0" ver="3.0.6" rel="150400.4.6.1"/>
  <changelog author="tonyj@suse.com" date="1578916800">- Update to version 2.8.5:
  * Fix segfault on shutdown
  * Fix hang on startup (#1587995)
  * Add sleep to script to dump state so file is ready when needed
  * Add auparse_normalizer support for SOFTWARE_UPDATE event
  * Mark netlabel events as simple events so that get processed quicker
  * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
  * Add 30-ospp-v42.rules to meet new Common Criteria requirements
  * Update lookup tables for the 4.18 kernel
  * In aureport, fix segfault in file report
  * Add auparse_normalizer support for labeled networking events
  * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
  * Event aging is off by a second
  * In ausearch/auparse, correct event ordering to process oldest first
  * auparse_reset was not clearing everything it should
  * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
  * In ausearch/report, lightly parse selinux portion of USER_AVC events
  * In ausearch/report, limit record size when malformed
  * In auditd, fix extract_type function for network originating events
  * In auditd, calculate right size and location for network originating events
  * Treat all network originating events as VER2 so dispatcher doesn't format it
  * In audisp-remote do an initial connection attempt (#1625156)
  * In auditd, allow expression of space left as a percentage (#1650670)
  * On PPC64LE systems, only allow 64 bit rules (#1462178)
  * Make some parts of auditd state report optional based on config
  * Fix ausearch when checkpointing a single file (Burn Alting)
  * Fix scripting in 31-privileged.rules wrt filecap (#1662516)
  * In ausearch, do not checkpt if stdin is input source
  * In libev, remove __cold__ attribute for functions to allow proper hardening
  * Add tests to configure.ac for openldap support
  * Make systemd support files use /run rather than /var/run (Christian Hesse)
  * Fix minor memory leak in auditd kerberos credentials code
  * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
  * In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Fix build errors when using gcc-10 no-common default (bsc#1160384)
  New patch: audit-fno-common.patch
- Refresh audit-allow-manual-stop.patch</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="abergmann@suse.com" date="1606910400">- Enable Aarch64 processor support. (bsc#1179515 bsc#1179806)</changelog>
  <changelog author="ematsumiya@suse.com" date="1611835200">- Create new "audit" group for read access to logs (bsc#1178154)
  * add change-default-log_group.patch
  * update audit-secondary.spec</changelog>
  <changelog author="dimstar@opensuse.org" date="1612180800">- Do not explicitly provide group(audit) in system-users-audit:
  this is automatically handled by rpm/providers.</changelog>
  <changelog author="ematsumiya@suse.com" date="1623672000">- Adjust audit.spec and audit-secondary.spec to support new version
- Include fix for libev
  * add libev-werror.patch
- Update to version 3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations
- In auditd, do not allow spaces in the hostname name format
- Big documentation cleanup (MIZUTA Takeshi)
- Update syscall table to the 5.12 kernel
- Update the auparse normalizer for new event types
- Fix compiler warnings in ids subsystem
- Block a couple signals from flush &amp; reconfigure threads
- In auditd, don't wait on flush thread when exiting
- Output error message if the path of input files are too long ausearch/report
  Included fixes from 3.0.1
- Update syscall table to the 5.11 kernel
- Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
- Only enable periodic timers when listening on the network
- Upgrade libev to 4.33
- Add auparse_new_buffer function to auparse library
- Use the select libev backend unless aggregating events
- Add sudoers to some base audit rules
- Update the auparse normalizer for some new syscalls and event types
  Included fixes from 3.0
- Generate checkpoint file even when no results are returned (Burn Alting)
- Fix log file creation when file logging is disabled entirely (Vlad Glagolev)
- Convert auparse_test to run with python3 (Tomá? Chvátal)
- Drop support for prelude
- Adjust backlog_wait_time in rules to the kernel default (#1482848)
- Remove ids key syntax checking of rules in auditctl
- Use SIGCONT to dump auditd internal state (#1504251)
- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903)
- Fix parsing of uid &amp; success for ausearch
- Add support for not equal operator in audit by executable (Ondrej Mosnacek)
- Hide lru symbols in auparse
- Add systemd process protections
- Fix aureport summary time range reporting
- Allow unlimited retries on startup for remote logging
- Add queue_depth to remote logging stats and increase default queue_depth size
- Fix segfault on shutdown
- Merge auditd and audispd code
- Close on execute init_pipe fd (#1587995)
- Breakout audisp syslog plugin to be standalone program
- Create a common internal library to reduce code
- Move all audispd config files under /etc/audit/
- Move audispd.conf settings into auditd.conf
- Add queue depth statistics to internal state dump report
- Add network statistics to internal state dump report
- SIGUSR now also restarts queue processing if its suspended
- Update lookup tables for the 4.18 kernel
- Add auparse_normalizer support for SOFTWARE_UPDATE event
- Add 30-ospp-v42.rules to meet new Common Criteria requirements
- Deprecate enable_krb and replace with transport config opt for remote logging
- Mark netlabel events as simple events so that get processed quicker
- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
- In aureport, fix segfault in file report
- Add auparse_normalizer support for labeled networking events
- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
- In ausearch/auparse, event aging is off by a second
- In ausearch/auparse, correct event ordering to process oldest first
- Migrate auparse python test to python3
- auparse_reset was not clearing everything it should
- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
- In ausearch/report, lightly parse selinux portion of USER_AVC events
- Add bpf syscall command argument interpretation to auparse
- In ausearch/report, limit record size when malformed
- Port af_unix plugin to libev
- In auditd, fix extract_type function for network originating events
- In auditd, calculate right size and location for network originating events
- Make legacy script wait for auditd to terminate (#1643567)
- Treat all network originating events as VER2 so dispatcher doesn't format it
- If an event has a node name make it VER2 so dispatcher doesnt format it
- In audisp-remote do an initial connection attempt (#1625156)
- In auditd, allow expression of space left as a percentage (#1650670)
- On PPC64LE systems, only allow 64 bit rules (#1462178)
- Make some parts of auditd state report optional based on config
- Update to libev-4.25
- Fix ausearch when checkpointing a single file (Burn Alting)
- Fix scripting in 31-privileged.rules wrt filecap (#1662516)
- In ausearch, do not checkpt if stdin is input source
- In libev, remove __cold__ attribute for functions to allow proper hardening
- Add tests to configure.ac for openldap support
- Make systemd support files use /run rather than /var/run (Christian Hesse)
- Fix minor memory leak in auditd kerberos credentials code
- Allow exclude and user filter by executable name (Ondrej Mosnacek)
- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
- In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Add substitue functions for strndupa &amp; rawmemchr
- Fix memleak in auparse caused by corrected event ordering
- Fix legacy reload script to reload audit rules when daemon is reloaded
- Support for unescaping in trusted messages (Dmitry Voronin)
- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
- In aureport, fix segfault for malformed USER_CMD events
- Add exe field to audit_log_user_command in libaudit
- In auditctl support filter on socket address families (Richard Guy Briggs)
- Deprecate support for Alpha &amp; IA64 processors
- If space_left_action is rotate, allow it every time (#1718444)
- In auparse, drop standalone EOE events
- Add milliseconds column for ausearch extra time csv format
- Fix aureport first event reporting when no start given
- In audisp-remote, add new config item for startup connection errors
- Remove dependency on chkconfig
- Install rules to /usr/share/audit/sample-rules/
- Split up ospp rules to make SCAP scanning easier (#1746018)
- In audisp-syslog, support interpreting records (#1497279)
- Audit USER events now sends msg as name value pair
- Add support for AUDIT_BPF event
- Auditd should not process AUDIT_REPLACE events
- Update syscall tables to the 5.5 kernel
- Improve personality interpretation by using PERS_MASK
- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup
- Change auparse python bindings to shared object (Issue #121)
- Add error messages for watch permissions
- If audit rules file doesn't exist log error message instead of info message
- Revise error message for unmatched options in auditctl
- In audisp-remote, fixup remote endpoint disappearin in ascii format
- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander)
- In auditctl, add support for sending a signal to auditd
- Removes audit-fno-common.patch: fixed in upstream
- Removes audit-python3.patch: fixed in upstream</changelog>
  <changelog author="ematsumiya@suse.com" date="1627646400">- Update to version 3.0.3:
  * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined
  * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids
  * Change auparse_feed_has_data in auparse to include incomplete events
  * Auditd, stop linking against -lrt
  * Add ProtectHome and RestrictRealtime to auditd.service
  * In auditd, read up to 3 netlink packets in a row
  * In auditd, do not validate path to plugin unless active
  * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists
- use https source urls</changelog>
  <changelog author="meissner@suse.com" date="1629115200">- harden_auditd.service.patch: automatic hardening applied to systemd
  services</changelog>
  <changelog author="ematsumiya@suse.com" date="1631793600">- Change default log_format from ENRICHED to RAW (bsc#1190500):
  * add change-default-log_format.patch (SUSE-specific patch)
- Update to version 3.0.5:
  * In auditd, flush uid/gid caches when user/group added/deleted/modified
  * Fixed various issues when dealing with corrupted logs
  * In auditd, check if log_file is valid before closing handle
- Include fixed from 3.0.4:
  * Apply performance speedups to auparse library
  * Optimize rule loading in auditctl
  * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath
  * Update syscall table to the 5.14 kernel
  * Fixed various issues when dealing with corrupted logs</changelog>
  <changelog author="ematsumiya@suse.com" date="1632139200">- Fix hardened auditd.service (bsc#1181400)
  * add fix-hardened-service.patch
    Make /etc/audit read-write from the service.
    Remove PrivateDevices=true to expose /dev/* to auditd.service.
- Enable stop rules for audit.service (cf. bsc#1190227)
  * add enable-stop-rules.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1634126400">- Create separate service for augenrules (bsc#1191614, bsc#1181400)
  * add create-augenrules-service.patch
  Remove ReadWritePaths=/etc/audit from auditd.service, also removes
  augenrules call from ExecStartPost.
  Create augenrules.service with the ReadWritePaths directive above.
  This makes /etc/audit only accessible by augenrules.service and
  let auditd.service (and daemon) to be sandboxed again.
- Update audit-secondary.spec to accomodate the new service file.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634299200">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636286400">- Update to version 3.0.6:
  * fixes a segfault on some SELINUX_ERR records
  * makes IPX packet interpretation dependent on the ipx header
    file existing
  * adds b32/b64 support to ausyscall
  * adds support for armv8l
  * fixes auditctl list of syscalls on PPC
  * auditd.service now restarts auditd under some conditions</changelog>
  <changelog author="fvogt@suse.com" date="1638187200">- Use %autosetup
- Don't include sample rules as %doc, they're already installed
  as normal files
- Fix create-augenrules-service.patch:
  * auditd.service needs to require augenrules.service,
    not the other way around
- Fix documentation for enable-stop-rules.patch</changelog>
  <changelog author="dmueller@suse.com" date="1648036800">- add audit-userspace-517-compat.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1648209600">- Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645)
  * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
- Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517)
  * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Fix buildrequire for openldap2-devel - audit doesn't require the
  (outdated) C++ binding, but the C headers that happen to be pulled
  in by buildrequiring the C++ devel package</changelog>
  <changelog author="jengelh@inai.de" date="1649678400">- Drop buildrequire on C++ compiler.
- Modernize specfile constructs.</changelog>
  <changelog author="ali.abdallah@suse.com" date="1659441600">- Update audit-secondary.spec: create symbolic link from
  /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519).</changelog>
  <changelog author="lidong.zhong@suse.com" date="1667304000">- Fix rules not loaded when restarting auditd.service(bsc#1204844)</changelog>
</package>
<package pkgid="2170df737f1d24446a9ece9712d498540d3e9765486ba99f25bd64a5094a6543" name="python3-audit" arch="x86_64">
  <version epoch="0" ver="3.0.6" rel="150400.4.6.1"/>
  <changelog author="tonyj@suse.com" date="1578916800">- Update to version 2.8.5:
  * Fix segfault on shutdown
  * Fix hang on startup (#1587995)
  * Add sleep to script to dump state so file is ready when needed
  * Add auparse_normalizer support for SOFTWARE_UPDATE event
  * Mark netlabel events as simple events so that get processed quicker
  * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
  * Add 30-ospp-v42.rules to meet new Common Criteria requirements
  * Update lookup tables for the 4.18 kernel
  * In aureport, fix segfault in file report
  * Add auparse_normalizer support for labeled networking events
  * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
  * Event aging is off by a second
  * In ausearch/auparse, correct event ordering to process oldest first
  * auparse_reset was not clearing everything it should
  * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
  * In ausearch/report, lightly parse selinux portion of USER_AVC events
  * In ausearch/report, limit record size when malformed
  * In auditd, fix extract_type function for network originating events
  * In auditd, calculate right size and location for network originating events
  * Treat all network originating events as VER2 so dispatcher doesn't format it
  * In audisp-remote do an initial connection attempt (#1625156)
  * In auditd, allow expression of space left as a percentage (#1650670)
  * On PPC64LE systems, only allow 64 bit rules (#1462178)
  * Make some parts of auditd state report optional based on config
  * Fix ausearch when checkpointing a single file (Burn Alting)
  * Fix scripting in 31-privileged.rules wrt filecap (#1662516)
  * In ausearch, do not checkpt if stdin is input source
  * In libev, remove __cold__ attribute for functions to allow proper hardening
  * Add tests to configure.ac for openldap support
  * Make systemd support files use /run rather than /var/run (Christian Hesse)
  * Fix minor memory leak in auditd kerberos credentials code
  * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
  * In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Fix build errors when using gcc-10 no-common default (bsc#1160384)
  New patch: audit-fno-common.patch
- Refresh audit-allow-manual-stop.patch</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="abergmann@suse.com" date="1606910400">- Enable Aarch64 processor support. (bsc#1179515 bsc#1179806)</changelog>
  <changelog author="ematsumiya@suse.com" date="1611835200">- Create new "audit" group for read access to logs (bsc#1178154)
  * add change-default-log_group.patch
  * update audit-secondary.spec</changelog>
  <changelog author="dimstar@opensuse.org" date="1612180800">- Do not explicitly provide group(audit) in system-users-audit:
  this is automatically handled by rpm/providers.</changelog>
  <changelog author="ematsumiya@suse.com" date="1623672000">- Adjust audit.spec and audit-secondary.spec to support new version
- Include fix for libev
  * add libev-werror.patch
- Update to version 3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations
- In auditd, do not allow spaces in the hostname name format
- Big documentation cleanup (MIZUTA Takeshi)
- Update syscall table to the 5.12 kernel
- Update the auparse normalizer for new event types
- Fix compiler warnings in ids subsystem
- Block a couple signals from flush &amp; reconfigure threads
- In auditd, don't wait on flush thread when exiting
- Output error message if the path of input files are too long ausearch/report
  Included fixes from 3.0.1
- Update syscall table to the 5.11 kernel
- Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
- Only enable periodic timers when listening on the network
- Upgrade libev to 4.33
- Add auparse_new_buffer function to auparse library
- Use the select libev backend unless aggregating events
- Add sudoers to some base audit rules
- Update the auparse normalizer for some new syscalls and event types
  Included fixes from 3.0
- Generate checkpoint file even when no results are returned (Burn Alting)
- Fix log file creation when file logging is disabled entirely (Vlad Glagolev)
- Convert auparse_test to run with python3 (Tomá? Chvátal)
- Drop support for prelude
- Adjust backlog_wait_time in rules to the kernel default (#1482848)
- Remove ids key syntax checking of rules in auditctl
- Use SIGCONT to dump auditd internal state (#1504251)
- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903)
- Fix parsing of uid &amp; success for ausearch
- Add support for not equal operator in audit by executable (Ondrej Mosnacek)
- Hide lru symbols in auparse
- Add systemd process protections
- Fix aureport summary time range reporting
- Allow unlimited retries on startup for remote logging
- Add queue_depth to remote logging stats and increase default queue_depth size
- Fix segfault on shutdown
- Merge auditd and audispd code
- Close on execute init_pipe fd (#1587995)
- Breakout audisp syslog plugin to be standalone program
- Create a common internal library to reduce code
- Move all audispd config files under /etc/audit/
- Move audispd.conf settings into auditd.conf
- Add queue depth statistics to internal state dump report
- Add network statistics to internal state dump report
- SIGUSR now also restarts queue processing if its suspended
- Update lookup tables for the 4.18 kernel
- Add auparse_normalizer support for SOFTWARE_UPDATE event
- Add 30-ospp-v42.rules to meet new Common Criteria requirements
- Deprecate enable_krb and replace with transport config opt for remote logging
- Mark netlabel events as simple events so that get processed quicker
- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
- In aureport, fix segfault in file report
- Add auparse_normalizer support for labeled networking events
- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
- In ausearch/auparse, event aging is off by a second
- In ausearch/auparse, correct event ordering to process oldest first
- Migrate auparse python test to python3
- auparse_reset was not clearing everything it should
- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
- In ausearch/report, lightly parse selinux portion of USER_AVC events
- Add bpf syscall command argument interpretation to auparse
- In ausearch/report, limit record size when malformed
- Port af_unix plugin to libev
- In auditd, fix extract_type function for network originating events
- In auditd, calculate right size and location for network originating events
- Make legacy script wait for auditd to terminate (#1643567)
- Treat all network originating events as VER2 so dispatcher doesn't format it
- If an event has a node name make it VER2 so dispatcher doesnt format it
- In audisp-remote do an initial connection attempt (#1625156)
- In auditd, allow expression of space left as a percentage (#1650670)
- On PPC64LE systems, only allow 64 bit rules (#1462178)
- Make some parts of auditd state report optional based on config
- Update to libev-4.25
- Fix ausearch when checkpointing a single file (Burn Alting)
- Fix scripting in 31-privileged.rules wrt filecap (#1662516)
- In ausearch, do not checkpt if stdin is input source
- In libev, remove __cold__ attribute for functions to allow proper hardening
- Add tests to configure.ac for openldap support
- Make systemd support files use /run rather than /var/run (Christian Hesse)
- Fix minor memory leak in auditd kerberos credentials code
- Allow exclude and user filter by executable name (Ondrej Mosnacek)
- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
- In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Add substitue functions for strndupa &amp; rawmemchr
- Fix memleak in auparse caused by corrected event ordering
- Fix legacy reload script to reload audit rules when daemon is reloaded
- Support for unescaping in trusted messages (Dmitry Voronin)
- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
- In aureport, fix segfault for malformed USER_CMD events
- Add exe field to audit_log_user_command in libaudit
- In auditctl support filter on socket address families (Richard Guy Briggs)
- Deprecate support for Alpha &amp; IA64 processors
- If space_left_action is rotate, allow it every time (#1718444)
- In auparse, drop standalone EOE events
- Add milliseconds column for ausearch extra time csv format
- Fix aureport first event reporting when no start given
- In audisp-remote, add new config item for startup connection errors
- Remove dependency on chkconfig
- Install rules to /usr/share/audit/sample-rules/
- Split up ospp rules to make SCAP scanning easier (#1746018)
- In audisp-syslog, support interpreting records (#1497279)
- Audit USER events now sends msg as name value pair
- Add support for AUDIT_BPF event
- Auditd should not process AUDIT_REPLACE events
- Update syscall tables to the 5.5 kernel
- Improve personality interpretation by using PERS_MASK
- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup
- Change auparse python bindings to shared object (Issue #121)
- Add error messages for watch permissions
- If audit rules file doesn't exist log error message instead of info message
- Revise error message for unmatched options in auditctl
- In audisp-remote, fixup remote endpoint disappearin in ascii format
- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander)
- In auditctl, add support for sending a signal to auditd
- Removes audit-fno-common.patch: fixed in upstream
- Removes audit-python3.patch: fixed in upstream</changelog>
  <changelog author="ematsumiya@suse.com" date="1627646400">- Update to version 3.0.3:
  * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined
  * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids
  * Change auparse_feed_has_data in auparse to include incomplete events
  * Auditd, stop linking against -lrt
  * Add ProtectHome and RestrictRealtime to auditd.service
  * In auditd, read up to 3 netlink packets in a row
  * In auditd, do not validate path to plugin unless active
  * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists
- use https source urls</changelog>
  <changelog author="meissner@suse.com" date="1629115200">- harden_auditd.service.patch: automatic hardening applied to systemd
  services</changelog>
  <changelog author="ematsumiya@suse.com" date="1631793600">- Change default log_format from ENRICHED to RAW (bsc#1190500):
  * add change-default-log_format.patch (SUSE-specific patch)
- Update to version 3.0.5:
  * In auditd, flush uid/gid caches when user/group added/deleted/modified
  * Fixed various issues when dealing with corrupted logs
  * In auditd, check if log_file is valid before closing handle
- Include fixed from 3.0.4:
  * Apply performance speedups to auparse library
  * Optimize rule loading in auditctl
  * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath
  * Update syscall table to the 5.14 kernel
  * Fixed various issues when dealing with corrupted logs</changelog>
  <changelog author="ematsumiya@suse.com" date="1632139200">- Fix hardened auditd.service (bsc#1181400)
  * add fix-hardened-service.patch
    Make /etc/audit read-write from the service.
    Remove PrivateDevices=true to expose /dev/* to auditd.service.
- Enable stop rules for audit.service (cf. bsc#1190227)
  * add enable-stop-rules.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1634126400">- Create separate service for augenrules (bsc#1191614, bsc#1181400)
  * add create-augenrules-service.patch
  Remove ReadWritePaths=/etc/audit from auditd.service, also removes
  augenrules call from ExecStartPost.
  Create augenrules.service with the ReadWritePaths directive above.
  This makes /etc/audit only accessible by augenrules.service and
  let auditd.service (and daemon) to be sandboxed again.
- Update audit-secondary.spec to accomodate the new service file.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634299200">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636286400">- Update to version 3.0.6:
  * fixes a segfault on some SELINUX_ERR records
  * makes IPX packet interpretation dependent on the ipx header
    file existing
  * adds b32/b64 support to ausyscall
  * adds support for armv8l
  * fixes auditctl list of syscalls on PPC
  * auditd.service now restarts auditd under some conditions</changelog>
  <changelog author="fvogt@suse.com" date="1638187200">- Use %autosetup
- Don't include sample rules as %doc, they're already installed
  as normal files
- Fix create-augenrules-service.patch:
  * auditd.service needs to require augenrules.service,
    not the other way around
- Fix documentation for enable-stop-rules.patch</changelog>
  <changelog author="dmueller@suse.com" date="1648036800">- add audit-userspace-517-compat.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1648209600">- Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645)
  * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
- Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517)
  * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Fix buildrequire for openldap2-devel - audit doesn't require the
  (outdated) C++ binding, but the C headers that happen to be pulled
  in by buildrequiring the C++ devel package</changelog>
  <changelog author="jengelh@inai.de" date="1649678400">- Drop buildrequire on C++ compiler.
- Modernize specfile constructs.</changelog>
  <changelog author="ali.abdallah@suse.com" date="1659441600">- Update audit-secondary.spec: create symbolic link from
  /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519).</changelog>
  <changelog author="lidong.zhong@suse.com" date="1667304000">- Fix rules not loaded when restarting auditd.service(bsc#1204844)</changelog>
</package>
<package pkgid="952fcee05e8e0331bf34c44adeeaae8181c82a7ad3a640cf83202ab081cf65f2" name="python3-base" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="57e7cf9ea44cd70f442f4fee74c461b2dbe3c9501ff5243705e66a24af008891" name="python3-base" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="3722265f2cd65fd45a673411a17c4168e1fc2155b856c0448521f7bf42eb1c6e" name="python3-base" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="dc2532e5731cdf087451e2ff217183cca39ce7b3609d3d3d93b1abb56d4439f9" name="python3-base" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="3ce67a0365c4883a8d18c041cbbbe88e1a72bb948ffa85050b716ffb9a7420aa" name="python3-base" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.45.1"/>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
</package>
<package pkgid="43e29dd98605696ac217beb5fa63cba7784e954d15f142cc6533e1ab4ce3f8e7" name="python3-base" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.45.1"/>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
</package>
<package pkgid="1a516b9bf945ed1b96c8234328f20d4ac4aefb6db5904993e6d4cf4cbf06266b" name="python3-cairo" arch="aarch64">
  <version epoch="0" ver="1.15.1" rel="150000.3.8.1"/>
  <changelog author="vuntz@opensuse.org" date="1308312000">- Update to version 1.10.0:
  + New Constants:
  - cairo.FORMAT_RGB16_565
  + Bug Fixes:
  - context.get_source().get_surface() fails (fdo#33013)
  + Improve/simplify unicode filename and text support.
  + Build related changes.
- Move to using waf for the build as the autotools support is
  broken.
- Recompile the generated byte-code with %py_compile, as the
  waf-generated byte-code references the build root. This is a bug
  in waf, see http://code.google.com/p/waf/issues/detail?id=986</changelog>
  <changelog author="coolo@suse.com" date="1326196800">- trying to get the license right for spdx</changelog>
  <changelog author="saschpe@suse.de" date="1328097600">- Add group to devel package</changelog>
  <changelog author="schwab@linux-m68k.org" date="1349697600">- Build with %{optflags}</changelog>
  <changelog author="idonmez@suse.com" date="1365163200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="toddrme2178@gmail.com" date="1488024000">- Add python2-cairo and python2-cairo-devel provides for
  compatibility with the new multipython spec file macros.</changelog>
  <changelog author="dimstar@opensuse.org" date="1497787200">- Update to version 1.13.3:
  + Fix ImageSurface leaking in case
    :meth:`get_data() &lt;ImageSurface.get_data&gt;` is used under
    Python 3 (gh#pygobject/pycairo#43).
- Changes from version 1.13.2:
  + Fix pip failing to install pycairo in some cases
    (gh#pygobject/pycairo#39).
- Changes from version 1.13.1:
  + setup.py install: Fix generated pkg-config file if ``--home``
    or ``--user`` is specified (gh#pygobject/pycairo#34).
  + Fix a build error on macOS Sierra (gh#pygobject/pycairo#36)
  + examples: Fix snippet examples when .pyc files are present
    (gh#pygobject/pycairo#35).
- For more changes since the last package update, see NEWS inside.
- Implement python single-spec packaging: since pycairo 1.11.0, the
  sources for python2 and python3 based bindings have been merged
  again.</changelog>
  <changelog author="jmatejek@suse.com" date="1498219200">- fix requires for devel subpackage</changelog>
  <changelog author="zaitor@opensuse.org" date="1503576000">- Update to version 1.15.1:
  + Fixes:
  - Improved support for Python filesystem paths including
    os.PathLike. See pathlike for details.
  - Various minor fixes.
  + Changes: Expose cairo.Path.
  + Tests: Improved test coverage from ~70% to ~90%.
- Changes from version 1.15.0:
  + New Features:
  - Add Surface.map_to_image() and Surface.unmap_image().
  - Add RasterSourcePattern.
  - Add Glyph.
  - Add Rectangle.
  - Add TextCluster.
  - Add ScaledFont.text_to_glyphs() and
    ScaledFont.glyph_extents().
  - Add Context.show_text_glyphs().
  - Add TextExtents.
  + Changes:
  - Pycairo instances wrapping the same underlying cairo object
    now hash and compare equally e.g. context.get_target() ==
    context.get_target().
  - Functions which returned a cairo error with Status.NO_MEMORY
    no longer raise MemoryError, but a subclass of Error and
    MemoryError. Similarly errors with Status.READ_ERROR and
    Status.WRITE_ERROR no longer raise IOError, but a subclass of
    Error and IOError.
  - Some functions which previously returned a tuple now return a
    tuple subclass like Rectangle, Glyph, TextCluster and
    TextExtents.
- Changes from version 1.14.1:
  + Fixes: Fix a crash with Surface.get_device().
- Changes from version 1.14.0:
  + General: Requires at least cairo 1.13.1.
  + Tests: Optional Hypothesis tests.
  + New Features:
  - Add Surface.set_device_scale() and
    Surface.get_device_scale().
  - Add Device.
  - Add Surface.get_device().
  - Add ScriptDevice and ScriptMode.
  - Add ScriptSurface.
  - Add Status.JBIG2_GLOBAL_MISSING.
  - Add Format.stride_for_width().
  - Add TextClusterFlags and SurfaceObserverMode.
  - Add Gradient.get_color_stops_rgba().
  - Add TeeSurface.
  - Add MeshPattern.
- Changes from version 1.13.4:
  + Fixes: Fix a rare crash with get_data() under Python 3 (1.13.3
    regression).</changelog>
  <changelog author="tchvatal@suse.com" date="1563969600">- Provide python-pycairo symbol to play nice with backporting
  python stack as new TW contains just this as a proper package
  name bsc#1142582</changelog>
</package>
<package pkgid="e0c2623c719ab989a53661bef63b46d57fb9688e64d26e4691ad4238b5cb65ae" name="python3-cairo" arch="x86_64">
  <version epoch="0" ver="1.15.1" rel="150000.3.8.1"/>
  <changelog author="vuntz@opensuse.org" date="1308312000">- Update to version 1.10.0:
  + New Constants:
  - cairo.FORMAT_RGB16_565
  + Bug Fixes:
  - context.get_source().get_surface() fails (fdo#33013)
  + Improve/simplify unicode filename and text support.
  + Build related changes.
- Move to using waf for the build as the autotools support is
  broken.
- Recompile the generated byte-code with %py_compile, as the
  waf-generated byte-code references the build root. This is a bug
  in waf, see http://code.google.com/p/waf/issues/detail?id=986</changelog>
  <changelog author="coolo@suse.com" date="1326196800">- trying to get the license right for spdx</changelog>
  <changelog author="saschpe@suse.de" date="1328097600">- Add group to devel package</changelog>
  <changelog author="schwab@linux-m68k.org" date="1349697600">- Build with %{optflags}</changelog>
  <changelog author="idonmez@suse.com" date="1365163200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="toddrme2178@gmail.com" date="1488024000">- Add python2-cairo and python2-cairo-devel provides for
  compatibility with the new multipython spec file macros.</changelog>
  <changelog author="dimstar@opensuse.org" date="1497787200">- Update to version 1.13.3:
  + Fix ImageSurface leaking in case
    :meth:`get_data() &lt;ImageSurface.get_data&gt;` is used under
    Python 3 (gh#pygobject/pycairo#43).
- Changes from version 1.13.2:
  + Fix pip failing to install pycairo in some cases
    (gh#pygobject/pycairo#39).
- Changes from version 1.13.1:
  + setup.py install: Fix generated pkg-config file if ``--home``
    or ``--user`` is specified (gh#pygobject/pycairo#34).
  + Fix a build error on macOS Sierra (gh#pygobject/pycairo#36)
  + examples: Fix snippet examples when .pyc files are present
    (gh#pygobject/pycairo#35).
- For more changes since the last package update, see NEWS inside.
- Implement python single-spec packaging: since pycairo 1.11.0, the
  sources for python2 and python3 based bindings have been merged
  again.</changelog>
  <changelog author="jmatejek@suse.com" date="1498219200">- fix requires for devel subpackage</changelog>
  <changelog author="zaitor@opensuse.org" date="1503576000">- Update to version 1.15.1:
  + Fixes:
  - Improved support for Python filesystem paths including
    os.PathLike. See pathlike for details.
  - Various minor fixes.
  + Changes: Expose cairo.Path.
  + Tests: Improved test coverage from ~70% to ~90%.
- Changes from version 1.15.0:
  + New Features:
  - Add Surface.map_to_image() and Surface.unmap_image().
  - Add RasterSourcePattern.
  - Add Glyph.
  - Add Rectangle.
  - Add TextCluster.
  - Add ScaledFont.text_to_glyphs() and
    ScaledFont.glyph_extents().
  - Add Context.show_text_glyphs().
  - Add TextExtents.
  + Changes:
  - Pycairo instances wrapping the same underlying cairo object
    now hash and compare equally e.g. context.get_target() ==
    context.get_target().
  - Functions which returned a cairo error with Status.NO_MEMORY
    no longer raise MemoryError, but a subclass of Error and
    MemoryError. Similarly errors with Status.READ_ERROR and
    Status.WRITE_ERROR no longer raise IOError, but a subclass of
    Error and IOError.
  - Some functions which previously returned a tuple now return a
    tuple subclass like Rectangle, Glyph, TextCluster and
    TextExtents.
- Changes from version 1.14.1:
  + Fixes: Fix a crash with Surface.get_device().
- Changes from version 1.14.0:
  + General: Requires at least cairo 1.13.1.
  + Tests: Optional Hypothesis tests.
  + New Features:
  - Add Surface.set_device_scale() and
    Surface.get_device_scale().
  - Add Device.
  - Add Surface.get_device().
  - Add ScriptDevice and ScriptMode.
  - Add ScriptSurface.
  - Add Status.JBIG2_GLOBAL_MISSING.
  - Add Format.stride_for_width().
  - Add TextClusterFlags and SurfaceObserverMode.
  - Add Gradient.get_color_stops_rgba().
  - Add TeeSurface.
  - Add MeshPattern.
- Changes from version 1.13.4:
  + Fixes: Fix a rare crash with get_data() under Python 3 (1.13.3
    regression).</changelog>
  <changelog author="tchvatal@suse.com" date="1563969600">- Provide python-pycairo symbol to play nice with backporting
  python stack as new TW contains just this as a proper package
  name bsc#1142582</changelog>
</package>
<package pkgid="440aad4a371cc6e57a35cf360f89645c29780c6dc292e8fac1fb011ede1f0180" name="python3-certifi" arch="noarch">
  <version epoch="0" ver="2018.1.18" rel="150000.3.3.1"/>
  <changelog author="mcihar@suse.cz" date="1429704000">- Initial packaging</changelog>
  <changelog author="toddrme2178@gmail.com" date="1443268800">- Update to version 2015.9.6.2:
  * Actually ship weak cert bundle.
  * Provide old cert bundle.
  * Use secure roots by default.
  * Update scripts to use mkcert.org
  * Concatenate the two roots
  * Add the needed 1024-bit roots
  * Move mkcert output to non-core file
- Fix dependencies on SLES 11
- Certifi is released under MPL-2.0; fix the license tag
- Rebase python-certifi-shipped-requests-cabundle.patch</changelog>
  <changelog author="michael@stroeder.com" date="1453464000">- Update to version 2015.11.20.1</changelog>
  <changelog author="jacobwinski@gmail.com" date="1464955200">- Update to version 2016.2.28
- Update copyright year in spec file
- Fix executable warning (fix taken from python3-certifi)</changelog>
  <changelog author="aloisio@gmx.com" date="1491652800">- Updated to version 2017.1.23
- Converted to single-spec
- Updated source URL</changelog>
  <changelog author="dmueller@suse.com" date="1497096000">- update to 2017.4.17</changelog>
  <changelog author="dmueller@suse.com" date="1497182400">- require ca-certificates-mozilla, otherwise certifi does not
  provide any ca bundle (the bundled one that openSUSE patches
  out is the mozilla bundle as well)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1499688000">- Fix wrong-script-interpreter rpmlint error.
- Fix script-without-shebang rpmlint warning.</changelog>
  <changelog author="arun@gmx.de" date="1507032000">- updated patch
- update to version 2017.7.27.1:
  * Use a more expressive API for getting the dir a path is in
  * set zip_safe=False to help out setuptools (#63)
  * Change license from ISC to MPL-2.0 in setup.py
  * Add trove classifiers for missing supported Python versions
  * Rename [wheel] section to [bdist_wheel] as the former is legacy</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1507809600">- add patch to fix version string from 2017.07.27.1 to
  2017.7.27.1 to fix the build on SLE12_SP3 and earlier
  + python-certifi-fix-version-string.patch</changelog>
  <changelog author="jmatejek@suse.com" date="1508328000">- fix macros to support not having python2</changelog>
  <changelog author="dmueller@suse.com" date="1510660800">- update to 2017.11.5:
  * Sync with bundle mozilla release
- remove  python-certifi-fix-version-string.patch: obsolete</changelog>
  <changelog author="arun@gmx.de" date="1517745600">- specfile:
  * update copyright year
- update to version 2018.1.18:
  * Remove 1024-bit root certificates
  * Include license in the list of trove classifiers
  * Include license file in the generated wheel package</changelog>
  <changelog author="dbenini@suse.com" date="1672488000">- remove all TrustCor CAs, as TrustCor issued multiple man-in-the-middle
  certs (bsc#1206212 CVE-2022-23491)
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - TrustCor ECA-1
- Add removeTrustCor.patch</changelog>
</package>
<package pkgid="606debca9eea3aabc5c2ba6adba79895a05c25d7d93cd136caaed67df91ed044" name="python3-core" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="2e5f87c5482cdad34873a1f98c7efe045be3cfc7f3d61220989f0bfdc428a6a7" name="python3-core" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="86d79e1579af138962c5d087dcfb9a5c38e19e6e58127f212db8b8b01b32edaf" name="python3-core" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.45.1"/>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
</package>
<package pkgid="666b49c7db29e0272d10f5566109a028555d368dcbe5b29faa36bef4800b2f99" name="python3-cryptography" arch="aarch64">
  <version epoch="0" ver="3.3.2" rel="150400.16.6.1"/>
  <changelog author="tchvatal@suse.com" date="1534852800">- Update to 2.3.1:
  * updated tests for upstream wycheproof changes
  * many other tiny test tweaks</changelog>
  <changelog author="tchvatal@suse.com" date="1544097600">- Fix fdupes call</changelog>
  <changelog author="mcepl@suse.com" date="1544097601">- Update to 2.4.1:
  * Dropped support for LibreSSL 2.4.x.
  * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no
    longer supported by the OpenSSL project. At this time there
    is no time table for dropping support, however we strongly
    encourage all users to upgrade or install cryptography from
    a wheel.
  * Added initial :doc:`OCSP &lt;/x509/ocsp&gt;` support.
  * Added support for cryptography.x509.PrecertPoison.</changelog>
  <changelog author="mpluskal@suse.com" date="1546516800">- Update to version 2.4.2:
  * Updated Windows, macOS, and manylinux1 wheels to be compiled
    with OpenSSL 1.1.0j.</changelog>
  <changelog author="michael@stroeder.com" date="1548417600">- Dependency on python-idna changed to "Recommends" aligned with
  change in upstream source (see below)
- update to 2.5:
  * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1,
    but this version removes the default idna dependency as well. If you still
    need this deprecated path please install cryptography with the idna extra:
    pip install cryptography[idna].
  * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4.
  * Numerous classes and functions have been updated to allow bytes-like
    types for keying material and passwords, including symmetric algorithms,
    AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a.
  * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1.
  * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1.
  * Added support for X448 key exchange when using OpenSSL 1.1.1.
  * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1.
  * Added initial support for parsing PKCS12 files with load_key_and_certificates().
  * Added support for IssuingDistributionPoint.
  * Added rfc4514_string() method to x509.Name,
    x509.RelativeDistinguishedName, and x509.NameAttribute to format the name
    or component an RFC 4514 Distinguished Name string.
  * Added from_encoded_point(), which immediately checks if the point is on
    the curve and supports compressed points. Deprecated the previous method
    from_encoded_point().
  * Added signature_hash_algorithm to OCSPResponse.
  * Updated X25519 key exchange support to allow additional serialization
    methods. Calling public_bytes() with no arguments has been deprecated.
  * Added support for encoding compressed and uncompressed points via
    public_bytes(). Deprecated the previous method encode_point().</changelog>
  <changelog author="michael@stroeder.com" date="1551355200">- update to 2.6.1:
  * BACKWARDS INCOMPATIBLE:
    Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature
    andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature,
    which had been deprecated for nearly 4 years. Use encode_dss_signature()
    and decode_dss_signature()instead.
  * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which
    had been deprecated for nearly 3 years. Use serial_number instead.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with
    OpenSSL 1.1.1b.
  * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer.
  * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer.
  * load_ssh_public_key() can now load ed25519 public keys.
  * Add support for easily mapping an object identifier to its elliptic curve
    class viaget_curve_for_oid().
  * Add support for OpenSSL when compiled with the no-engine
    (OPENSSL_NO_ENGINE) flag.</changelog>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1595937600">- update to 3.0
- refreshed disable-uneven-sizes-tests.patch and  skip_openssl_memleak_test.patch
  * Removed support for passing an Extension instance
    to from_issuer_subject_key_identifier(), as per our deprecation policy.
  * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed
  * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer.
  * RSA generate_private_key() no longer accepts public_exponent values except
    65537 and 3 (the latter for legacy purposes).
  * X.509 certificate parsing now enforces that the version field contains
    a valid value, rather than deferring this check until version is accessed.
  * Deprecated support for Python 2
  * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa
    private keys: load_ssh_private_key() for loading and OpenSSH for writing.
  * Added support for OpenSSH certificates to load_ssh_public_key().
  * Added encrypt_at_time() and decrypt_at_time() to Fernet.
  * Added support for the SubjectInformationAccess X.509 extension.
  * Added support for parsing SignedCertificateTimestamps in OCSP responses.
  * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().
  * Added support for encoding attributes in certificate signing requests via add_attribute().
  * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG
    instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.
  * Added initial support for creating PKCS12 files with serialize_key_and_certificates().</changelog>
  <changelog author="dmueller@suse.com" date="1600430400">- update to 3.1:
  * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
    :term:`U-label` parsing in various X.509 classes. This support was originally
    deprecated in version 2.1 and moved to an extra in 2.5.
  * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
    the OpenSSL project. The next version of ``cryptography`` will drop support
    for it.
  * Deprecated support for Python 3.5. This version sees very little use and will
    be removed in the next release.
  * ``backend`` arguments to functions are no longer required and the
    default backend will automatically be selected if no ``backend`` is provided.
  * Added initial support for parsing certificates from PKCS7 files with
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
    and
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
    .
  * Calling ``update`` or ``update_into`` on
    :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
    longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
    also resolves the same issue in :doc:`/fernet`.</changelog>
  <changelog author="dmueller@suse.com" date="1601294400">- update to 3.1.1:
  * wheels compiled with OpenSSL 1.1.1h.</changelog>
  <changelog author="michael@stroeder.com" date="1603713600">- update to 3.2 (bsc#1178168, CVE-2020-25659):
  * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,
    to protect against Bleichenbacher vulnerabilities. Due to limitations imposed
    by our API, we cannot completely mitigate this vulnerability.
  * Support for OpenSSL 1.0.2 has been removed.
  * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
- drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists</changelog>
  <changelog author="michael@stroeder.com" date="1603886400">- update to 3.2.1:
  Disable blinding on RSA public keys to address an error with
  some versions of OpenSSL.</changelog>
  <changelog author="mcepl@suse.com" date="1607256000">- Remove unnecessary dependency virtualenv.</changelog>
  <changelog author="mrueckert@suse.de" date="1607515200">- update to 3.3.0
  - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed
    due to low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit
    to 1024-bit (8 byte to 128 byte) initialization vectors. This
    change is to conform with an upcoming OpenSSL release that will
    no longer support sizes outside this window.
  - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we
    now raise ValueError rather than UnsupportedAlgorithm when an
    unsupported cipher is used. This change is to conform with an
    upcoming OpenSSL release that will no longer distinguish
    between error types.
  - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite
    field Diffie-Hellman parameters of less than 512 bits in
    length. This change is to conform with an upcoming OpenSSL
    release that no longer supports smaller sizes. These keys were
    already wildly insecure and should not have been used in any
    application outside of testing.
  - Updated Windows, macOS, and manylinux wheels to be compiled
    with OpenSSL 1.1.1i.
  - Python 2 support is deprecated in cryptography. This is the
    last release that will support Python 2.
  - Added the recover_data_from_signature() function to
    RSAPublicKey for recovering the signed data from an RSA
    signature.</changelog>
  <changelog author="dmueller@suse.com" date="1608465600">- update to 3.3.1:
  * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use</changelog>
  <changelog author="michael@stroeder.com" date="1612699200">- update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331):
  * SECURITY ISSUE: Fixed a bug where certain sequences of update()
    calls when symmetrically encrypting very large payloads (&gt;2GB) could
    result in an integer overflow, leading to buffer overflows.
    CVE-2020-36242
  - drops CVE-2020-36242-buffer-overflow.patch on older dists</changelog>
  <changelog author="daniel.garcia@suse.com" date="1676289600">- Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931)
  * Don't allow update_into to mutate immutable objects</changelog>
</package>
<package pkgid="4e090ba8d4ab4477ebdb656201696737b0e40154e736ec9da93d8fdf34536d99" name="python3-cryptography" arch="x86_64">
  <version epoch="0" ver="3.3.2" rel="150400.16.6.1"/>
  <changelog author="tchvatal@suse.com" date="1534852800">- Update to 2.3.1:
  * updated tests for upstream wycheproof changes
  * many other tiny test tweaks</changelog>
  <changelog author="tchvatal@suse.com" date="1544097600">- Fix fdupes call</changelog>
  <changelog author="mcepl@suse.com" date="1544097601">- Update to 2.4.1:
  * Dropped support for LibreSSL 2.4.x.
  * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no
    longer supported by the OpenSSL project. At this time there
    is no time table for dropping support, however we strongly
    encourage all users to upgrade or install cryptography from
    a wheel.
  * Added initial :doc:`OCSP &lt;/x509/ocsp&gt;` support.
  * Added support for cryptography.x509.PrecertPoison.</changelog>
  <changelog author="mpluskal@suse.com" date="1546516800">- Update to version 2.4.2:
  * Updated Windows, macOS, and manylinux1 wheels to be compiled
    with OpenSSL 1.1.0j.</changelog>
  <changelog author="michael@stroeder.com" date="1548417600">- Dependency on python-idna changed to "Recommends" aligned with
  change in upstream source (see below)
- update to 2.5:
  * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1,
    but this version removes the default idna dependency as well. If you still
    need this deprecated path please install cryptography with the idna extra:
    pip install cryptography[idna].
  * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4.
  * Numerous classes and functions have been updated to allow bytes-like
    types for keying material and passwords, including symmetric algorithms,
    AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a.
  * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1.
  * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1.
  * Added support for X448 key exchange when using OpenSSL 1.1.1.
  * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1.
  * Added initial support for parsing PKCS12 files with load_key_and_certificates().
  * Added support for IssuingDistributionPoint.
  * Added rfc4514_string() method to x509.Name,
    x509.RelativeDistinguishedName, and x509.NameAttribute to format the name
    or component an RFC 4514 Distinguished Name string.
  * Added from_encoded_point(), which immediately checks if the point is on
    the curve and supports compressed points. Deprecated the previous method
    from_encoded_point().
  * Added signature_hash_algorithm to OCSPResponse.
  * Updated X25519 key exchange support to allow additional serialization
    methods. Calling public_bytes() with no arguments has been deprecated.
  * Added support for encoding compressed and uncompressed points via
    public_bytes(). Deprecated the previous method encode_point().</changelog>
  <changelog author="michael@stroeder.com" date="1551355200">- update to 2.6.1:
  * BACKWARDS INCOMPATIBLE:
    Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature
    andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature,
    which had been deprecated for nearly 4 years. Use encode_dss_signature()
    and decode_dss_signature()instead.
  * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which
    had been deprecated for nearly 3 years. Use serial_number instead.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with
    OpenSSL 1.1.1b.
  * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer.
  * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer.
  * load_ssh_public_key() can now load ed25519 public keys.
  * Add support for easily mapping an object identifier to its elliptic curve
    class viaget_curve_for_oid().
  * Add support for OpenSSL when compiled with the no-engine
    (OPENSSL_NO_ENGINE) flag.</changelog>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1595937600">- update to 3.0
- refreshed disable-uneven-sizes-tests.patch and  skip_openssl_memleak_test.patch
  * Removed support for passing an Extension instance
    to from_issuer_subject_key_identifier(), as per our deprecation policy.
  * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed
  * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer.
  * RSA generate_private_key() no longer accepts public_exponent values except
    65537 and 3 (the latter for legacy purposes).
  * X.509 certificate parsing now enforces that the version field contains
    a valid value, rather than deferring this check until version is accessed.
  * Deprecated support for Python 2
  * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa
    private keys: load_ssh_private_key() for loading and OpenSSH for writing.
  * Added support for OpenSSH certificates to load_ssh_public_key().
  * Added encrypt_at_time() and decrypt_at_time() to Fernet.
  * Added support for the SubjectInformationAccess X.509 extension.
  * Added support for parsing SignedCertificateTimestamps in OCSP responses.
  * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().
  * Added support for encoding attributes in certificate signing requests via add_attribute().
  * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG
    instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.
  * Added initial support for creating PKCS12 files with serialize_key_and_certificates().</changelog>
  <changelog author="dmueller@suse.com" date="1600430400">- update to 3.1:
  * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
    :term:`U-label` parsing in various X.509 classes. This support was originally
    deprecated in version 2.1 and moved to an extra in 2.5.
  * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
    the OpenSSL project. The next version of ``cryptography`` will drop support
    for it.
  * Deprecated support for Python 3.5. This version sees very little use and will
    be removed in the next release.
  * ``backend`` arguments to functions are no longer required and the
    default backend will automatically be selected if no ``backend`` is provided.
  * Added initial support for parsing certificates from PKCS7 files with
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
    and
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
    .
  * Calling ``update`` or ``update_into`` on
    :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
    longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
    also resolves the same issue in :doc:`/fernet`.</changelog>
  <changelog author="dmueller@suse.com" date="1601294400">- update to 3.1.1:
  * wheels compiled with OpenSSL 1.1.1h.</changelog>
  <changelog author="michael@stroeder.com" date="1603713600">- update to 3.2 (bsc#1178168, CVE-2020-25659):
  * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,
    to protect against Bleichenbacher vulnerabilities. Due to limitations imposed
    by our API, we cannot completely mitigate this vulnerability.
  * Support for OpenSSL 1.0.2 has been removed.
  * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
- drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists</changelog>
  <changelog author="michael@stroeder.com" date="1603886400">- update to 3.2.1:
  Disable blinding on RSA public keys to address an error with
  some versions of OpenSSL.</changelog>
  <changelog author="mcepl@suse.com" date="1607256000">- Remove unnecessary dependency virtualenv.</changelog>
  <changelog author="mrueckert@suse.de" date="1607515200">- update to 3.3.0
  - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed
    due to low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit
    to 1024-bit (8 byte to 128 byte) initialization vectors. This
    change is to conform with an upcoming OpenSSL release that will
    no longer support sizes outside this window.
  - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we
    now raise ValueError rather than UnsupportedAlgorithm when an
    unsupported cipher is used. This change is to conform with an
    upcoming OpenSSL release that will no longer distinguish
    between error types.
  - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite
    field Diffie-Hellman parameters of less than 512 bits in
    length. This change is to conform with an upcoming OpenSSL
    release that no longer supports smaller sizes. These keys were
    already wildly insecure and should not have been used in any
    application outside of testing.
  - Updated Windows, macOS, and manylinux wheels to be compiled
    with OpenSSL 1.1.1i.
  - Python 2 support is deprecated in cryptography. This is the
    last release that will support Python 2.
  - Added the recover_data_from_signature() function to
    RSAPublicKey for recovering the signed data from an RSA
    signature.</changelog>
  <changelog author="dmueller@suse.com" date="1608465600">- update to 3.3.1:
  * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use</changelog>
  <changelog author="michael@stroeder.com" date="1612699200">- update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331):
  * SECURITY ISSUE: Fixed a bug where certain sequences of update()
    calls when symmetrically encrypting very large payloads (&gt;2GB) could
    result in an integer overflow, leading to buffer overflows.
    CVE-2020-36242
  - drops CVE-2020-36242-buffer-overflow.patch on older dists</changelog>
  <changelog author="daniel.garcia@suse.com" date="1676289600">- Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931)
  * Don't allow update_into to mutate immutable objects</changelog>
</package>
<package pkgid="9d1eefe6fa1edc7baf76d90a443d136fccb743fd3e45bbc768f353424ca5824b" name="python3-future" arch="noarch">
  <version epoch="0" ver="0.18.2" rel="150300.3.3.1"/>
  <changelog author="glin@suse.com" date="1450094400">- initial import: 0.15.2 (fate#320644)</changelog>
  <changelog author="glin@suse.com" date="1473422400">- Remove %ghost from %{_bindir}/futurize and %{_bindir}/pasteurize
  (fate#320644)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1473940800">- Fix update-alternatives usage.</changelog>
  <changelog author="okurz@suse.com" date="1474459200">- Fix rpm uninstall warnings by removing alternatives in postun as
  discussed in https://build.opensuse.org/request/show/427095</changelog>
  <changelog author="ms@suse.com" date="1476187200">- Tracker changelog entry to add python-future to SLE12 (bnc#999200)</changelog>
  <changelog author="mimi.vx@gmail.com" date="1480075200">- update to 0.16.0
  * Fix newbytes constructor bug.
  * Fix semantics of bool() with newobject.
  * Fix standard_library.install_aliases() on PyPy
  * Fix assertRaises for pow and compile` on Python 3.5.
  * Fix return argument of future.utils.ensure_new_type
  if conversion to new type does not exist.
  * Add missing cmp_to_key for Py2.6.
  * Allow the old_div fixer to be disabled.
  * Improve compatibility with Google App Engine.
  * Add some missing imports to the tkinter and tkinter.filedialog
  package namespaces
  * Fix raise_from on PY3 when the exception cannot be recreated from its repr.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1491480000">- Implement single-spec version</changelog>
  <changelog author="toddrme2178@gmail.com" date="1542369600">- Update to version 0.17.1
  * This release address a packaging error because of an erroneous declaration that
    any built wheels are universal.
- Update to version 0.17.0
  * Fix ``from collections import ChainMap`` after install_aliases() (issue #226)
  * Fix multiple import from ``__future__`` bug in futurize (issue #113)
  * Add support for proper %s formatting of newbytes
  * Properly implement iterator protocol for newrange object
  * Fix ``past.translation`` on read-only file systems
  * Fix Tkinter import bug introduced in Python 2.7.4 (issue #262)
  * Correct TypeError to ValueError in a specific edge case for newrange
  * Support inequality tests betwen newstrs and newbytes
  * Add type check to __get__ in newsuper
  * Fix fix_divsion_safe to support better conversion of complex expressions, and
    skip obvious float division.</changelog>
  <changelog author="mcepl@suse.com" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="jayvdb@gmail.com" date="1552305600">- Activate test suite</changelog>
  <changelog author="jayvdb@gmail.com" date="1557230400">- Change License from MIT to MIT and Python-2.0</changelog>
  <changelog author="mcepl@suse.com" date="1570017600">- Add python38-compat.patch to fix compatibility with Python 3.8
  gh#PythonCharmers/python-future#447
- Add python38-pow.patch not to expect exception on new available
  parameters for Python 3.8. gh#PythonCharmers/python-future#474</changelog>
  <changelog author="steven.kowalik@suse.com" date="1571054400">- Update to 0.18.0.
- Remove python38-compat.patch, already included.
- Add future-correct-mimetype.patch, since Python 3.8 is able to detect
  the MIME type now.</changelog>
  <changelog author="mcepl@suse.com" date="1575547200">- Update to 0.18.2:
  - Fix min/max functions with generators, and 'None' default (PR #514)
  - Use BaseException in raise_() (PR #515)
  - Fix builtins.round() for Decimals (Issue #501)
  - Fix raise_from() to prevent failures with immutable classes (PR #518)
  - Make FixInput idempotent (Issue #427)
  - Fix type in newround (PR #521)
  - Support mimetype guessing in urllib2 for Py3.8+ (Issue #508)
  - fix for raise_() when passed an exception that's not an
    Exception (e.g. BaseException subclasses)
- Rebase future-correct-mimetype.patch to revert incorrect fix in
  gh#PythonCharmers/python-future#508</changelog>
  <changelog author="daniel.garcia@suse.com" date="1672920000">- Add CVE-2022-40899.patch to fix REDoS in http.cookiejar
  gh#PythonCharmers/python-future#610
  bsc#1206673</changelog>
</package>
<package pkgid="70b7e7dc3989dccf6614b2373f5b2870beaed0af691f782e3351db736dde43d5" name="python3-gobject" arch="aarch64">
  <version epoch="0" ver="3.42.2" rel="150400.3.3.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1551960000">- Update to version 3.31.4:
  + docs: document GObject.Object.weak_ref().
  + cairo:
  - Add cairo pattern foreign struct support.
  - Add cairo_matrix_t converter to GValue.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552219200">- Update to version 3.32.0:
  + No changes since 3.31.4.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1555761600">- Update to version 3.32.1:
  + tests/gimarshallingtestsextra.c/h: relicense to LGPLv2.1+.
  + meson: add ``tests`` option for disabling tests.
  + meson: tests: pass ``--quiet`` to g-ir-scanner.
  + Fix a crash when marshalling a GError to Python fails.
  + Fix leak of transfer-full/container C arrays.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1561377600">- Update to version 3.32.2:
  + Python 3.8b1 compatibility fixes.
  + tests: fix a test error when run under wayland.
  + setup.py: specify python_requires.</changelog>
  <changelog author="mgorse@suse.com" date="1567252800">- Update to version 3.33.1:
  + Make GLib.Variant.unpack a bit less costly.
  + pygobject: ignore GParameter deprecations.
  + pygobject-object: fix refcount of floating return values.
  + pygi-info: remove some dead code.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + No changes since 3.33.1.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578744000">- Drop gnome-common Requires from python-gobject-common-devel
  sub-package, no longer needed, nor used since 3.29.1, where the
  BuildRequires was dropped, but the explicit Requires was not
  removed by mistake.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580472000">- Remove %{python_module gobject-devel = %{version}} from
  common-devel: Assuming that consumers of the .pc and include
  headers are not really using the python bindings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583668800">- Update to version 3.36.0:
  + This will be the last release supporting Python 2.
  + pygobject-object: Avoid checking whether NULL is floating.
  + Avoid various new glib deprecation warnings.
  + Port to g_object_new_with_properties().
  + Drop Python 2 support on Windows.
  + gtk overrides: Drop Menu, MenuItem for Gtk 4.
  + Docs:
  - Update openSUSE instructions.
  - Add Gaphor to Who is Using PyGObject.
  - Remove reference to a fixed bug.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1588766400">- Update to version 3.36.1:
  + tests: Fix failing tests with pytest 5.4.0+.
  + Gtk: Add override to make sure both
    TreeModelSort.new_with_model and TreeModel.sort_new_with_model
    exist independend of the gtk version.
  + Gtk.Template: Fix initialisation order errors with Widgets
    getting created from C (potentially through other templates).
  + Gtk.Template: Fix errors when calling init_template() multiple
    times.</changelog>
  <changelog author="dimstar@opensuse.org" date="1600084800">- Update to version 3.38.0:
  + meson: Make the `pycairo` option a feature.
  + gdk overrides: Fix wrapping of scroll events.
  + Add overrides for Gtk.Button set/get_focus_on_click.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Simplify the dependency exclusion from __init__.py to also match
  with multiple python3-flavors.
- Remove exec bit from all *.py files in examples, also
  subdirectories.</changelog>
  <changelog author="code@bnavigator.de" date="1610539201">- Recompile python cache files after removal of components, include
  cache files in correct subpackage
- Fix supplements declarations, where possible. Disable for -gdk.</changelog>
  <changelog author="mgorse@suse.com" date="1616155200">- Update to version 3.40.0:
  + GTK 4 compatibility fixes.
  + Python 3.9 and 3.10 compatibility fixes.
  + New minimal dependency requirements.
- Up glib2, gobject-introspection, and cairo required versions.</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 3.40.1:
  + Fix tests with glib 2.68.
  + Fix a regression with marshalling partial() objects.</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Adjust BuildRequires for python_module cairo to python-module
  pycairo: the module was renamed 2 years ago.
- Skip build for python2: not supported anymore since 3.38.0.</changelog>
  <changelog author="dimstar@opensuse.org" date="1632139200">- Update to version 3.42.0:
  + meson: Bump minimum meson_version to 0.47.0.
  + Expose GObject.Object.run_dispose().
  + docs: document Gtk.Template.
  + dev: Add poetry support.
  + meson: use main branch for glib subproject.
  + Fix some small memory leaks.</changelog>
  <changelog author="emilyyrose@gmail.com" date="1650542400">- Update to version 3.42.1:
  + Do not error out for unknown scopes.
  + gtk overrides: restore Gtk.ListStore.insert_with_valuesv with
    newer GTK4.
  + gtk overrides: Do not override Treeview.enable_model_drag_xx
    for GTK4.
  + Implement DynamicImporter.find_spec() to silence deprecation
    warning.
  + Some test/CI fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1654776000">- Add dependency on python-cairo to python-gobject-cairo: The
  introspection wrapper needs the actual pycairo underneath
  (boo#1179584).</changelog>
  <changelog author="yfjiang@suse.com" date="1664539200">- Update to version 3.42.2:
  * Error out instead of crashing when marshaling unsupported
    fundamental types in some cases :mr:`180`
  * Add a workaround for a PyPy 3.9+ bug when threads are used
    :mr:`200`
  * Fix crashes when marshaling zero terminated arrays for certain
    item types :mr:`191`
  * Fix a crash/refcounting error in case marshaling a hash table
    fails :mr:`191`
  * Make the test suite pass again with PyPy :mr:`191`
  * tests: support running tests with (MSVC) CPython 3.8+ on
    Windows :mr:`206`
  * interface: Fix leak when overriding GInterfaceInfo :mr:`204`
  * setup.py: look up pycairo headers without importing the module
    (helps with building on Windows and MSVC CPython 3.8+)
    :mr:`205`</changelog>
</package>
<package pkgid="d8c284d11901e348760a8ebcfb4c5a700ab6084a67eda2f2ada4beb60a45aaf0" name="python3-gobject" arch="x86_64">
  <version epoch="0" ver="3.42.2" rel="150400.3.3.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1551960000">- Update to version 3.31.4:
  + docs: document GObject.Object.weak_ref().
  + cairo:
  - Add cairo pattern foreign struct support.
  - Add cairo_matrix_t converter to GValue.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552219200">- Update to version 3.32.0:
  + No changes since 3.31.4.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1555761600">- Update to version 3.32.1:
  + tests/gimarshallingtestsextra.c/h: relicense to LGPLv2.1+.
  + meson: add ``tests`` option for disabling tests.
  + meson: tests: pass ``--quiet`` to g-ir-scanner.
  + Fix a crash when marshalling a GError to Python fails.
  + Fix leak of transfer-full/container C arrays.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1561377600">- Update to version 3.32.2:
  + Python 3.8b1 compatibility fixes.
  + tests: fix a test error when run under wayland.
  + setup.py: specify python_requires.</changelog>
  <changelog author="mgorse@suse.com" date="1567252800">- Update to version 3.33.1:
  + Make GLib.Variant.unpack a bit less costly.
  + pygobject: ignore GParameter deprecations.
  + pygobject-object: fix refcount of floating return values.
  + pygi-info: remove some dead code.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + No changes since 3.33.1.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578744000">- Drop gnome-common Requires from python-gobject-common-devel
  sub-package, no longer needed, nor used since 3.29.1, where the
  BuildRequires was dropped, but the explicit Requires was not
  removed by mistake.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580472000">- Remove %{python_module gobject-devel = %{version}} from
  common-devel: Assuming that consumers of the .pc and include
  headers are not really using the python bindings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583668800">- Update to version 3.36.0:
  + This will be the last release supporting Python 2.
  + pygobject-object: Avoid checking whether NULL is floating.
  + Avoid various new glib deprecation warnings.
  + Port to g_object_new_with_properties().
  + Drop Python 2 support on Windows.
  + gtk overrides: Drop Menu, MenuItem for Gtk 4.
  + Docs:
  - Update openSUSE instructions.
  - Add Gaphor to Who is Using PyGObject.
  - Remove reference to a fixed bug.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1588766400">- Update to version 3.36.1:
  + tests: Fix failing tests with pytest 5.4.0+.
  + Gtk: Add override to make sure both
    TreeModelSort.new_with_model and TreeModel.sort_new_with_model
    exist independend of the gtk version.
  + Gtk.Template: Fix initialisation order errors with Widgets
    getting created from C (potentially through other templates).
  + Gtk.Template: Fix errors when calling init_template() multiple
    times.</changelog>
  <changelog author="dimstar@opensuse.org" date="1600084800">- Update to version 3.38.0:
  + meson: Make the `pycairo` option a feature.
  + gdk overrides: Fix wrapping of scroll events.
  + Add overrides for Gtk.Button set/get_focus_on_click.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Simplify the dependency exclusion from __init__.py to also match
  with multiple python3-flavors.
- Remove exec bit from all *.py files in examples, also
  subdirectories.</changelog>
  <changelog author="code@bnavigator.de" date="1610539201">- Recompile python cache files after removal of components, include
  cache files in correct subpackage
- Fix supplements declarations, where possible. Disable for -gdk.</changelog>
  <changelog author="mgorse@suse.com" date="1616155200">- Update to version 3.40.0:
  + GTK 4 compatibility fixes.
  + Python 3.9 and 3.10 compatibility fixes.
  + New minimal dependency requirements.
- Up glib2, gobject-introspection, and cairo required versions.</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 3.40.1:
  + Fix tests with glib 2.68.
  + Fix a regression with marshalling partial() objects.</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Adjust BuildRequires for python_module cairo to python-module
  pycairo: the module was renamed 2 years ago.
- Skip build for python2: not supported anymore since 3.38.0.</changelog>
  <changelog author="dimstar@opensuse.org" date="1632139200">- Update to version 3.42.0:
  + meson: Bump minimum meson_version to 0.47.0.
  + Expose GObject.Object.run_dispose().
  + docs: document Gtk.Template.
  + dev: Add poetry support.
  + meson: use main branch for glib subproject.
  + Fix some small memory leaks.</changelog>
  <changelog author="emilyyrose@gmail.com" date="1650542400">- Update to version 3.42.1:
  + Do not error out for unknown scopes.
  + gtk overrides: restore Gtk.ListStore.insert_with_valuesv with
    newer GTK4.
  + gtk overrides: Do not override Treeview.enable_model_drag_xx
    for GTK4.
  + Implement DynamicImporter.find_spec() to silence deprecation
    warning.
  + Some test/CI fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1654776000">- Add dependency on python-cairo to python-gobject-cairo: The
  introspection wrapper needs the actual pycairo underneath
  (boo#1179584).</changelog>
  <changelog author="yfjiang@suse.com" date="1664539200">- Update to version 3.42.2:
  * Error out instead of crashing when marshaling unsupported
    fundamental types in some cases :mr:`180`
  * Add a workaround for a PyPy 3.9+ bug when threads are used
    :mr:`200`
  * Fix crashes when marshaling zero terminated arrays for certain
    item types :mr:`191`
  * Fix a crash/refcounting error in case marshaling a hash table
    fails :mr:`191`
  * Make the test suite pass again with PyPy :mr:`191`
  * tests: support running tests with (MSVC) CPython 3.8+ on
    Windows :mr:`206`
  * interface: Fix leak when overriding GInterfaceInfo :mr:`204`
  * setup.py: look up pycairo headers without importing the module
    (helps with building on Windows and MSVC CPython 3.8+)
    :mr:`205`</changelog>
</package>
<package pkgid="312acc989c319f08c9986cfc5b2c6f5c0119da7d6536b2179506413fddc8d2a8" name="python3-gobject-Gdk" arch="aarch64">
  <version epoch="0" ver="3.42.2" rel="150400.3.3.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1551960000">- Update to version 3.31.4:
  + docs: document GObject.Object.weak_ref().
  + cairo:
  - Add cairo pattern foreign struct support.
  - Add cairo_matrix_t converter to GValue.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552219200">- Update to version 3.32.0:
  + No changes since 3.31.4.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1555761600">- Update to version 3.32.1:
  + tests/gimarshallingtestsextra.c/h: relicense to LGPLv2.1+.
  + meson: add ``tests`` option for disabling tests.
  + meson: tests: pass ``--quiet`` to g-ir-scanner.
  + Fix a crash when marshalling a GError to Python fails.
  + Fix leak of transfer-full/container C arrays.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1561377600">- Update to version 3.32.2:
  + Python 3.8b1 compatibility fixes.
  + tests: fix a test error when run under wayland.
  + setup.py: specify python_requires.</changelog>
  <changelog author="mgorse@suse.com" date="1567252800">- Update to version 3.33.1:
  + Make GLib.Variant.unpack a bit less costly.
  + pygobject: ignore GParameter deprecations.
  + pygobject-object: fix refcount of floating return values.
  + pygi-info: remove some dead code.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + No changes since 3.33.1.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578744000">- Drop gnome-common Requires from python-gobject-common-devel
  sub-package, no longer needed, nor used since 3.29.1, where the
  BuildRequires was dropped, but the explicit Requires was not
  removed by mistake.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580472000">- Remove %{python_module gobject-devel = %{version}} from
  common-devel: Assuming that consumers of the .pc and include
  headers are not really using the python bindings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583668800">- Update to version 3.36.0:
  + This will be the last release supporting Python 2.
  + pygobject-object: Avoid checking whether NULL is floating.
  + Avoid various new glib deprecation warnings.
  + Port to g_object_new_with_properties().
  + Drop Python 2 support on Windows.
  + gtk overrides: Drop Menu, MenuItem for Gtk 4.
  + Docs:
  - Update openSUSE instructions.
  - Add Gaphor to Who is Using PyGObject.
  - Remove reference to a fixed bug.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1588766400">- Update to version 3.36.1:
  + tests: Fix failing tests with pytest 5.4.0+.
  + Gtk: Add override to make sure both
    TreeModelSort.new_with_model and TreeModel.sort_new_with_model
    exist independend of the gtk version.
  + Gtk.Template: Fix initialisation order errors with Widgets
    getting created from C (potentially through other templates).
  + Gtk.Template: Fix errors when calling init_template() multiple
    times.</changelog>
  <changelog author="dimstar@opensuse.org" date="1600084800">- Update to version 3.38.0:
  + meson: Make the `pycairo` option a feature.
  + gdk overrides: Fix wrapping of scroll events.
  + Add overrides for Gtk.Button set/get_focus_on_click.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Simplify the dependency exclusion from __init__.py to also match
  with multiple python3-flavors.
- Remove exec bit from all *.py files in examples, also
  subdirectories.</changelog>
  <changelog author="code@bnavigator.de" date="1610539201">- Recompile python cache files after removal of components, include
  cache files in correct subpackage
- Fix supplements declarations, where possible. Disable for -gdk.</changelog>
  <changelog author="mgorse@suse.com" date="1616155200">- Update to version 3.40.0:
  + GTK 4 compatibility fixes.
  + Python 3.9 and 3.10 compatibility fixes.
  + New minimal dependency requirements.
- Up glib2, gobject-introspection, and cairo required versions.</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 3.40.1:
  + Fix tests with glib 2.68.
  + Fix a regression with marshalling partial() objects.</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Adjust BuildRequires for python_module cairo to python-module
  pycairo: the module was renamed 2 years ago.
- Skip build for python2: not supported anymore since 3.38.0.</changelog>
  <changelog author="dimstar@opensuse.org" date="1632139200">- Update to version 3.42.0:
  + meson: Bump minimum meson_version to 0.47.0.
  + Expose GObject.Object.run_dispose().
  + docs: document Gtk.Template.
  + dev: Add poetry support.
  + meson: use main branch for glib subproject.
  + Fix some small memory leaks.</changelog>
  <changelog author="emilyyrose@gmail.com" date="1650542400">- Update to version 3.42.1:
  + Do not error out for unknown scopes.
  + gtk overrides: restore Gtk.ListStore.insert_with_valuesv with
    newer GTK4.
  + gtk overrides: Do not override Treeview.enable_model_drag_xx
    for GTK4.
  + Implement DynamicImporter.find_spec() to silence deprecation
    warning.
  + Some test/CI fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1654776000">- Add dependency on python-cairo to python-gobject-cairo: The
  introspection wrapper needs the actual pycairo underneath
  (boo#1179584).</changelog>
  <changelog author="yfjiang@suse.com" date="1664539200">- Update to version 3.42.2:
  * Error out instead of crashing when marshaling unsupported
    fundamental types in some cases :mr:`180`
  * Add a workaround for a PyPy 3.9+ bug when threads are used
    :mr:`200`
  * Fix crashes when marshaling zero terminated arrays for certain
    item types :mr:`191`
  * Fix a crash/refcounting error in case marshaling a hash table
    fails :mr:`191`
  * Make the test suite pass again with PyPy :mr:`191`
  * tests: support running tests with (MSVC) CPython 3.8+ on
    Windows :mr:`206`
  * interface: Fix leak when overriding GInterfaceInfo :mr:`204`
  * setup.py: look up pycairo headers without importing the module
    (helps with building on Windows and MSVC CPython 3.8+)
    :mr:`205`</changelog>
</package>
<package pkgid="88cff362022f7cc9e0a4373dc990b0cd65f097d12a59da60fe56b76f649cb48d" name="python3-gobject-Gdk" arch="x86_64">
  <version epoch="0" ver="3.42.2" rel="150400.3.3.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1551960000">- Update to version 3.31.4:
  + docs: document GObject.Object.weak_ref().
  + cairo:
  - Add cairo pattern foreign struct support.
  - Add cairo_matrix_t converter to GValue.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552219200">- Update to version 3.32.0:
  + No changes since 3.31.4.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1555761600">- Update to version 3.32.1:
  + tests/gimarshallingtestsextra.c/h: relicense to LGPLv2.1+.
  + meson: add ``tests`` option for disabling tests.
  + meson: tests: pass ``--quiet`` to g-ir-scanner.
  + Fix a crash when marshalling a GError to Python fails.
  + Fix leak of transfer-full/container C arrays.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1561377600">- Update to version 3.32.2:
  + Python 3.8b1 compatibility fixes.
  + tests: fix a test error when run under wayland.
  + setup.py: specify python_requires.</changelog>
  <changelog author="mgorse@suse.com" date="1567252800">- Update to version 3.33.1:
  + Make GLib.Variant.unpack a bit less costly.
  + pygobject: ignore GParameter deprecations.
  + pygobject-object: fix refcount of floating return values.
  + pygi-info: remove some dead code.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + No changes since 3.33.1.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578744000">- Drop gnome-common Requires from python-gobject-common-devel
  sub-package, no longer needed, nor used since 3.29.1, where the
  BuildRequires was dropped, but the explicit Requires was not
  removed by mistake.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580472000">- Remove %{python_module gobject-devel = %{version}} from
  common-devel: Assuming that consumers of the .pc and include
  headers are not really using the python bindings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583668800">- Update to version 3.36.0:
  + This will be the last release supporting Python 2.
  + pygobject-object: Avoid checking whether NULL is floating.
  + Avoid various new glib deprecation warnings.
  + Port to g_object_new_with_properties().
  + Drop Python 2 support on Windows.
  + gtk overrides: Drop Menu, MenuItem for Gtk 4.
  + Docs:
  - Update openSUSE instructions.
  - Add Gaphor to Who is Using PyGObject.
  - Remove reference to a fixed bug.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1588766400">- Update to version 3.36.1:
  + tests: Fix failing tests with pytest 5.4.0+.
  + Gtk: Add override to make sure both
    TreeModelSort.new_with_model and TreeModel.sort_new_with_model
    exist independend of the gtk version.
  + Gtk.Template: Fix initialisation order errors with Widgets
    getting created from C (potentially through other templates).
  + Gtk.Template: Fix errors when calling init_template() multiple
    times.</changelog>
  <changelog author="dimstar@opensuse.org" date="1600084800">- Update to version 3.38.0:
  + meson: Make the `pycairo` option a feature.
  + gdk overrides: Fix wrapping of scroll events.
  + Add overrides for Gtk.Button set/get_focus_on_click.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Simplify the dependency exclusion from __init__.py to also match
  with multiple python3-flavors.
- Remove exec bit from all *.py files in examples, also
  subdirectories.</changelog>
  <changelog author="code@bnavigator.de" date="1610539201">- Recompile python cache files after removal of components, include
  cache files in correct subpackage
- Fix supplements declarations, where possible. Disable for -gdk.</changelog>
  <changelog author="mgorse@suse.com" date="1616155200">- Update to version 3.40.0:
  + GTK 4 compatibility fixes.
  + Python 3.9 and 3.10 compatibility fixes.
  + New minimal dependency requirements.
- Up glib2, gobject-introspection, and cairo required versions.</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 3.40.1:
  + Fix tests with glib 2.68.
  + Fix a regression with marshalling partial() objects.</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Adjust BuildRequires for python_module cairo to python-module
  pycairo: the module was renamed 2 years ago.
- Skip build for python2: not supported anymore since 3.38.0.</changelog>
  <changelog author="dimstar@opensuse.org" date="1632139200">- Update to version 3.42.0:
  + meson: Bump minimum meson_version to 0.47.0.
  + Expose GObject.Object.run_dispose().
  + docs: document Gtk.Template.
  + dev: Add poetry support.
  + meson: use main branch for glib subproject.
  + Fix some small memory leaks.</changelog>
  <changelog author="emilyyrose@gmail.com" date="1650542400">- Update to version 3.42.1:
  + Do not error out for unknown scopes.
  + gtk overrides: restore Gtk.ListStore.insert_with_valuesv with
    newer GTK4.
  + gtk overrides: Do not override Treeview.enable_model_drag_xx
    for GTK4.
  + Implement DynamicImporter.find_spec() to silence deprecation
    warning.
  + Some test/CI fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1654776000">- Add dependency on python-cairo to python-gobject-cairo: The
  introspection wrapper needs the actual pycairo underneath
  (boo#1179584).</changelog>
  <changelog author="yfjiang@suse.com" date="1664539200">- Update to version 3.42.2:
  * Error out instead of crashing when marshaling unsupported
    fundamental types in some cases :mr:`180`
  * Add a workaround for a PyPy 3.9+ bug when threads are used
    :mr:`200`
  * Fix crashes when marshaling zero terminated arrays for certain
    item types :mr:`191`
  * Fix a crash/refcounting error in case marshaling a hash table
    fails :mr:`191`
  * Make the test suite pass again with PyPy :mr:`191`
  * tests: support running tests with (MSVC) CPython 3.8+ on
    Windows :mr:`206`
  * interface: Fix leak when overriding GInterfaceInfo :mr:`204`
  * setup.py: look up pycairo headers without importing the module
    (helps with building on Windows and MSVC CPython 3.8+)
    :mr:`205`</changelog>
</package>
<package pkgid="7e57a8183ad9e531990d52bc1f7f5df8e8387bcdc8cca6a4a12dc6d787a95680" name="python3-gobject-cairo" arch="aarch64">
  <version epoch="0" ver="3.42.2" rel="150400.3.3.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1551960000">- Update to version 3.31.4:
  + docs: document GObject.Object.weak_ref().
  + cairo:
  - Add cairo pattern foreign struct support.
  - Add cairo_matrix_t converter to GValue.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552219200">- Update to version 3.32.0:
  + No changes since 3.31.4.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1555761600">- Update to version 3.32.1:
  + tests/gimarshallingtestsextra.c/h: relicense to LGPLv2.1+.
  + meson: add ``tests`` option for disabling tests.
  + meson: tests: pass ``--quiet`` to g-ir-scanner.
  + Fix a crash when marshalling a GError to Python fails.
  + Fix leak of transfer-full/container C arrays.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1561377600">- Update to version 3.32.2:
  + Python 3.8b1 compatibility fixes.
  + tests: fix a test error when run under wayland.
  + setup.py: specify python_requires.</changelog>
  <changelog author="mgorse@suse.com" date="1567252800">- Update to version 3.33.1:
  + Make GLib.Variant.unpack a bit less costly.
  + pygobject: ignore GParameter deprecations.
  + pygobject-object: fix refcount of floating return values.
  + pygi-info: remove some dead code.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + No changes since 3.33.1.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578744000">- Drop gnome-common Requires from python-gobject-common-devel
  sub-package, no longer needed, nor used since 3.29.1, where the
  BuildRequires was dropped, but the explicit Requires was not
  removed by mistake.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580472000">- Remove %{python_module gobject-devel = %{version}} from
  common-devel: Assuming that consumers of the .pc and include
  headers are not really using the python bindings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583668800">- Update to version 3.36.0:
  + This will be the last release supporting Python 2.
  + pygobject-object: Avoid checking whether NULL is floating.
  + Avoid various new glib deprecation warnings.
  + Port to g_object_new_with_properties().
  + Drop Python 2 support on Windows.
  + gtk overrides: Drop Menu, MenuItem for Gtk 4.
  + Docs:
  - Update openSUSE instructions.
  - Add Gaphor to Who is Using PyGObject.
  - Remove reference to a fixed bug.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1588766400">- Update to version 3.36.1:
  + tests: Fix failing tests with pytest 5.4.0+.
  + Gtk: Add override to make sure both
    TreeModelSort.new_with_model and TreeModel.sort_new_with_model
    exist independend of the gtk version.
  + Gtk.Template: Fix initialisation order errors with Widgets
    getting created from C (potentially through other templates).
  + Gtk.Template: Fix errors when calling init_template() multiple
    times.</changelog>
  <changelog author="dimstar@opensuse.org" date="1600084800">- Update to version 3.38.0:
  + meson: Make the `pycairo` option a feature.
  + gdk overrides: Fix wrapping of scroll events.
  + Add overrides for Gtk.Button set/get_focus_on_click.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Simplify the dependency exclusion from __init__.py to also match
  with multiple python3-flavors.
- Remove exec bit from all *.py files in examples, also
  subdirectories.</changelog>
  <changelog author="code@bnavigator.de" date="1610539201">- Recompile python cache files after removal of components, include
  cache files in correct subpackage
- Fix supplements declarations, where possible. Disable for -gdk.</changelog>
  <changelog author="mgorse@suse.com" date="1616155200">- Update to version 3.40.0:
  + GTK 4 compatibility fixes.
  + Python 3.9 and 3.10 compatibility fixes.
  + New minimal dependency requirements.
- Up glib2, gobject-introspection, and cairo required versions.</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 3.40.1:
  + Fix tests with glib 2.68.
  + Fix a regression with marshalling partial() objects.</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Adjust BuildRequires for python_module cairo to python-module
  pycairo: the module was renamed 2 years ago.
- Skip build for python2: not supported anymore since 3.38.0.</changelog>
  <changelog author="dimstar@opensuse.org" date="1632139200">- Update to version 3.42.0:
  + meson: Bump minimum meson_version to 0.47.0.
  + Expose GObject.Object.run_dispose().
  + docs: document Gtk.Template.
  + dev: Add poetry support.
  + meson: use main branch for glib subproject.
  + Fix some small memory leaks.</changelog>
  <changelog author="emilyyrose@gmail.com" date="1650542400">- Update to version 3.42.1:
  + Do not error out for unknown scopes.
  + gtk overrides: restore Gtk.ListStore.insert_with_valuesv with
    newer GTK4.
  + gtk overrides: Do not override Treeview.enable_model_drag_xx
    for GTK4.
  + Implement DynamicImporter.find_spec() to silence deprecation
    warning.
  + Some test/CI fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1654776000">- Add dependency on python-cairo to python-gobject-cairo: The
  introspection wrapper needs the actual pycairo underneath
  (boo#1179584).</changelog>
  <changelog author="yfjiang@suse.com" date="1664539200">- Update to version 3.42.2:
  * Error out instead of crashing when marshaling unsupported
    fundamental types in some cases :mr:`180`
  * Add a workaround for a PyPy 3.9+ bug when threads are used
    :mr:`200`
  * Fix crashes when marshaling zero terminated arrays for certain
    item types :mr:`191`
  * Fix a crash/refcounting error in case marshaling a hash table
    fails :mr:`191`
  * Make the test suite pass again with PyPy :mr:`191`
  * tests: support running tests with (MSVC) CPython 3.8+ on
    Windows :mr:`206`
  * interface: Fix leak when overriding GInterfaceInfo :mr:`204`
  * setup.py: look up pycairo headers without importing the module
    (helps with building on Windows and MSVC CPython 3.8+)
    :mr:`205`</changelog>
</package>
<package pkgid="a3d94f334961414f850bfeb6d7b8c1b97c38e942b12b0956ea60c2de1c92d0f7" name="python3-gobject-cairo" arch="x86_64">
  <version epoch="0" ver="3.42.2" rel="150400.3.3.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1551960000">- Update to version 3.31.4:
  + docs: document GObject.Object.weak_ref().
  + cairo:
  - Add cairo pattern foreign struct support.
  - Add cairo_matrix_t converter to GValue.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552219200">- Update to version 3.32.0:
  + No changes since 3.31.4.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1555761600">- Update to version 3.32.1:
  + tests/gimarshallingtestsextra.c/h: relicense to LGPLv2.1+.
  + meson: add ``tests`` option for disabling tests.
  + meson: tests: pass ``--quiet`` to g-ir-scanner.
  + Fix a crash when marshalling a GError to Python fails.
  + Fix leak of transfer-full/container C arrays.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1561377600">- Update to version 3.32.2:
  + Python 3.8b1 compatibility fixes.
  + tests: fix a test error when run under wayland.
  + setup.py: specify python_requires.</changelog>
  <changelog author="mgorse@suse.com" date="1567252800">- Update to version 3.33.1:
  + Make GLib.Variant.unpack a bit less costly.
  + pygobject: ignore GParameter deprecations.
  + pygobject-object: fix refcount of floating return values.
  + pygi-info: remove some dead code.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + No changes since 3.33.1.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578744000">- Drop gnome-common Requires from python-gobject-common-devel
  sub-package, no longer needed, nor used since 3.29.1, where the
  BuildRequires was dropped, but the explicit Requires was not
  removed by mistake.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580472000">- Remove %{python_module gobject-devel = %{version}} from
  common-devel: Assuming that consumers of the .pc and include
  headers are not really using the python bindings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583668800">- Update to version 3.36.0:
  + This will be the last release supporting Python 2.
  + pygobject-object: Avoid checking whether NULL is floating.
  + Avoid various new glib deprecation warnings.
  + Port to g_object_new_with_properties().
  + Drop Python 2 support on Windows.
  + gtk overrides: Drop Menu, MenuItem for Gtk 4.
  + Docs:
  - Update openSUSE instructions.
  - Add Gaphor to Who is Using PyGObject.
  - Remove reference to a fixed bug.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1588766400">- Update to version 3.36.1:
  + tests: Fix failing tests with pytest 5.4.0+.
  + Gtk: Add override to make sure both
    TreeModelSort.new_with_model and TreeModel.sort_new_with_model
    exist independend of the gtk version.
  + Gtk.Template: Fix initialisation order errors with Widgets
    getting created from C (potentially through other templates).
  + Gtk.Template: Fix errors when calling init_template() multiple
    times.</changelog>
  <changelog author="dimstar@opensuse.org" date="1600084800">- Update to version 3.38.0:
  + meson: Make the `pycairo` option a feature.
  + gdk overrides: Fix wrapping of scroll events.
  + Add overrides for Gtk.Button set/get_focus_on_click.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Simplify the dependency exclusion from __init__.py to also match
  with multiple python3-flavors.
- Remove exec bit from all *.py files in examples, also
  subdirectories.</changelog>
  <changelog author="code@bnavigator.de" date="1610539201">- Recompile python cache files after removal of components, include
  cache files in correct subpackage
- Fix supplements declarations, where possible. Disable for -gdk.</changelog>
  <changelog author="mgorse@suse.com" date="1616155200">- Update to version 3.40.0:
  + GTK 4 compatibility fixes.
  + Python 3.9 and 3.10 compatibility fixes.
  + New minimal dependency requirements.
- Up glib2, gobject-introspection, and cairo required versions.</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 3.40.1:
  + Fix tests with glib 2.68.
  + Fix a regression with marshalling partial() objects.</changelog>
  <changelog author="dimstar@opensuse.org" date="1628078400">- Adjust BuildRequires for python_module cairo to python-module
  pycairo: the module was renamed 2 years ago.
- Skip build for python2: not supported anymore since 3.38.0.</changelog>
  <changelog author="dimstar@opensuse.org" date="1632139200">- Update to version 3.42.0:
  + meson: Bump minimum meson_version to 0.47.0.
  + Expose GObject.Object.run_dispose().
  + docs: document Gtk.Template.
  + dev: Add poetry support.
  + meson: use main branch for glib subproject.
  + Fix some small memory leaks.</changelog>
  <changelog author="emilyyrose@gmail.com" date="1650542400">- Update to version 3.42.1:
  + Do not error out for unknown scopes.
  + gtk overrides: restore Gtk.ListStore.insert_with_valuesv with
    newer GTK4.
  + gtk overrides: Do not override Treeview.enable_model_drag_xx
    for GTK4.
  + Implement DynamicImporter.find_spec() to silence deprecation
    warning.
  + Some test/CI fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1654776000">- Add dependency on python-cairo to python-gobject-cairo: The
  introspection wrapper needs the actual pycairo underneath
  (boo#1179584).</changelog>
  <changelog author="yfjiang@suse.com" date="1664539200">- Update to version 3.42.2:
  * Error out instead of crashing when marshaling unsupported
    fundamental types in some cases :mr:`180`
  * Add a workaround for a PyPy 3.9+ bug when threads are used
    :mr:`200`
  * Fix crashes when marshaling zero terminated arrays for certain
    item types :mr:`191`
  * Fix a crash/refcounting error in case marshaling a hash table
    fails :mr:`191`
  * Make the test suite pass again with PyPy :mr:`191`
  * tests: support running tests with (MSVC) CPython 3.8+ on
    Windows :mr:`206`
  * interface: Fix leak when overriding GInterfaceInfo :mr:`204`
  * setup.py: look up pycairo headers without importing the module
    (helps with building on Windows and MSVC CPython 3.8+)
    :mr:`205`</changelog>
</package>
<package pkgid="09cb4d0544051e3fc98ce7122dc2cccacf97df72158fe083fe9689df5fff83f6" name="python3-libxml2" arch="aarch64">
  <version epoch="0" ver="2.9.14" rel="150400.5.13.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1584360000">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Revert upstream commit 5a02583c7e683896d84878bd90641d8d9b0d0549
  * Add patch libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="code@bnavigator.de" date="1603454400">- Make python subpackage ready for multiple python3 flavors
  gh#openSUSE/python-rpm-macros#66</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1608206400">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="wicked@iki.fi" date="1614081600">- Fails to build against Python 3.9:
  * Add upstream commit that fixes the issue
    https://github.com/GNOME/libxml2/commit/e4fb36841800038c289997432ca547c9bfef9db1
- Add patch libxml2-python39.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="39d96dd5df01c6d74410303ac45d3168d1b5c72be5771e83f2df8924a673e518" name="python3-libxml2" arch="x86_64">
  <version epoch="0" ver="2.9.14" rel="150400.5.13.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1584360000">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Revert upstream commit 5a02583c7e683896d84878bd90641d8d9b0d0549
  * Add patch libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="code@bnavigator.de" date="1603454400">- Make python subpackage ready for multiple python3 flavors
  gh#openSUSE/python-rpm-macros#66</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1608206400">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="wicked@iki.fi" date="1614081600">- Fails to build against Python 3.9:
  * Add upstream commit that fixes the issue
    https://github.com/GNOME/libxml2/commit/e4fb36841800038c289997432ca547c9bfef9db1
- Add patch libxml2-python39.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="cd03eea1444c9c85beb5c0466b4b1c8d6ba413c582c1424524ff657be1f37764" name="python3-msgpack" arch="aarch64">
  <version epoch="0" ver="0.5.6" rel="150100.3.3.1"/>
  <changelog author="toddrme2178@gmail.com" date="1416312000">- Update to 0.4.2
  Bugfixes
  - Unpacker doesn't increment refcount of ExtType hook.
  - Packer raises no exception for inputs doesn't fit to msgpack format.
- Update to 0.4.1
  Changes
  - fallback.Unpacker.feed() supports bytearray.
  Bugs fixed
  - Unpacker doesn't increment refcount of hooks. Hooks may be GCed while unpacking.
  - Unpacker may read unfilled internal buffer.</changelog>
  <changelog author="hpj@urpla.net" date="1426507200">- Update to version 0.4.6
  * fallback.Unpacker: Fix Data corruption when OutOfData. This bug
    only affects "Streaming unpacking."
- Changes from version 0.4.5
  * Fix test failure on pytest 2.3.
  * Fix typos in ChangeLog.
  * Improve README.rst
- Changes from version 0.4.4
  * Fix compile error.
- Changes from version 0.4.3
  * Unpacker may unpack wrong uint32 value on 32bit or LLP64
    environment. (#101)
  * Build failed on Windows Python 2.7.</changelog>
  <changelog author="mc@suse.com" date="1445083200">- build conditionally without tests</changelog>
  <changelog author="dmueller@suse.com" date="1479211200">- update to 0.4.8</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492603200">- Implement single-spec version.</changelog>
  <changelog author="dmueller@suse.com" date="1517054400">- update to 0.5.1:
  * Package name on PyPI was changed to msgpack from 0.5.
- rename from msgpack-python</changelog>
  <changelog author="jengelh@inai.de" date="1517313600">- Strip rheotrics from descriptions.</changelog>
  <changelog author="tbechtold@suse.com" date="1517918400">- update to version 0.5.4
  * packer: Use PyUnicode_AsUTF8AndSize() for utf-8 (#272)
  * Fix encoding and unicode_errors (#277)
  * Undeprecate unicode_errors (#278)
  * Packer.pack() reset buffer on exception (#274)
  * Use cython's cast for converting encoding and errors (#279)
  * 0.5.4
  * Add raw_as_bytes option to Unpacker. (#265)
  * s/raw_as_bytes/raw/g (#276)</changelog>
  <changelog author="dmueller@suse.com" date="1518436800">- fix typo in obsoletes</changelog>
  <changelog author="alarrosa@suse.com" date="1519646400">- Provide also python-msgpack-python in the python2 package to
  be able to obsolete the python2-msgpack-python package correctly.</changelog>
  <changelog author="alarrosa@suse.com" date="1519905600">- Update to version 0.5.6 (boo#1123558)
  * Fix fallback.Unpacker.feed() dropped unused data from buffer
  * Resurrect fallback.unpack() and _unpacker.unpack(). They were
    removed at 0.5.5 but it breaks backward compatibility.
- Update to version 0.5.5
  * Fix memory leak in pure Python Unpacker.feed()
  * Fix unpack() didn't support raw option</changelog>
  <changelog author="alarrosa@suse.com" date="1548763200">- Use %license</changelog>
  <changelog author="mcepl@suse.com" date="1664280000">- Loose the filelist for the package info to avoid FTBFS on
  SLE-15-SP5 (bsc#1203743).</changelog>
</package>
<package pkgid="ef39fa91132748507b1cc134cce31582fbe4a80528ef3100e55b7a97e81681e0" name="python3-msgpack" arch="x86_64">
  <version epoch="0" ver="0.5.6" rel="150100.3.3.1"/>
  <changelog author="toddrme2178@gmail.com" date="1416312000">- Update to 0.4.2
  Bugfixes
  - Unpacker doesn't increment refcount of ExtType hook.
  - Packer raises no exception for inputs doesn't fit to msgpack format.
- Update to 0.4.1
  Changes
  - fallback.Unpacker.feed() supports bytearray.
  Bugs fixed
  - Unpacker doesn't increment refcount of hooks. Hooks may be GCed while unpacking.
  - Unpacker may read unfilled internal buffer.</changelog>
  <changelog author="hpj@urpla.net" date="1426507200">- Update to version 0.4.6
  * fallback.Unpacker: Fix Data corruption when OutOfData. This bug
    only affects "Streaming unpacking."
- Changes from version 0.4.5
  * Fix test failure on pytest 2.3.
  * Fix typos in ChangeLog.
  * Improve README.rst
- Changes from version 0.4.4
  * Fix compile error.
- Changes from version 0.4.3
  * Unpacker may unpack wrong uint32 value on 32bit or LLP64
    environment. (#101)
  * Build failed on Windows Python 2.7.</changelog>
  <changelog author="mc@suse.com" date="1445083200">- build conditionally without tests</changelog>
  <changelog author="dmueller@suse.com" date="1479211200">- update to 0.4.8</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492603200">- Implement single-spec version.</changelog>
  <changelog author="dmueller@suse.com" date="1517054400">- update to 0.5.1:
  * Package name on PyPI was changed to msgpack from 0.5.
- rename from msgpack-python</changelog>
  <changelog author="jengelh@inai.de" date="1517313600">- Strip rheotrics from descriptions.</changelog>
  <changelog author="tbechtold@suse.com" date="1517918400">- update to version 0.5.4
  * packer: Use PyUnicode_AsUTF8AndSize() for utf-8 (#272)
  * Fix encoding and unicode_errors (#277)
  * Undeprecate unicode_errors (#278)
  * Packer.pack() reset buffer on exception (#274)
  * Use cython's cast for converting encoding and errors (#279)
  * 0.5.4
  * Add raw_as_bytes option to Unpacker. (#265)
  * s/raw_as_bytes/raw/g (#276)</changelog>
  <changelog author="dmueller@suse.com" date="1518436800">- fix typo in obsoletes</changelog>
  <changelog author="alarrosa@suse.com" date="1519646400">- Provide also python-msgpack-python in the python2 package to
  be able to obsolete the python2-msgpack-python package correctly.</changelog>
  <changelog author="alarrosa@suse.com" date="1519905600">- Update to version 0.5.6 (boo#1123558)
  * Fix fallback.Unpacker.feed() dropped unused data from buffer
  * Resurrect fallback.unpack() and _unpacker.unpack(). They were
    removed at 0.5.5 but it breaks backward compatibility.
- Update to version 0.5.5
  * Fix memory leak in pure Python Unpacker.feed()
  * Fix unpack() didn't support raw option</changelog>
  <changelog author="alarrosa@suse.com" date="1548763200">- Use %license</changelog>
  <changelog author="mcepl@suse.com" date="1664280000">- Loose the filelist for the package info to avoid FTBFS on
  SLE-15-SP5 (bsc#1203743).</changelog>
</package>
<package pkgid="04a83d6f3b02a11872bb528c79ccfe7f6ed60eba0629026b87bc913655ee7f31" name="python3-py" arch="noarch">
  <version epoch="0" ver="1.10.0" rel="150100.5.12.1"/>
  <changelog author="jmatejek@suse.com" date="1475668800">- update for singlespec</changelog>
  <changelog author="jmatejek@suse.com" date="1487851200">- update to 1.4.32
  - fix issue70: added ability to copy all stat info in py.path.local.copy.
  - make TerminalWriter.fullwidth a property.  This results in the correct
    value when the terminal gets resized.
  - update supported html tags to include recent additions.
    Thanks Denis Afonso for the PR.
  - Remove internal code in ``Source.compile`` meant to support earlier Python 3 versions that produced the side effect
    of leaving ``None`` in ``sys.modules`` when called (see pytest-dev/pytest#2103).
    Thanks Bruno Oliveira for the PR.</changelog>
  <changelog author="aloisio@gmx.com" date="1498824000">- Update to 1.4.34
  * fix issue119 / pytest issue708 where tmpdir may fail to make
    numbered directories when the filesystem is case-insensitive.
  1.4.33:
  * avoid imports in calls to py.path.local().fnmatch(). Thanks
    Andreas Pelme for the PR.
  * fix issue106: Naive unicode encoding when calling fspath() in
    python2. Thanks Tiago Nobrega for the PR.
  * fix issue110: unittest.TestCase.assertWarns fails with py
    imported.</changelog>
  <changelog author="arun@gmx.de" date="1510747200">- update to version 1.5.0:
  * python 2.6 and 3.3 are no longer supported
  * deprecate py.std and remove all internal uses
  * fix #73 turn py.error into an actual module
  * path join to / no longer produces leading double slashes
  * fix #82 - remove unsupportable aliases
  * fix python37 compatibility of path.sysfind on windows by correctly
    replacing vars
  * turn iniconfig and apipkg into vendored packages and ease
    de-vendoring for distributions
  * fix #68 remove invalid py.test.ensuretemp references
  * fix #25 - deprecate path.listdir(sort=callable)
  * add TerminalWriter.chars_on_current_line read-only property that
    tracks how many characters have been written to the current line.</changelog>
  <changelog author="arun@gmx.de" date="1511092800">- specfile:
  * updated url
- update to version 1.5.2:
  * fix #169, #170: error importing py.log on Windows: no module named
    "syslog".
- changes from version 1.5.1:
  * fix #167 - prevent pip from installing py in unsupported Python
    versions.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1527768000">- update to version 1.5.3
  * - fix #179: ensure we can support 'from py.error import ...'</changelog>
  <changelog author="mimi.vx@gmail.com" date="1533211200">- update to 1.5.4
  * don't make assumptions about fs case sensitivity in ``make_numbered_dir``.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1540555200">- update to 1.7.0
  * use ``shutil.get_terminal_size()`` in Python 3.3+ to determine the size of the
  terminal, which produces more accurate results than the previous method.
  * introduce new ``PY_IGNORE_IMPORTMISMATCH`` environment variable
  that suppresses ``ImportMismatchError`` exceptions when set to ``1``.
  * add ``TerminalWriter.width_of_current_line`` (i18n version of
  ``TerminalWriter.chars_on_current_line``), a read-only property
  that tracks how wide the current line is, attempting to take
  into account international characters in the calculation.</changelog>
  <changelog author="tchvatal@suse.com" date="1549972800">- Drop the doc subpackage, no need for it really
- Make sure the tests are realy executed</changelog>
  <changelog author="tchvatal@suse.com" date="1550232000">- Make tests really pass on pytest 3.x series
- Add patch to operate better with serparators (from upstream git):
  * separators.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1550232001">- Make tests never fail as they are borked on pytest-4 with
  most probably no intention of being ever fixed</changelog>
  <changelog author="tchvatal@suse.com" date="1551268800">- Update to 1.8.0:
  * add ``"importlib"`` pyimport mode for python3.5+, allowing unimportable test suites
    to contain identically named modules.
  * fix ``LocalPath.as_cwd()`` not calling ``os.chdir()`` with ``None``, when
    being invoked from a non-existing directory.
- Drop merged patch separators.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1560945600">- Switch to multibuild to avoid cycle bsc#1138666</changelog>
  <changelog author="tchvatal@suse.com" date="1578312000">- Update to 1.8.1:
  - Handle ``FileNotFoundError`` when trying to import pathlib in
    ``path.common`` on Python 3.4 (#207).
  - ``py.path.local.samefile`` now works correctly in Python 3 on
    Windows when dealing with symlinks.</changelog>
  <changelog author="mcalabkova@suse.com" date="1593432000">- Update to 1.9.0
  * Add type annotation stubs</changelog>
  <changelog author="jayvdb@gmail.com" date="1602936000">- Devendor apipkg and iniconfig
- Add pr_222.patch to activate test suite</changelog>
  <changelog author="code@bnavigator.de" date="1613736000">- Update to 1.10.0
  * Fix a regular expression DoS vulnerability in the py.path.svnwc
    SVN blame functionality (CVE-2020-29651)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- CVE-2020-29651.patch (bsc#1179805, CVE-2020-29651, bsc#1184505)
  * python-py: regular expression denial of service in svnwc.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1647259200">- Update in SLE-15 (bsc#1195916, bsc#1196696, jsc#PM-3356, jsc#SLE-23972)
- Drop CVE-2020-29651.patch, issue fixed upstream in 1.10.0</changelog>
  <changelog author="steven.kowalik@suse.com" date="1673956800">- Remove all traces of py._path.svn{url,wc}. (bsc#1204364, CVE-2022-42969)
- Add patch remove-svn-remants.patch to help with that goal.
- Refresh pr_222.patch as needed for above.</changelog>
</package>
<package pkgid="34fe2bcd2dcb868afd91b7f725f323dc2f020cb62c28441c0ea29d2a5d29be7d" name="python3-rpm" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="80253b50bb4a25c8e2ce019f722d61fac14c7cff409b8cf9e9ef16ab3a5d0899" name="python3-rpm" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="a9e7031ea2c13da53695c26e0ae61e457e19d1e0c681d2fde730ffeb3fb9c7b0" name="python3-salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150400.8.17.7"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
</package>
<package pkgid="0ed3ac47430bf885c4c5570a75b8cd6309ddbf9aae3c9c314e3d09bbbf0a4a5c" name="python3-salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150400.8.17.7"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
</package>
<package pkgid="4a4e8480bc07676fb294f9516e2f5b06a8ef191b627ec8fc2aec7a434108fb6d" name="python3-salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150400.8.20.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="6579d759083d39eb10cc785d114debc1b32a09ee846ed328ffdc1f5986cc533e" name="python3-salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150400.8.20.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="b02f1bb5186a1d50b506b3b84fc6a5282c229026dc35459b868c8831a6fea0ce" name="python3-salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150400.8.25.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677153600">- Fixes pkg.version_cmp on openEuler systems and a few other OS flavors
- Make pkg.remove function from zypperpkg module to handle also PTF packages
- Added:
  * 3004-implement-zypper-removeptf-574.patch
  * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677499200">- Fix problem with detecting PTF packages (bsc#1208691)
- Added:
  * skip-package-names-without-colon-bsc-1208691-578.patch</changelog>
</package>
<package pkgid="dc1427ef2cdfc8e1ebd26d68318522a201ab98f435ed01cac4fd6466860e4775" name="python3-salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150400.8.25.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677153600">- Fixes pkg.version_cmp on openEuler systems and a few other OS flavors
- Make pkg.remove function from zypperpkg module to handle also PTF packages
- Added:
  * 3004-implement-zypper-removeptf-574.patch
  * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677499200">- Fix problem with detecting PTF packages (bsc#1208691)
- Added:
  * skip-package-names-without-colon-bsc-1208691-578.patch</changelog>
</package>
<package pkgid="ff0c7d656beda9ad75d1c57f767a174d3625848e7e767e261bf54d5d3719a99a" name="python3-setuptools" arch="noarch">
  <version epoch="0" ver="44.1.1" rel="150400.3.3.1"/>
  <changelog author="arun@gmx.de" date="1556971200">- update to version 41.0.1:
  * #1671: Fixed issue with the PEP 517 backend that prevented
    building a wheel when the dist/ directory contained existing .whl
    files.
  * #1709: In test.paths_on_python_path, avoid adding unnecessary
    duplicates to the PYTHONPATH.
  * #1741: In package_index, now honor "current directory" during a
    checkout of git and hg repositories under Windows</changelog>
  <changelog author="tchvatal@suse.com" date="1566388800">- Update to 41.2.0:
  * #479: Remove some usage of the deprecated imp module.
  * #1565: Changed html_sidebars from string to list of string as per https://www.sphinx-doc.org/en/master/changes.html#id58
  * #1697: Moved most of the constants from setup.py to setup.cfg
  * #1756: Forse metadata-version &gt;= 1.2. when project urls are present.</changelog>
  <changelog author="tchvatal@suse.com" date="1566388801">- Switch to multibuild to enable testsuite</changelog>
  <changelog author="jayvdb@gmail.com" date="1568462400">- Define LANG in %check to fix openSUSE/SLE 15 testsuite</changelog>
  <changelog author="mcalabkova@suse.com" date="1570795200">- Update to 41.4.0
  * In declarative config, now traps errors when invalid python_requires
    values are supplied.
  * When storing extras, rely on OrderedSet to retain order of extras
    as indicated by the packager, which will also be deterministic
    on Python 2.7 (with PYTHONHASHSEED unset) and Python 3.6+.
  * Fixed failing integration test triggered by 'long_description_content_type' in packaging.</changelog>
  <changelog author="tchvatal@suse.com" date="1571227200">- Add patch to sort outputs for better reproducability:
  * sort-for-reproducibility.patch
- Add missing dep on ordered-set as it is now in the vendored
  dir too</changelog>
  <changelog author="tchvatal@suse.com" date="1571227201">- Try to use system packages rather than the vendored variants</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1571313600">- Remove runtime dependency for the full python3 package, as the
  actually required SSL module is in python3-base. For python(2),
  SSL is in the "full" python package. Avoids build loops and
  shortens the dependency chain for e.g. rust.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1573473600">- update to 41.6.0
- add importlib.patch
  * Replace usage of deprecated imp module with local
    re-implementation in setuptools._imp
  * Fix pkg_resources.Requirement hash/equality implementation
  * Fix tests when running under python3.10.
  * drop 'deprecated' documentation (test command, ez_setup, EasyInstall)</changelog>
  <changelog author="mimi.vx@gmail.com" date="1580817600">- update to 44.0.0
- last version with python2 support
- add testdata.tar.gz -&gt; missing data for testsuite
  * Drop support for Python 3.4.
  * include pyproject.toml in source distribution by default.
    Projects relying on the previous behavior where pyproject.toml
  * Setuptools once again declares 'setuptools' in the build-system.requires
    and adds PEP 517 build support by declaring itself as the build-backend
  * Fix support for easy_install's find-links option in setup.cfg
  * Build dependencies (setup_requires and tests_require) now install transitive
    dependencies indicated by extras.
  * Mark the easy_install script and setuptools command as deprecated, and use
    pip when available to fetch/build wheels for missing setup_requires/tests_require
    requirements, with the following differences in behavior:
    + support for python_requires
    + better support for wheels (proper handling of priority with respect to PEP 425 tags)
    + PEP 517/518 support
    + eggs are not supported
    + no support for the allow_hosts easy_install option (index_url/find_links are still honored)
    + pip environment variables are honored (and take precedence over easy_install options)
  * Removed the "upload" and "register" commands in favor of twine.
  * Add support for the license_files option in setup.cfg to automatically
    include multiple license files in a source distribution.
  * Update handling of wheels compatibility tags: * add support for manylinux2010
  * fix use of removed 'm' ABI flag in Python 3.8 on Windows
  * Fix empty namespace package installation from wheel.
  * Setuptools now exposes a new entry point hook "setuptools.finalize_distribution_options",
    enabling plugins like setuptools_scm to configure options on the distribution
    at finalization time.</changelog>
  <changelog author="tchvatal@suse.com" date="1584100800">- Fix build without python2</changelog>
  <changelog author="mcepl@suse.com" date="1586174400">- Fix License to the correct MIT</changelog>
  <changelog author="code@bnavigator.de" date="1592913600">- use local source dir for pytest imports
  gh#openSUSE/python-rpm-macros#48</changelog>
  <changelog author="mimi.vx@gmail.com" date="1597320000">- update to 44.1.0
  * Set sys.argv[0] in setup script run by build_meta.__legacy__
  * Fix for Python 4: replace unsafe six.PY3 with six.PY2
  * Fixed a bug in the ?setuptools.finalize_distribution_options? hook
    that lead to ignoring the order attribute of entry points managed
    by this hook.
  * Avoid loading working set during Distribution.finalize_options prior
    to invoking _install_setup_requires, broken since v42.0.0.</changelog>
  <changelog author="mcepl@suse.com" date="1605009600">- Add wheel subpackage with the generated wheel for this package
  (bsc#1176262, CVE-2019-20916).</changelog>
  <changelog author="mcepl@suse.com" date="1605182400">- Make wheel a separate build run to avoid the setuptools/wheel build
  cycle.</changelog>
  <changelog author="mcepl@suse.com" date="1605528000">- Avoid duplicite wheel name in the generated package, and we actually
  don't need a subpackage at all.</changelog>
  <changelog author="mcepl@suse.com" date="1607428800">- Add remove_mock.patch to remove dependency on the external mock
  package.</changelog>
  <changelog author="mcepl@suse.com" date="1611316800">- We cannot remove vendored packages when generating setuptools
  wheel (bsc#1177127).</changelog>
  <changelog author="daniel.garcia@suse.com" date="1673265600">- Add CVE-2022-40897-ReDos.patch to fix Regular Expression Denial of Service
  (ReDoS) in package_index.py.
  bsc#1206667</changelog>
</package>
<package pkgid="c41ce2f41b6c829e8f47064a4a205b8ddd33de1323c7371f3795881e2ccddfd4" name="qemu" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="866a029238279bcc85b795d226d8c0300baec98b665f79c90cd509c75a4394ab" name="qemu" arch="src">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="42ca27d77786f2045fbe377a8bb175824394f855a2a4272f1e64d909661e78fe" name="qemu" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="6a604b842e13211b3e3e80dbb32b47ef632af883320383ba567d589f620a14f5" name="qemu" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="f15ecedcfb93a670ab019d626cd18168cc673ef5ae05bf1b1f052525695e4d5d" name="qemu" arch="src">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="7de4a2a6156172663ad9ccad75954d759ea1060eecb640d8b9e1074c019477d7" name="qemu" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="15f2e3df2d6cd8664d9af42a17ef91deaa1ea6e8e972f3a8283e640509507f63" name="qemu-accel-tcg-x86" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="5362c8369e1fff0f9aec754c9799587239c6c0b9bbbd3731d3b3aa80d50b6359" name="qemu-accel-tcg-x86" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="7408f8ec3ab03be2f14c5e3b0a5f90cf00ad5785bf825184dd2e7ab8b5280826" name="qemu-arm" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="d8050f8b794e469c64776d33c799f8aea444d0a7d7491a90fbef9a928f4889e2" name="qemu-arm" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="140e8b6798d3842418ed0b515e66a8763b677943a2542d9310d6428a1d0b673e" name="qemu-audio-spice" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="e8fdb58aa50d59f7c23d3f12166b2dcfe6c89bc9fc557e7f291b62bffb6d2362" name="qemu-audio-spice" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="102d2d636d553075d5b39c5adaf6a6a529203596ff4c27ae1d4b7c6cab3c7977" name="qemu-audio-spice" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="b91c55e69ae421532b27ff431fee32b6b0230f837d985cb9ca325c1def1ab03e" name="qemu-audio-spice" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="fcbf84f60e1f4b90fdbd10fa70da7a95941498aaaf157cca6cc512b78f9713b9" name="qemu-chardev-spice" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="5e2d0ec04df0910ba212202a937dd6d173016b51e141361c61e694e4a5ec6314" name="qemu-chardev-spice" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="793d9486916f0021e950873c930c03c0b5051714ad02689bf47b58a5bf42bcba" name="qemu-chardev-spice" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="140ea36b260f1b088d0756d13c76d96a83566d3cf6b32c903bee76002f5d1520" name="qemu-chardev-spice" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="ce85fcd3764fb71f511b108dd8be0a411ffd009ffc63b9889d610a14347b41a5" name="qemu-guest-agent" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="bef60d85be03e67bda20470ec0caa75eaeb8fffdeb2f257f946468cf0c55fd3e" name="qemu-guest-agent" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="2bd6128b945f9158ef6bed6b1e49d2a120fb13d869596518f4ddcace17c5f162" name="qemu-guest-agent" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="f2a78c2e3183d8424997a03a500b863b1175d1c76dfe99b6440a365b4f9d7692" name="qemu-guest-agent" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="56daf6ab135954167aedc72428cf01220084802fda08ab29ea98a94c4e11fddb" name="qemu-hw-display-qxl" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="d661e6a73aede0f089f6c52966ebf4bd63ba3dc078e49437830ab4f805ccc91f" name="qemu-hw-display-qxl" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="7fa9e4333ac5f1380734d4754e1951e40925bbffee5fd48d8f77dc09fab16a23" name="qemu-hw-display-qxl" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="7cb61dba36cc769b6f3f58ae29fc66e6889c71a63ca0c8e29a24d7423fb97377" name="qemu-hw-display-qxl" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="cb316af08273fa54b15765b6cc4b3531f158f58f743323fafaa25f1f06603105" name="qemu-hw-display-virtio-gpu" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="6fce54e4027fa4d39f717107d15dc7dde8c5fd01f5aff5a4c6233e7c7849c6a5" name="qemu-hw-display-virtio-gpu" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="eb27639aa73da2db9973d3c2c246d91dbbee0b1049a7c70ad1a6ecdab16bfb3c" name="qemu-hw-display-virtio-gpu" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="3e7492687fdbaa4c2ffaf5341c8e2d1808b7b2fd588f85048ad956f4a370741e" name="qemu-hw-display-virtio-gpu" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="7f3ff0bcda01b7d08bf14b3def1403c8c222654bb9de0c6d97794f53bc887e6a" name="qemu-hw-display-virtio-vga" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="6031cd7801770ad251255bd9d164024a5d484292ca3bc064e6f60565b1652000" name="qemu-hw-display-virtio-vga" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="89afa5772fe79c15baee04795c81f0ad8362444b0e159040048a5f1a0a67164b" name="qemu-hw-display-virtio-vga" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="7ec885929dcedd34b2e5d08d308687586e442dc1d61c5532fe8cbda25a55ae39" name="qemu-hw-display-virtio-vga" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="27f96f1c2596bc5788247fd792aa2ce3dba42caef49c9f0037cdb01448f887b5" name="qemu-hw-usb-redirect" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="7e172fc7128b74b5b1014dd4640f4dfd804044e8331a07bfb284f649d8e69ea9" name="qemu-hw-usb-redirect" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="a16b2c7bb9fc2d2443131a6834195eca1ba1dfbf824a5acc2a4125e276d52a00" name="qemu-hw-usb-redirect" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="794616e4b5164892707526998c8905bb32a5ad4bc6cb79ef42ee533aef1fc377" name="qemu-hw-usb-redirect" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="53cff19b84810038d6858a091ee15153d7b5d1de6ea9aa25b9c315fc142b6747" name="qemu-ipxe" arch="noarch">
  <version epoch="0" ver="1.0.0+" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="6d07f593f194669e40cedb6e5d5456cbec90bbdcc6c228cedb4a502c22944254" name="qemu-ipxe" arch="noarch">
  <version epoch="0" ver="1.0.0+" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="c453b2a1904c23820a906984af6070132f3c96901cc245d0d7081e5b8f303c9d" name="qemu-seabios" arch="noarch">
  <version epoch="0" ver="1.15.0_0_g2dd4b9b" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="71673bfee29ca88bb6a86e70f12cdbebb6df40a770a5f6be6035e4597479b026" name="qemu-seabios" arch="noarch">
  <version epoch="0" ver="1.15.0_0_g2dd4b9b" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="db85ca9d290d2c19a40cebb87d09f80b2ac14ea8a1b4a653c763de699a62b2bf" name="qemu-sgabios" arch="noarch">
  <version epoch="0" ver="8" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="77fac3c08baa11c5a14c1e43a06fd3d35cae756b5a70cffb8c6ed9afb397e2c9" name="qemu-sgabios" arch="noarch">
  <version epoch="0" ver="8" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="2fffe72856ca4ef35f029eb910c3cc9ed8151abca1bd2b6338d8f47e9a7e4818" name="qemu-tools" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="a960aa31cdb4b26eff32e4f37305e2a0f87d70ee7e53a592093b2e64804196cc" name="qemu-tools" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="85f4364dc4a8871ee0afc80993c229c4651865a96cb5ac0f4590da4d01e08929" name="qemu-tools" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="fa5513f3dd6fa0d98355e0a59159e5f85817aabe640868438e3b33cef5725582" name="qemu-tools" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="c2aeaab1f8e0229358bb172e7a46ab6cb06d18cd85893283cd492e47f892be38" name="qemu-ui-opengl" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="68775fb219d5bea277b96579b524b0cb3b076aaa2a8fb323b675e3977825d79c" name="qemu-ui-opengl" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="e729f9481d939cc35d1664d9d720c457e6a769e1a12f4dea7be7310d02bf6988" name="qemu-ui-opengl" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="5dcb3b3783bf96e265d588bc51de6c144adc924bd5466788464ec9b2b55782d6" name="qemu-ui-opengl" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="e5906c78c257a842d4014b41e3beb02787e38f825c469fb239d117598e3e84dd" name="qemu-ui-spice-core" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="5b6a73324a42112b2689a9650f915cef671770e1a21016cb08a498327371b659" name="qemu-ui-spice-core" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="a74b414bcce6f44df4cc07546f2aa8e00f340d387d11e5582c6e2cd785000fa2" name="qemu-ui-spice-core" arch="aarch64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="2b5b4901c5c57ad5f99b85a215e86c2566f8866c449ac909f9ff63dd55fadb57" name="qemu-ui-spice-core" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="df3c7483373b6da4a9d409aa1e555ab09baa35d91d154b126f5745a2bb65834f" name="qemu-vgabios" arch="noarch">
  <version epoch="0" ver="1.15.0_0_g2dd4b9b" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="181eaaa509d3c424184b05246e6d14e80cdb3698b9a8ea1515f87b991db3a8f3" name="qemu-vgabios" arch="noarch">
  <version epoch="0" ver="1.15.0_0_g2dd4b9b" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="2fb3e35b767c3951309598eb428d48177897b5c2973ea8d6d1b45617f3b90d83" name="qemu-x86" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.11.1"/>
  <changelog author="li.zhang@suse.com" date="1648123200">- Improve test reliability
  * Patches added:
  Fix-the-module-building-problem-for-s390.patch
  tests-qemu-iotests-040-Skip-TestCommitWi.patch
  tests-qemu-iotests-testrunner-Quote-case.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Fix update_git.sh wiping all the package file of the local
  checkout while cloning the git repository on demand (in case they
  don't exist and the user as to do so).</changelog>
  <changelog author="dfaggioli@suse.com" date="1648209601">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
</package>
<package pkgid="0cc3981f5c8f096559cc0405b76378c42a127cb95fc2693df8c2ef9e7f869be3" name="qemu-x86" arch="x86_64">
  <version epoch="0" ver="6.2.0" rel="150400.37.14.2"/>
  <changelog author="dfaggioli@suse.com" date="1648209600">- Kill downstream patches around bifmt handling that makes
  cumbersome to run multi-arch containers, and switch to the
  upstream behavior, which is well documented and valid on
  all other distros. This is possible thanks to Linux kernel
  commit 2347961b11d4 and QEMU commit 6e1c0d7b951e19c53 (so
  it can only work on Leap/SLE 15.4 and higher). (bsc#1197298)
  * Patches dropped:
  qemu-binfmt-conf.sh-allow-overriding-SUS.patch
  qemu-binfmt-conf-use-qemu-ARCH-binfmt.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1648555200">- Add missing patch from a PTFs (bsc#1194938)
  * Patches added:
  scsi-generic-check-for-additional-SG_IO-.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555201">- The patches from upstream cause testsuit failures (bsc#1197150 bsc#1197528)
  * Patches added:
  Revert-python-iotests-replace-qmp-with-a.patch
  Revert-python-machine-add-instance-disam.patch
  Revert-python-machine-add-sock_dir-prope.patch
  Revert-python-machine-handle-fast-QEMU-t.patch
  Revert-python-machine-move-more-variable.patch
  Revert-python-machine-remove-_remove_mon.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648555202">- Backport CVE-2021-3929 (bsc#1193880)
  * Patches added:
  hw-nvme-fix-CVE-2021-3929.patch</changelog>
  <changelog author="li.zhang@suse.com" date="1648728000">- Support the SGX feature (bsc#1197807)
  * Patches added:
  doc-Add-the-SGX-numa-description.patch
  numa-Enable-numa-for-SGX-EPC-sections.patch
  numa-Support-SGX-numa-in-the-monitor-and.patch</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- enable aio=io_uring on all kvm architectures (bsc#1197699)</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport a GCC 12 aarch64 build fix (bsc#1199625)
  * Patches added:
  block-qdict-Fix-Werror-maybe-uninitializ.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307201">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307202">- Fix bsc#1198712, CVE-2022-26354
- Fix bsc#1198711, CVE-2022-26353
  * Patches added:
  vhost-vsock-detach-the-virqueue-element-.patch
  virtio-net-fix-map-leaking-on-error-duri.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1653393600">- Get rid of downstream patches breaking s390 modules. Replace
  them with the upstream proposed and Acked (but never committed)
  solution (bsc#1199015)
  * Patches added:
  modules-generates-per-target-modinfo.patch
  modules-introduces-module_kconfig-direct.patch
  * Patches dropped:
  Fix-the-module-building-problem-for-s390.patch
  modules-quick-fix-a-fundamental-error-in.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Improve the output of update_git.sh, by including the list of
  repos to which we have downstream patches.
- Fix bsc#1197084 and bsc#1199924
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix: bsc#1198038, CVE-2022-0216
- Fix: bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1664539200">- Fix bsc#1198038, CVE-2022-0216
  * Patches added:
  scsi-lsi53c895a-really-fix-use-after-fre.patch</changelog>
  <changelog author="lma@suse.com" date="1668600000">- Fix qemu "block limits" VPD emulation broken (bsc#1202364)
  * Patches added:
  hw-scsi-scsi-generic-Fixup-VPD-block-lim.patch
  scsi-generic-Fix-emulated-block-limits-V.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1676980800">- Fix bsc#1206527
  * Patches added:
  s390x-tod-kvm-don-t-save-restore-the-TOD.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677067200">- Fixes bsc#1205808 (CVE-2022-4144), bsc#1203788  (CVE-2022-3165),
  bsc#1197653 (CVE-2022-1050)
  * Patches added:
  hw-display-qxl-Assert-memory-slot-fits-i.patch
  hw-display-qxl-Avoid-buffer-overrun-in-q.patch
  hw-display-qxl-Document-qxl_phys2virt.patch
  hw-display-qxl-Have-qxl_log_command-Retu.patch
  hw-display-qxl-Pass-requested-buffer-siz.patch
  ui-vnc-clipboard-fix-integer-underflow-i.patch
  hw-pvrdma-Protect-against-buggy-or-malic.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1677758400">- Fix: bsc#1185000, CVE-2021-3507
  * Patches added:
  hw-block-fdc-Prevent-end-of-track-overru.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1678276800">- Fix bsc#1180207 (CVE-2020-14394)
  * Patches added:
  hw-usb-hcd-xhci-Fix-unbounded-loop-in-xh.patch</changelog>
</package>
<package pkgid="26a00e07db13916a6a5317fe5e33fe15bb29abe4de881c8dbc716ecccbd2aaa8" name="rpm" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1586347200">- Fix verification of DSA2 signatures with libgrcypt [bnc#1165731]
  * new patch: gcryptdsa2.diff</changelog>
  <changelog author="mls@suse.de" date="1586865600">- Do not map the index database read-write all the time [bnc#1168735]
  * new patch: ndb_backport2.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1590321600">- Add reproducible-debuginfo.patch to generate debuginfo
  in a reproducible way [bsc#1172173]</changelog>
  <changelog author="lpechacek@suse.com" date="1603800000">- Backport support for compressed kernel modules (jsc#SLE-10886)
  * added patch: compressed-kernel-modules.diff
  * modified file: find-requires.ksyms
  * modified file: find-provides.ksyms
- Fix obvious bugs in find-provides.ksyms
  * https://github.com/openSUSE/rpm-config-SUSE/pull/34</changelog>
  <changelog author="mls@suse.de" date="1607428800">- Handle xz compressed kernels in find-provides.ksyms [bsc#1179251]
  * modified file: find-requires.ksyms</changelog>
  <changelog author="mls@suse.de" date="1607515200">- Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428]
  * new patch: touch_backport.diff
- Backport read-only berkeley db support and enable it if we
  disable berkeley db [jsc#SLE-7272]
  * new patch: bdb_ro_backport.diff</changelog>
  <changelog author="mls@suse.de" date="1608638400">- Finish split of SUSE macros and some helpers into rpm-config-SUSE
  [jsc#SLE-17074]
  * new patch: findsupplements.diff
  * modified patches: fileattrs.diff, brp.diff, macrosin.diff,
    enable-postin-scripts-error.diff
  * dropped files: rpm-suse_macros
  * dropped patches: firmware.diff, initscriptsprov.diff,
    modalias-encode.diff, modalias.diff,
    compressed-kernel-modules.diff, findksyms.diff</changelog>
  <changelog author="mls@suse.de" date="1611921600">- Increase the maximum size of the signature header so that rpms
  containing file signatures can be queried [bsc#1181568]
  * new patch: sigheadersize.diff</changelog>
  <changelog author="mls@suse.de" date="1612958400">- Do not require the signature header to be in a contiguous
  region when signing [bnc#1181805]
  * new patch: signbadregion.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1613995200">- Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279]</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3 [jsc#SLE-17817]
  * add support for enforcing signature policy and payload
    verification step to transactions
  * add :humansi and :hmaniec query formatters for human readable output
  * add query selectors –-whatobsoletes and –-whatconflicts
  * add support for sorting caret (‘^’) higher than base version
- refreshed patches:
  * checksepwarn.diff
  * dbrointerruptable.diff
  * finddebuginfo.diff
  * ndb-backport.diff
  * pythondistdeps.diff
  * remove-brp-strips.diff
  * whatrequires-doc.diff
- dropped patches:
  * debugedit-bnc1076819.diff
  * debugedit-riscv.patch
  * disttag-macro.diff
  * hardlinks.diff
  * reproducible-debuginfo.patch
  * rpm-4.14.1-initialize-verifyflags.diff
  * safesymlinks.diff
  * signbadregion.diff
  * verifynodup.diff</changelog>
  <changelog author="mls@suse.de" date="1619006400">- set default package verification level to 'none' to be compatible
  to rpm-4.14.1
  new patch: verifylevel_none.diff
- make illegal obsoletes a warning
  new patch: badobsoletewarn.diff
- backport header check security fixes from upstream [CVE-2021-3421]
  [CVE-2021-20271] [CVE-2021-20266]
  [bsc#1183543] [bsc#1183545]
  new patch: headerchk3.diff
- fix potential access of freed mem in ndb's glue code [bnc#1179416]
  new patch: ndbglue.diff
- permit secondary index open to fail for bdb_ro
  new patch: bdbro_missingidx.diff</changelog>
  <changelog author="mls@suse.de" date="1633521600">- backport zstd detection fix [bsc#1187670]
  new patch: zstddetection.diff
- backport ndb rofs support [bsc#1188548]
  new patch: ndbrofs.diff
- backport pgp hardening changes from upstream [bsc#1185299]
  new patch: pgpharden.diff
- fix deadlock when multiple rpm processes try tp acquire the
  database lock [bsc#1183659]
  new patch: deadlock.diff</changelog>
  <changelog author="mcepl@suse.com" date="1639483200">- Add explicit requirement on python-rpm-macros to avoid widespread
  breakage by package mistakenly ignoring their requirement of
  python-rpm-macros (bsc#1180125, bsc#1193711).</changelog>
  <changelog author="mls@suse.de" date="1640174400">- Backport header check changes so that old rpms get no longer
  rejected [bsc#1190824]
  updated patch: headerchk3.diff</changelog>
  <changelog author="mls@suse.de" date="1642680000">- Revert unwanted /usr/bin/python -&gt; /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff</changelog>
  <changelog author="mls@suse.de" date="1657627200">- Support Ed25519 signatures [jsc#SLE-24714]
  * new patch: ed25519.diff</changelog>
  <changelog author="mls@suse.de" date="1666699200">- Strip critical bit in signature subpackage parsing
  * modified patch: pgpharden.diff
- Add workaround to make newer dnf versions no longer deadlock
  after it imported a pubkey [bnc#1202750]
  * new patch: keyimportdeadlock.diff</changelog>
  <changelog author="dmueller@suse.com" date="1674129600">- add pythondeps-python310.diff
  and add match-python-version-if-minor.diff:
  * fix missing python(abi) for 3.XX versions (bsc#1207294)</changelog>
  <changelog author="daniel.garcia@suse.com" date="1674129601">- update pythondeps-python310.diff: replace with minimal fix to
  support python 3.xx (bsc#1207294)</changelog>
</package>
<package pkgid="fd86090d5968b53c29914077252fc7ccf8b78fef44b00df345fb89b1fe620aaa" name="rpm" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1586347200">- Fix verification of DSA2 signatures with libgrcypt [bnc#1165731]
  * new patch: gcryptdsa2.diff</changelog>
  <changelog author="mls@suse.de" date="1586865600">- Do not map the index database read-write all the time [bnc#1168735]
  * new patch: ndb_backport2.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1590321600">- Add reproducible-debuginfo.patch to generate debuginfo
  in a reproducible way [bsc#1172173]</changelog>
  <changelog author="lpechacek@suse.com" date="1603800000">- Backport support for compressed kernel modules (jsc#SLE-10886)
  * added patch: compressed-kernel-modules.diff
  * modified file: find-requires.ksyms
  * modified file: find-provides.ksyms
- Fix obvious bugs in find-provides.ksyms
  * https://github.com/openSUSE/rpm-config-SUSE/pull/34</changelog>
  <changelog author="mls@suse.de" date="1607428800">- Handle xz compressed kernels in find-provides.ksyms [bsc#1179251]
  * modified file: find-requires.ksyms</changelog>
  <changelog author="mls@suse.de" date="1607515200">- Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428]
  * new patch: touch_backport.diff
- Backport read-only berkeley db support and enable it if we
  disable berkeley db [jsc#SLE-7272]
  * new patch: bdb_ro_backport.diff</changelog>
  <changelog author="mls@suse.de" date="1608638400">- Finish split of SUSE macros and some helpers into rpm-config-SUSE
  [jsc#SLE-17074]
  * new patch: findsupplements.diff
  * modified patches: fileattrs.diff, brp.diff, macrosin.diff,
    enable-postin-scripts-error.diff
  * dropped files: rpm-suse_macros
  * dropped patches: firmware.diff, initscriptsprov.diff,
    modalias-encode.diff, modalias.diff,
    compressed-kernel-modules.diff, findksyms.diff</changelog>
  <changelog author="mls@suse.de" date="1611921600">- Increase the maximum size of the signature header so that rpms
  containing file signatures can be queried [bsc#1181568]
  * new patch: sigheadersize.diff</changelog>
  <changelog author="mls@suse.de" date="1612958400">- Do not require the signature header to be in a contiguous
  region when signing [bnc#1181805]
  * new patch: signbadregion.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1613995200">- Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279]</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3 [jsc#SLE-17817]
  * add support for enforcing signature policy and payload
    verification step to transactions
  * add :humansi and :hmaniec query formatters for human readable output
  * add query selectors –-whatobsoletes and –-whatconflicts
  * add support for sorting caret (‘^’) higher than base version
- refreshed patches:
  * checksepwarn.diff
  * dbrointerruptable.diff
  * finddebuginfo.diff
  * ndb-backport.diff
  * pythondistdeps.diff
  * remove-brp-strips.diff
  * whatrequires-doc.diff
- dropped patches:
  * debugedit-bnc1076819.diff
  * debugedit-riscv.patch
  * disttag-macro.diff
  * hardlinks.diff
  * reproducible-debuginfo.patch
  * rpm-4.14.1-initialize-verifyflags.diff
  * safesymlinks.diff
  * signbadregion.diff
  * verifynodup.diff</changelog>
  <changelog author="mls@suse.de" date="1619006400">- set default package verification level to 'none' to be compatible
  to rpm-4.14.1
  new patch: verifylevel_none.diff
- make illegal obsoletes a warning
  new patch: badobsoletewarn.diff
- backport header check security fixes from upstream [CVE-2021-3421]
  [CVE-2021-20271] [CVE-2021-20266]
  [bsc#1183543] [bsc#1183545]
  new patch: headerchk3.diff
- fix potential access of freed mem in ndb's glue code [bnc#1179416]
  new patch: ndbglue.diff
- permit secondary index open to fail for bdb_ro
  new patch: bdbro_missingidx.diff</changelog>
  <changelog author="mls@suse.de" date="1633521600">- backport zstd detection fix [bsc#1187670]
  new patch: zstddetection.diff
- backport ndb rofs support [bsc#1188548]
  new patch: ndbrofs.diff
- backport pgp hardening changes from upstream [bsc#1185299]
  new patch: pgpharden.diff
- fix deadlock when multiple rpm processes try tp acquire the
  database lock [bsc#1183659]
  new patch: deadlock.diff</changelog>
  <changelog author="mcepl@suse.com" date="1639483200">- Add explicit requirement on python-rpm-macros to avoid widespread
  breakage by package mistakenly ignoring their requirement of
  python-rpm-macros (bsc#1180125, bsc#1193711).</changelog>
  <changelog author="mls@suse.de" date="1640174400">- Backport header check changes so that old rpms get no longer
  rejected [bsc#1190824]
  updated patch: headerchk3.diff</changelog>
  <changelog author="mls@suse.de" date="1642680000">- Revert unwanted /usr/bin/python -&gt; /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff</changelog>
  <changelog author="mls@suse.de" date="1657627200">- Support Ed25519 signatures [jsc#SLE-24714]
  * new patch: ed25519.diff</changelog>
  <changelog author="mls@suse.de" date="1666699200">- Strip critical bit in signature subpackage parsing
  * modified patch: pgpharden.diff
- Add workaround to make newer dnf versions no longer deadlock
  after it imported a pubkey [bnc#1202750]
  * new patch: keyimportdeadlock.diff</changelog>
  <changelog author="dmueller@suse.com" date="1674129600">- add pythondeps-python310.diff
  and add match-python-version-if-minor.diff:
  * fix missing python(abi) for 3.XX versions (bsc#1207294)</changelog>
  <changelog author="daniel.garcia@suse.com" date="1674129601">- update pythondeps-python310.diff: replace with minimal fix to
  support python 3.xx (bsc#1207294)</changelog>
</package>
<package pkgid="11c10c40a77e3d3032a28cf4e04ad33fbd7c7a2d9ef0dd8e92166bfdf23c9a45" name="rpm" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1586347200">- Fix verification of DSA2 signatures with libgrcypt [bnc#1165731]
  * new patch: gcryptdsa2.diff</changelog>
  <changelog author="mls@suse.de" date="1586865600">- Do not map the index database read-write all the time [bnc#1168735]
  * new patch: ndb_backport2.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1590321600">- Add reproducible-debuginfo.patch to generate debuginfo
  in a reproducible way [bsc#1172173]</changelog>
  <changelog author="lpechacek@suse.com" date="1603800000">- Backport support for compressed kernel modules (jsc#SLE-10886)
  * added patch: compressed-kernel-modules.diff
  * modified file: find-requires.ksyms
  * modified file: find-provides.ksyms
- Fix obvious bugs in find-provides.ksyms
  * https://github.com/openSUSE/rpm-config-SUSE/pull/34</changelog>
  <changelog author="mls@suse.de" date="1607428800">- Handle xz compressed kernels in find-provides.ksyms [bsc#1179251]
  * modified file: find-requires.ksyms</changelog>
  <changelog author="mls@suse.de" date="1607515200">- Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428]
  * new patch: touch_backport.diff
- Backport read-only berkeley db support and enable it if we
  disable berkeley db [jsc#SLE-7272]
  * new patch: bdb_ro_backport.diff</changelog>
  <changelog author="mls@suse.de" date="1608638400">- Finish split of SUSE macros and some helpers into rpm-config-SUSE
  [jsc#SLE-17074]
  * new patch: findsupplements.diff
  * modified patches: fileattrs.diff, brp.diff, macrosin.diff,
    enable-postin-scripts-error.diff
  * dropped files: rpm-suse_macros
  * dropped patches: firmware.diff, initscriptsprov.diff,
    modalias-encode.diff, modalias.diff,
    compressed-kernel-modules.diff, findksyms.diff</changelog>
  <changelog author="mls@suse.de" date="1611921600">- Increase the maximum size of the signature header so that rpms
  containing file signatures can be queried [bsc#1181568]
  * new patch: sigheadersize.diff</changelog>
  <changelog author="mls@suse.de" date="1612958400">- Do not require the signature header to be in a contiguous
  region when signing [bnc#1181805]
  * new patch: signbadregion.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1613995200">- Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279]</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3 [jsc#SLE-17817]
  * add support for enforcing signature policy and payload
    verification step to transactions
  * add :humansi and :hmaniec query formatters for human readable output
  * add query selectors –-whatobsoletes and –-whatconflicts
  * add support for sorting caret (‘^’) higher than base version
- refreshed patches:
  * checksepwarn.diff
  * dbrointerruptable.diff
  * finddebuginfo.diff
  * ndb-backport.diff
  * pythondistdeps.diff
  * remove-brp-strips.diff
  * whatrequires-doc.diff
- dropped patches:
  * debugedit-bnc1076819.diff
  * debugedit-riscv.patch
  * disttag-macro.diff
  * hardlinks.diff
  * reproducible-debuginfo.patch
  * rpm-4.14.1-initialize-verifyflags.diff
  * safesymlinks.diff
  * signbadregion.diff
  * verifynodup.diff</changelog>
  <changelog author="mls@suse.de" date="1619006400">- set default package verification level to 'none' to be compatible
  to rpm-4.14.1
  new patch: verifylevel_none.diff
- make illegal obsoletes a warning
  new patch: badobsoletewarn.diff
- backport header check security fixes from upstream [CVE-2021-3421]
  [CVE-2021-20271] [CVE-2021-20266]
  [bsc#1183543] [bsc#1183545]
  new patch: headerchk3.diff
- fix potential access of freed mem in ndb's glue code [bnc#1179416]
  new patch: ndbglue.diff
- permit secondary index open to fail for bdb_ro
  new patch: bdbro_missingidx.diff</changelog>
  <changelog author="mls@suse.de" date="1633521600">- backport zstd detection fix [bsc#1187670]
  new patch: zstddetection.diff
- backport ndb rofs support [bsc#1188548]
  new patch: ndbrofs.diff
- backport pgp hardening changes from upstream [bsc#1185299]
  new patch: pgpharden.diff
- fix deadlock when multiple rpm processes try tp acquire the
  database lock [bsc#1183659]
  new patch: deadlock.diff</changelog>
  <changelog author="mcepl@suse.com" date="1639483200">- Add explicit requirement on python-rpm-macros to avoid widespread
  breakage by package mistakenly ignoring their requirement of
  python-rpm-macros (bsc#1180125, bsc#1193711).</changelog>
  <changelog author="mls@suse.de" date="1640174400">- Backport header check changes so that old rpms get no longer
  rejected [bsc#1190824]
  updated patch: headerchk3.diff</changelog>
  <changelog author="mls@suse.de" date="1642680000">- Revert unwanted /usr/bin/python -&gt; /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff</changelog>
  <changelog author="mls@suse.de" date="1657627200">- Support Ed25519 signatures [jsc#SLE-24714]
  * new patch: ed25519.diff</changelog>
  <changelog author="mls@suse.de" date="1666699200">- Strip critical bit in signature subpackage parsing
  * modified patch: pgpharden.diff
- Add workaround to make newer dnf versions no longer deadlock
  after it imported a pubkey [bnc#1202750]
  * new patch: keyimportdeadlock.diff</changelog>
  <changelog author="dmueller@suse.com" date="1674129600">- add pythondeps-python310.diff
  and add match-python-version-if-minor.diff:
  * fix missing python(abi) for 3.XX versions (bsc#1207294)</changelog>
  <changelog author="daniel.garcia@suse.com" date="1674129601">- update pythondeps-python310.diff: replace with minimal fix to
  support python 3.xx (bsc#1207294)</changelog>
</package>
<package pkgid="3a8ce6f2d5c78e29eaf845985aa69500ad71339647a7092f6780966c45599ae7" name="rpm-ndb" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Initial revision</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="c1c2f2f4e3afb8ee5e73ee160809edc8e7787741756f933b066d4f24ddc051bf" name="rpm-ndb" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Initial revision</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="fe254b90ec4a31c8972fe06b6b816c70bde0234bce2863cfea3e5ba28567a567" name="rpm-ndb" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Initial revision</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="96ca9d4e666d116da98f8287603c72b3c6562950b8b345dc3c9b3668b4e53c0b" name="salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150400.8.17.7"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
</package>
<package pkgid="6e0bc9fb5b92bfa934b5cded26a9187a8570c6dc01fdc512cf57d48a627be2fc" name="salt" arch="src">
  <version epoch="0" ver="3004" rel="150400.8.17.7"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
</package>
<package pkgid="0002fd73d035f49457938c064dece67486508f9009b99121c0772a3fc32bfd21" name="salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150400.8.17.7"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
</package>
<package pkgid="490510c9d431a6ec21a4fbff76a6382d0c265b7addf6e97784f796b6999b5fab" name="salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150400.8.20.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="b5d618d2dc36486eb3c893e145d5fa5317d9361b8836e003420e626756bcc8e6" name="salt" arch="src">
  <version epoch="0" ver="3004" rel="150400.8.20.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="fe081f1d7a6083f727e63f12037726ad74c1d7defb8ed5ba52a178b3df7a2f45" name="salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150400.8.20.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="4f7c7d23374b5ba952f5e4459997ad708d7c5fcc067e44cf5263f6b01dc90ef2" name="salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150400.8.25.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677153600">- Fixes pkg.version_cmp on openEuler systems and a few other OS flavors
- Make pkg.remove function from zypperpkg module to handle also PTF packages
- Added:
  * 3004-implement-zypper-removeptf-574.patch
  * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677499200">- Fix problem with detecting PTF packages (bsc#1208691)
- Added:
  * skip-package-names-without-colon-bsc-1208691-578.patch</changelog>
</package>
<package pkgid="2919e2e6f967e2d0741cb7df6db1de389c9afd43f136bbada3c594bc6935211c" name="salt" arch="src">
  <version epoch="0" ver="3004" rel="150400.8.25.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677153600">- Fixes pkg.version_cmp on openEuler systems and a few other OS flavors
- Make pkg.remove function from zypperpkg module to handle also PTF packages
- Added:
  * 3004-implement-zypper-removeptf-574.patch
  * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677499200">- Fix problem with detecting PTF packages (bsc#1208691)
- Added:
  * skip-package-names-without-colon-bsc-1208691-578.patch</changelog>
</package>
<package pkgid="31b630427a1750dc53b176c55f25c705658f8cae93f7619074911026abe594ce" name="salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150400.8.25.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677153600">- Fixes pkg.version_cmp on openEuler systems and a few other OS flavors
- Make pkg.remove function from zypperpkg module to handle also PTF packages
- Added:
  * 3004-implement-zypper-removeptf-574.patch
  * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677499200">- Fix problem with detecting PTF packages (bsc#1208691)
- Added:
  * skip-package-names-without-colon-bsc-1208691-578.patch</changelog>
</package>
<package pkgid="465af986d92128290cd3eab456fe1502c871cccfd3f5c1b628b2b0d12d5bb1a2" name="salt-minion" arch="aarch64">
  <version epoch="0" ver="3004" rel="150400.8.17.7"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
</package>
<package pkgid="6371972331267981a2cfd6e1aae15533f54216b7cce8fbec8f08f2045197c040" name="salt-minion" arch="x86_64">
  <version epoch="0" ver="3004" rel="150400.8.17.7"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
</package>
<package pkgid="6b105e05813c70d9158c5d11e9d2db827df253bf380b06707a1341b7993f76c5" name="salt-minion" arch="aarch64">
  <version epoch="0" ver="3004" rel="150400.8.20.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="293ecde8f6e8b67f90cdc9deb63d6b07d69929381c6be50af53d039ec50d4c61" name="salt-minion" arch="x86_64">
  <version epoch="0" ver="3004" rel="150400.8.20.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="5f1a5546ffc55844fd9a784ef9c186a0dff7e9a4ba0529765e3018b7c70797e3" name="salt-minion" arch="aarch64">
  <version epoch="0" ver="3004" rel="150400.8.25.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677153600">- Fixes pkg.version_cmp on openEuler systems and a few other OS flavors
- Make pkg.remove function from zypperpkg module to handle also PTF packages
- Added:
  * 3004-implement-zypper-removeptf-574.patch
  * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677499200">- Fix problem with detecting PTF packages (bsc#1208691)
- Added:
  * skip-package-names-without-colon-bsc-1208691-578.patch</changelog>
</package>
<package pkgid="fd2583e993a050883f656a227705e14ed466902017d99bcf19ad007a5b02b820" name="salt-minion" arch="x86_64">
  <version epoch="0" ver="3004" rel="150400.8.25.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677153600">- Fixes pkg.version_cmp on openEuler systems and a few other OS flavors
- Make pkg.remove function from zypperpkg module to handle also PTF packages
- Added:
  * 3004-implement-zypper-removeptf-574.patch
  * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677499200">- Fix problem with detecting PTF packages (bsc#1208691)
- Added:
  * skip-package-names-without-colon-bsc-1208691-578.patch</changelog>
</package>
<package pkgid="530eb957be605a4d6d80b48df19d4aef3d39cc814524b9ca12412aadeedba2f4" name="salt-transactional-update" arch="aarch64">
  <version epoch="0" ver="3004" rel="150400.8.17.7"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
</package>
<package pkgid="d9c0930833efd0aeee3f04391b7d1c5d97d999b5035e5002ba3017e405d27264" name="salt-transactional-update" arch="x86_64">
  <version epoch="0" ver="3004" rel="150400.8.17.7"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
</package>
<package pkgid="a03562e5fc634fbe0c4f37e4989cf5d732ff0ee673a9f3a74ea8f9ec8fca6a16" name="salt-transactional-update" arch="aarch64">
  <version epoch="0" ver="3004" rel="150400.8.20.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="b971bd40ad5c62830545d5d396c499ba731814c01809a781e0c74423ac64acbd" name="salt-transactional-update" arch="x86_64">
  <version epoch="0" ver="3004" rel="150400.8.20.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="588e2464552d1bbdaa96ee92bca2c5f0eacfb74e6cd509f9175a3652dde3ed50" name="salt-transactional-update" arch="aarch64">
  <version epoch="0" ver="3004" rel="150400.8.25.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677153600">- Fixes pkg.version_cmp on openEuler systems and a few other OS flavors
- Make pkg.remove function from zypperpkg module to handle also PTF packages
- Added:
  * 3004-implement-zypper-removeptf-574.patch
  * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677499200">- Fix problem with detecting PTF packages (bsc#1208691)
- Added:
  * skip-package-names-without-colon-bsc-1208691-578.patch</changelog>
</package>
<package pkgid="1d844d466e25278d09bab383c8717cc34c0daf3167cbfa9d2803a3408bdfbb86" name="salt-transactional-update" arch="x86_64">
  <version epoch="0" ver="3004" rel="150400.8.25.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348800">- Exclude the full path of a download URL to prevent injection
  of malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348801">- Update to Salt release version 3003.3 (jsc#SLE-22204)
  * See release notes: https://docs.saltstack.com/en/latest/topics/releases/3003.3.html
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * support-transactional-systems-microos.patch
  * allow-vendor-change-option-with-zypper.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * virt-enhancements.patch
- Modified:
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * include-aliases-in-the-fqdns-grains.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * improvements-on-ansiblegate-module-354.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * x509-fixes-111.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * debian-info_installed-compatibility-50453.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * fix-bsc-1065792.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * async-batch-implementation.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * adds-explicit-type-cast-for-port.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * add-custom-suse-capabilities-as-grains.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * early-feature-support-config.patch
- Removed:
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * python3.8-compatibility-pr-s-235.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * accumulated-changes-from-yomi-167.patch
  * add-docker-logout-237.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * add-hold-unhold-functions.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * fix-unit-test-for-grains-core.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * open-suse-3002.2-xen-grub-316.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * grains-master-can-read-grains.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * fix-batch_async-obsolete-test.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * opensuse-3000-virt-defined-states-222.patch
  * changed-imports-to-vendored-tornado.patch
  * add-virt.all_capabilities.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-grains.test_core-unit-test-277.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * fall-back-to-pymysql.patch
  * virt-uefi-fix-backport-312.patch
  * reintroducing-reverted-changes.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * make-profiles-a-package.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * transactional_update-unify-with-chroot.call.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * fix-novendorchange-option-284.patch
  * fix-async-batch-race-conditions.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * backport-a-few-virt-prs-272.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-__mount_device-wrapper-254.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * re-adding-function-to-test-for-root.patch
  * fix-async-batch-multiple-done-events.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-pkg.services_need_restart-302.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fixing-streamclosed-issue.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * xen-disk-fixes-264.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * open-suse-3002.2-bigvm-310.patch
  * fix-for-log-checking-in-x509-test.patch
  * open-suse-3002.2-virt-network-311.patch
  * async-batch-implementation-fix-320.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * support-transactional-systems-microos-271.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633348802">- Do not break master_tops for minion with version lower to 3003
- Support querying for JSON data in external sql pillar
- Added:
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1634126400">- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Added:
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637236800">- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Use dnfnotify instead yumnotify for relevant distros
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Make "tar" as required for "salt-transactional-update" package
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Added:
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1643630400">- Update to version 3004 (jsc#SLE-23675)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Fix exception in batch_async caused by a bad function call
- Fix inspector module export function (bsc#1097531)
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * fix-inspector-module-export-function-bsc-1097531-481.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
- Modified:
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
  * 3003.3-postgresql-json-support-in-pillar-423.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-custom-suse-capabilities-as-grains.patch
  * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * debian-info_installed-compatibility-50453.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * info_installed-works-without-status-attr-now.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * improvements-on-ansiblegate-module-354.patch
  * support-transactional-systems-microos.patch
  * x509-fixes-111.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * include-aliases-in-the-fqdns-grains.patch
- Removed:
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-a-test-and-some-variable-names-229.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * virt-enhancements.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * do-not-break-master_tops-for-minion-with-version-low.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1644321600">- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1646049600">- Add salt-ssh with Salt Bundle support (venv-salt-minion)
  (bsc#1182851, bsc#1196432)
- Fix issues found around pre_flight_script_args
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Fix salt-call event.send with pillar or grains
- Update generated documentation to 3004
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728000">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648728001">- Fix salt-ssh opts poisoning (bsc#1197637)
- Added:
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Fixes for Python 3.10
- Added:
  * fixes-for-python-3.10-502.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1652961600">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-gpgautoimport-539.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * use-salt-bundle-in-dockermod.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-test_ipc-unit-tests.patch
  * backport-syndic-auth-fixes.patch
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * detect-module.run-syntax.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * pass-the-context-to-pillar-ext-modules.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677153600">- Fixes pkg.version_cmp on openEuler systems and a few other OS flavors
- Make pkg.remove function from zypperpkg module to handle also PTF packages
- Added:
  * 3004-implement-zypper-removeptf-574.patch
  * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1677499200">- Fix problem with detecting PTF packages (bsc#1208691)
- Added:
  * skip-package-names-without-colon-bsc-1208691-578.patch</changelog>
</package>
<package pkgid="fc9057959d6cd94478f2b7741428791d1a79daaca9c224be785f67a4b7c0bb85" name="samba" arch="src">
  <version epoch="0" ver="4.15.13+git.591.ab36624310c" rel="150400.3.19.1"/>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="scabrero@suse.de" date="1671451200">- Update to 4.15.13
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237); (bsc#1205385);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231); (bsc#1205386);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240); (bsc#1206504);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
- Adjust the systemd drop-in file for named service; (bsc#1201689);
  * Paths are additive so do not repeat paths from named.service
  * Prefix the samba DLZ directory with "-" to ignore this path
    if it does not exists</changelog>
  <changelog author="nopower@suse.com" date="1673265600">- CVE-2021-20251: samba: Bad password count not incremented
  atomically; (bso#14611); (bsc#1206546).</changelog>
  <changelog author="scabrero@suse.de" date="1673352000">- CVE-2022-38023 Additional patches for the PDC role's netlogon
  server; (bso#15240); (bsc#1206504);</changelog>
</package>
<package pkgid="d9cc354c3faf3a9afc27e197dc81e68d40a4e5a8b781473e5ba45dab4798cdac" name="samba-client-libs" arch="aarch64">
  <version epoch="0" ver="4.15.13+git.591.ab36624310c" rel="150400.3.19.1"/>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="scabrero@suse.de" date="1671451200">- Update to 4.15.13
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237); (bsc#1205385);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231); (bsc#1205386);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240); (bsc#1206504);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
- Adjust the systemd drop-in file for named service; (bsc#1201689);
  * Paths are additive so do not repeat paths from named.service
  * Prefix the samba DLZ directory with "-" to ignore this path
    if it does not exists</changelog>
  <changelog author="nopower@suse.com" date="1673265600">- CVE-2021-20251: samba: Bad password count not incremented
  atomically; (bso#14611); (bsc#1206546).</changelog>
  <changelog author="scabrero@suse.de" date="1673352000">- CVE-2022-38023 Additional patches for the PDC role's netlogon
  server; (bso#15240); (bsc#1206504);</changelog>
</package>
<package pkgid="29d5b9336731fd7500a8da9dd92af73b19d30e9d24874e6bfc27ddef1476aa8a" name="samba-client-libs" arch="x86_64">
  <version epoch="0" ver="4.15.13+git.591.ab36624310c" rel="150400.3.19.1"/>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="scabrero@suse.de" date="1671451200">- Update to 4.15.13
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237); (bsc#1205385);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231); (bsc#1205386);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240); (bsc#1206504);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
- Adjust the systemd drop-in file for named service; (bsc#1201689);
  * Paths are additive so do not repeat paths from named.service
  * Prefix the samba DLZ directory with "-" to ignore this path
    if it does not exists</changelog>
  <changelog author="nopower@suse.com" date="1673265600">- CVE-2021-20251: samba: Bad password count not incremented
  atomically; (bso#14611); (bsc#1206546).</changelog>
  <changelog author="scabrero@suse.de" date="1673352000">- CVE-2022-38023 Additional patches for the PDC role's netlogon
  server; (bso#15240); (bsc#1206504);</changelog>
</package>
<package pkgid="7b1e217f9f7c94e6ede4613da8383c19f72ab16b7db1bc56affeeba558b360d7" name="sg3_utils" arch="aarch64">
  <version epoch="0" ver="1.47+13.75d23ac" rel="150400.3.6.1"/>
  <changelog author="hare@suse.de" date="1502452800">- Drop patch merged with git repository
  * drop add-lunsearch-filter-to-searchexisting.patch
- Drop rules included in git repository
  * drop 40-usb-blacklist.rules
- Update to latest svn snapshot:
  * sg_rdac: add sanity checks for -f=lun value
  * sg_vpd improvements
  * sg_ses: fix uninitialized struct
  * sg_luns: resync with SAM and SPC drafts
  * sg_vpd: fix struct misalignment introduced by --force
  * sg_logs: add --vendor and fixup enumeration
- Port patches from SLES:
  * Add systemd service files for LUN masking (bsc#954600)
  * 55-scsi-sg3_id.rules: handle VPD page 0x80 correctly (bsc#1006469)
  * scripts: added udev rules for legacy CCISS (bsc#1006175)
  * rescan-scsi-bus.sh: Add lunsearch filter to findresized()
  (bsc#1027176)
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063)
  * 55-scsi-sg3_id.rules: allow to override sysfs inquiry
  (bsc#1012523)
  * sg_inq: export all NAA values (bsc#1050767)
  * Silence gcc warnings</changelog>
  <changelog author="hare@suse.de" date="1507896000">- Update to svn r721:
  * Merge SUSE-specific patches with upstream svn
  * sg_write_atomic: add new program for WRITE ATOMIC
  * sg_bg_ctl: new background control command
  * sg_ses: Improve output and option handling
  * sg_logs: Add --vendor and decode more pages
  * sg_get_lba_status: add new program
  * Install rescan-scsi-bus.sh and scsi_logging_level per default</changelog>
  <changelog author="hare@suse.de" date="1511956800">- Update to svn r730:
  * Move testing utilities to 'testing' directory
  * sg_opcode: check resid and trim response
  * sg_rep_zones: expand --help option
  * sg_mode: Add Out-of-band management control page
  * sg_ses: filer join output on dpage element presence
  * documentation cleanup
- rescan-scsi-bus.sh: Add '--ignore-rev' option
- Supplement SCSI modaliases (bsc#1065212)</changelog>
  <changelog author="hare@suse.de" date="1513598400">- sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431)
- rescan-scsi-bus.sh: new option for ignore rev change
- rescan-scsi-bus.sh: Remove white space
- Add 'coreutils' to Requires (bsc#1072744)
- Add 'posttrans' to rpm spec (bsc#1071972)</changelog>
  <changelog author="hare@suse.de" date="1513944000">- sg_inq: check VPD page 0x0 before reading serial number
  (bsc#1067839)
- sg_inq: add option '-o/--only' to skip reading VPD pages
  (bsc#1067839)
- Revert 'postun' rpm spec changes after review</changelog>
  <changelog author="hare@suse.de" date="1518004800">- Update to svn r744:
  * sg_write_x: new command for normal/atomic/orwrite etc
    SCSI WRITE variants
  * sg_ses: add NVMe support
  * sg_inq: decode NVMe controller / NSIDs
- rescan_scsi_bus.sh: Fix manpage for --forcerescan
- 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873)
- 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873)</changelog>
  <changelog author="hare@suse.de" date="1518091200">- Merge local patch with git repository
  * Delete sgut-libversioning.diff</changelog>
  <changelog author="hare@suse.de" date="1518177600">- Update to svn r751:
  * NVMe bugfixes
  * sg_seek: new utility
  * sg_stream_ctl: new utility program
- 54-before-scsi-sg3_id.rules: compability rule for systemd
  (bsc#1079873)
- Add dracut.conf to install new rule with dracut</changelog>
  <changelog author="mwilck@suse.com" date="1518436800">- dracut.conf: add whitespace at end of line (bsc#1080562)</changelog>
  <changelog author="hare@suse.de" date="1523016000">- Update to svn r763:
  * More NVMe bugfixes
  * sg_vpd: add device constituents vpd
  * sg_raw: add --raw option
  * sg_turs: add --low option
  * sg_ses: decoding dpage fixes; add --quiet option
- rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008)
- rescan-scsi-bus.sh: Fixes from shellcheck</changelog>
  <changelog author="mwilck@suse.com" date="1553601600">- Spec file:
  * add fc_wwpn_id (bsc#1005063)
  * add lun masking service (bsc#954600)
  * drop BuildRequires on udev
  * replace unversioned "Provides: scsi" with versioned
- Update to version sg3_utils-1.45~803+31.564be3d:
  * New versioning scheme for upstream pre-release:
    1.45 - upstream release target, 803 - upstream svn id,
    +31: SUSE commits on top of svn, 564be3d - git hash
  * rescan-scsi-bus.sh: terminate scanning if last lun got removed
  (bsc#1087008)
  * 58-scsi-sg3_symlink.rules: don't skip multipath members
  (bsc#1085212)
  * Add scsi-enable-target-scan.sh (bsc#954600)
- Update to svn r803:
  * sg_opcodes: expand MLU (18-102r0)
  * sg_format: add --dcrt used twice (FOV=1 DCRT=0)
  * rescan-scsi-bus: widen LUN 0 only scanning
  (bsc#1069384)
- Earlier SUSE fixes included in 1.45:
  * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384)
  [svn: r795]
  * sg_ses: fixup page decoding (bsc#1077787) [svn: r795]
  * sg_ses: allow to decode raw data instead of reading from a device
  (bsc#1050943) [svn: r795]
- Update to sg3_utils-1.44 [20180912] [svn: r791]
  * rescan-scsi-bus.sh: harden code
  - bump version to 20180615
  - add --ignore-rev to ignore revision change
  * introduce SG3_UTILS_DSENSE environment variable
  * sginfo: don't open /dev/snapshot
  * sg_timestamp: add '--no-timestamp' option
  - add --elapsed and --hex options
  * sg_wr_mode: add --rtd option for RTD bi
  * sg_unmap: add --all=ST,RN[,LA] option
  * sgm_dd, sg_dd: add --dry-run and --verbose options
  * sg_inq+sg_vpd: update Extended inquiry data vpd page
  * sg_ses: add 'hw_reset' and 'sw_reset' to enclosure services
    controller electronics element type (18-047r1)
  * sg_decode sense: add --cdb and --err=ES options
  * sg_format: add --dry-run option
  - extend --wait timeout for &gt; 4TB disks
  * sg_sanitize: add --dry-run option
- Earlier SUSE fixes included in 1.44:
  * sg_inq: decode standard INQUIRY for CD-ROMs correctly
  (bsc#1065448, bsc#1070431) [svn: r742]
  * sg_inq: export all NAA values (bsc#1050767) [svn: r715]
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063) (svn@715)
  * sg_vpd: struct opts_t misaligment (bsc#1050943) [svn: r707]</changelog>
  <changelog author="jengelh@inai.de" date="1555588800">- Replace old $RPM_* shell vars.</changelog>
  <changelog author="mwilck@suse.com" date="1556193600">- Update to version 1.45~815+5.6aa67ed:
  * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418)
- Update to svn r815:
  * sg_opcodes: expand MLU (spc5r20)
  * sg_inq: update version descriptors to spc5r21
  * sg_vpd: 3pc VPD page add copy group descriptor
  * sg_xcopy: add --fco (fast copy only) (spc5r20) and --app=1
  * add nanosecond durations with SG3_UTILS_LINUX_NANO
- Earlier SUSE fixes now included upstream:
  * 58-scsi-sg3_symlink.rules: don't skip multipath members
  (bsc#1085212) [r815]
  * rescan-scsi-bus.sh: terminate scanning if last lun got removed
  (bsc#1087008) [r815]
  * Add scsi-enable-target-scan.sh (bsc#954600) [r814]
  * shellcheck cleanups for rescan-scsi-bus.sh [r814]</changelog>
  <changelog author="info@paolostivanin.com" date="1618920000">- Update to version 1.46:
  * sg_rep_pip: new utility: report provisioning initialization
    pattern command
  * sg_turs: estimated time-to-ready [spc6r03]
  - add --delay=MS option
  * sg_requests: substantial cleanup
  * sg_vpd: add Format presets and Concurrent positioning ranges
  - add hot-pluggable field in standard Inquiry [spc6r05]
  - fix vendor struct opts_t alignment
  * sg_inq: add hot-pluggable field in standard Inquiry
  * sg_dd: --verify : separate category for miscompare errors
  - --verify : oflag=coe continue on miscompares, counts them
  - add cdl= operand for command duration limit indexes
  - add oflag=nocreat and conv=nocreat : OFILE must exist
  - add iflag=00, ff, random flags
  - setup conditional auto rule for getrandom()
  - add command timeout after comma in time= operand
  * sg_get_elem_status: add ralwd bit sbc4r20a
  * sg_write_x: add dld bits to write(32) [sbc4r19a]
  * sg_rep_zones: print invalid write pointer LBA as -1 rather
    than 16 "f"s
  * sg_opcodes: improve handling of RWCDLP field
  * sg_ses: use fan speed factor field for calculation [ses4r04]
  - add --all (-a) option, same action as --join
  * sg_compare_and_write: add examples section to its manpage
  * sg_modes: document '-s' option (same as '-6')
  * sg_sanitize + sg_format: when --verbose given once report
    probable success; without --verbose 'no news is good news'
  * sg_zone: add Remove element and modify zones command
  * sg_raw: increase maximum data-in and data-out buffer size
    from 64 KB to 1 MB
  - fix --cmdfile= handling
  - add --nvm option to send commands from the NVM command set
  - add --cmdset option to bypass cdb heuristic
  - add --scan= first_opcode,last_opcode
  * sg_pt_freebsd: allow device names without leading /dev/
    thus fix for regression introduced in rev 731 (ver: 1.43)
  * sg_pt_solaris+sg_pt_osf1: fix problem with clear_scsi_pt_obj()
    which needs to remember is_nvme and dev_fd values
  * sg_lib: add ZBC (2020) feature set entries
  * sg_lib: restore elements and rebuild command added
  * sg_lib,sg_pt: add partial_clear_scsi_pt_obj(),
    get_scsi_pt_cdb_len() and get_scsi_pt_cdb_buf()
  - add do_nvm_pt() for the NVM (sub-)command set
  - tweak transport error handling in Linux
  * sg_lib: Linux NVMe SNTL: add read, write and verify;
    synchronize cache and write same translations
  - add dummy start stop unit and test unit ready commands
  - wire cache mpage's WCE to nvme 'volatile write cache'
  - fix crash in sg_f2hex_arr() when fname not found
  * sg_lib: reprint cdb with illegal request sense key
  - asc/ascq match asc-num.txt @t10 20200708 [spc6r02]
  * gcc-10: suppress warnings
  * autoconf: upgrade version 2.69 to 2.70
  * remove space from end of source lines for git-svn
  * testing/sg_mrq_testing: new, for blocking mrq usage
  * testing/sgs_dd: add evfd flags and eventfd processing
  * testing: remove master-slave terminology for sgv4
  * examples: add nvme_read_ctl.hex and nvme_write_ctl.hex
- Earlier SUSE fixes included in 1.46:
  * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY
    (bsc#840054, bsc#1131482)</changelog>
  <changelog author="mwilck@suse.com" date="1636632000">- Update to version 1.47:
  * sg_rep_zones: add support for REPORT ZONE DOMAINS and
    REPORT REALMS in this utility
  * sg_raw: fix prints of NVMe NVM command names
  * sg_logs: additions to Volume statistics lpage [ssc5r05c]
  - additions to Command duration limits statistics log
    page [spc6r06]
  * sg_vpd: fix do_hex type on some recent pages
  - zoned block dev char vpd: add zone alignment mode and
    zone starting LBA granularity [zbc2r11]
  * sg_read_buffer: fix --length= problem
  * sg_dd, sgm_dd, sgp_dd: don't close negative file descriptors
  * sg_dd: srand48_r() and mrand48_r() are GNU libc specific,
    put conditional in so non-reentrant version used otherwise
  - 'iflag=00,ff' places the 32 bit block address (big endian)
    into each block
  * sgp_dd: major rework, fix issue with error being ignored
  - new: --chkaddr which checks for block address in each block
  - add check for stdatomic.h presence in configure.ac
  * sg_xcopy: tweak CSCD identification descriptor
  * sg_get_elem_status: fix issue with '--maxlen=' option
  - add 2 depopulation revocation health attributes [sbc5r01]
  * transport error handling improved. To fix report of a
    BAD_TARGET transport error but the utility still continued.
  - introduce SG_LIB_TRANSPORT_ERROR [35] exit status
  * several utilities: override '--maxlen=LEN' when LEN
    is &lt; 16 (or 4), take default (or 4) instead
  * scripts: 55-scsi-sg3_id.rules remove outdated rule (bsc#1189297)
  * sg_lib: add sg_scsi_status_is_good(),
    sg_scsi_status_is_bad() and sg_get_zone_type_str()
  * pt_linux: fix verify(BytChk=0) which Linux SNTL translated
    to write, other SNTL cleanups
  * pt_linux_nvme: fix fua setting
  * pt: check_pt_file_handle() add return value of 5 for
- _service updates:
  * re-enable service, hadn't been used for 1.46 release
  * use upstream author's git repository, simplify versioning scheme
  * use obscpio format</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 1.47+2.388b767:
  * rescan-scsi-bus.sh: apply fix for '-r' (boo#1194293)
  * _service: use openSUSE github repo again (with cherry-picks
    from upstream)
  * spec file: suppress commit ID in library version</changelog>
  <changelog author="mwilck@suse.com" date="1644321600">- Update to version 1.47+3.adb7276:
  * rescan-scsi-bus.sh: fix garbled output (bsc#1195621)</changelog>
  <changelog author="mwilck@suse.com" date="1645444800">- Update to version 1.47+4.82fb156:
  * rescan_scsi_bus.sh: restore numeric ordering of hosts (bsc#1196244)</changelog>
  <changelog author="mwilck@suse.com" date="1654084800">- Update to version 1.47+5.d13bc56:
  * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248)</changelog>
  <changelog author="mwilck@suse.com" date="1674820800">- Update to version 1.47+13.75d23ac:
  * rescan-scsi-bus: speed large multipath scans (bsc#1207706)
  * rescan-scsi-bus.sh speed testonline()
  * rescan-scsi-bus.sh: add option --no-lip-scan
  * rescan-scsi-bus: sgdevice26: do not traverse sg class if scsi_device isnot added
  * rescan-scsi-bus.sh: fix handling of '-I &lt;secs&gt;' option</changelog>
</package>
<package pkgid="45dfc99ab0be439ea34adf14e913b89d267e5747b5548a19610d25ad2fb52ead" name="sg3_utils" arch="src">
  <version epoch="0" ver="1.47+13.75d23ac" rel="150400.3.6.1"/>
  <changelog author="hare@suse.de" date="1502452800">- Drop patch merged with git repository
  * drop add-lunsearch-filter-to-searchexisting.patch
- Drop rules included in git repository
  * drop 40-usb-blacklist.rules
- Update to latest svn snapshot:
  * sg_rdac: add sanity checks for -f=lun value
  * sg_vpd improvements
  * sg_ses: fix uninitialized struct
  * sg_luns: resync with SAM and SPC drafts
  * sg_vpd: fix struct misalignment introduced by --force
  * sg_logs: add --vendor and fixup enumeration
- Port patches from SLES:
  * Add systemd service files for LUN masking (bsc#954600)
  * 55-scsi-sg3_id.rules: handle VPD page 0x80 correctly (bsc#1006469)
  * scripts: added udev rules for legacy CCISS (bsc#1006175)
  * rescan-scsi-bus.sh: Add lunsearch filter to findresized()
  (bsc#1027176)
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063)
  * 55-scsi-sg3_id.rules: allow to override sysfs inquiry
  (bsc#1012523)
  * sg_inq: export all NAA values (bsc#1050767)
  * Silence gcc warnings</changelog>
  <changelog author="hare@suse.de" date="1507896000">- Update to svn r721:
  * Merge SUSE-specific patches with upstream svn
  * sg_write_atomic: add new program for WRITE ATOMIC
  * sg_bg_ctl: new background control command
  * sg_ses: Improve output and option handling
  * sg_logs: Add --vendor and decode more pages
  * sg_get_lba_status: add new program
  * Install rescan-scsi-bus.sh and scsi_logging_level per default</changelog>
  <changelog author="hare@suse.de" date="1511956800">- Update to svn r730:
  * Move testing utilities to 'testing' directory
  * sg_opcode: check resid and trim response
  * sg_rep_zones: expand --help option
  * sg_mode: Add Out-of-band management control page
  * sg_ses: filer join output on dpage element presence
  * documentation cleanup
- rescan-scsi-bus.sh: Add '--ignore-rev' option
- Supplement SCSI modaliases (bsc#1065212)</changelog>
  <changelog author="hare@suse.de" date="1513598400">- sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431)
- rescan-scsi-bus.sh: new option for ignore rev change
- rescan-scsi-bus.sh: Remove white space
- Add 'coreutils' to Requires (bsc#1072744)
- Add 'posttrans' to rpm spec (bsc#1071972)</changelog>
  <changelog author="hare@suse.de" date="1513944000">- sg_inq: check VPD page 0x0 before reading serial number
  (bsc#1067839)
- sg_inq: add option '-o/--only' to skip reading VPD pages
  (bsc#1067839)
- Revert 'postun' rpm spec changes after review</changelog>
  <changelog author="hare@suse.de" date="1518004800">- Update to svn r744:
  * sg_write_x: new command for normal/atomic/orwrite etc
    SCSI WRITE variants
  * sg_ses: add NVMe support
  * sg_inq: decode NVMe controller / NSIDs
- rescan_scsi_bus.sh: Fix manpage for --forcerescan
- 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873)
- 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873)</changelog>
  <changelog author="hare@suse.de" date="1518091200">- Merge local patch with git repository
  * Delete sgut-libversioning.diff</changelog>
  <changelog author="hare@suse.de" date="1518177600">- Update to svn r751:
  * NVMe bugfixes
  * sg_seek: new utility
  * sg_stream_ctl: new utility program
- 54-before-scsi-sg3_id.rules: compability rule for systemd
  (bsc#1079873)
- Add dracut.conf to install new rule with dracut</changelog>
  <changelog author="mwilck@suse.com" date="1518436800">- dracut.conf: add whitespace at end of line (bsc#1080562)</changelog>
  <changelog author="hare@suse.de" date="1523016000">- Update to svn r763:
  * More NVMe bugfixes
  * sg_vpd: add device constituents vpd
  * sg_raw: add --raw option
  * sg_turs: add --low option
  * sg_ses: decoding dpage fixes; add --quiet option
- rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008)
- rescan-scsi-bus.sh: Fixes from shellcheck</changelog>
  <changelog author="mwilck@suse.com" date="1553601600">- Spec file:
  * add fc_wwpn_id (bsc#1005063)
  * add lun masking service (bsc#954600)
  * drop BuildRequires on udev
  * replace unversioned "Provides: scsi" with versioned
- Update to version sg3_utils-1.45~803+31.564be3d:
  * New versioning scheme for upstream pre-release:
    1.45 - upstream release target, 803 - upstream svn id,
    +31: SUSE commits on top of svn, 564be3d - git hash
  * rescan-scsi-bus.sh: terminate scanning if last lun got removed
  (bsc#1087008)
  * 58-scsi-sg3_symlink.rules: don't skip multipath members
  (bsc#1085212)
  * Add scsi-enable-target-scan.sh (bsc#954600)
- Update to svn r803:
  * sg_opcodes: expand MLU (18-102r0)
  * sg_format: add --dcrt used twice (FOV=1 DCRT=0)
  * rescan-scsi-bus: widen LUN 0 only scanning
  (bsc#1069384)
- Earlier SUSE fixes included in 1.45:
  * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384)
  [svn: r795]
  * sg_ses: fixup page decoding (bsc#1077787) [svn: r795]
  * sg_ses: allow to decode raw data instead of reading from a device
  (bsc#1050943) [svn: r795]
- Update to sg3_utils-1.44 [20180912] [svn: r791]
  * rescan-scsi-bus.sh: harden code
  - bump version to 20180615
  - add --ignore-rev to ignore revision change
  * introduce SG3_UTILS_DSENSE environment variable
  * sginfo: don't open /dev/snapshot
  * sg_timestamp: add '--no-timestamp' option
  - add --elapsed and --hex options
  * sg_wr_mode: add --rtd option for RTD bi
  * sg_unmap: add --all=ST,RN[,LA] option
  * sgm_dd, sg_dd: add --dry-run and --verbose options
  * sg_inq+sg_vpd: update Extended inquiry data vpd page
  * sg_ses: add 'hw_reset' and 'sw_reset' to enclosure services
    controller electronics element type (18-047r1)
  * sg_decode sense: add --cdb and --err=ES options
  * sg_format: add --dry-run option
  - extend --wait timeout for &gt; 4TB disks
  * sg_sanitize: add --dry-run option
- Earlier SUSE fixes included in 1.44:
  * sg_inq: decode standard INQUIRY for CD-ROMs correctly
  (bsc#1065448, bsc#1070431) [svn: r742]
  * sg_inq: export all NAA values (bsc#1050767) [svn: r715]
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063) (svn@715)
  * sg_vpd: struct opts_t misaligment (bsc#1050943) [svn: r707]</changelog>
  <changelog author="jengelh@inai.de" date="1555588800">- Replace old $RPM_* shell vars.</changelog>
  <changelog author="mwilck@suse.com" date="1556193600">- Update to version 1.45~815+5.6aa67ed:
  * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418)
- Update to svn r815:
  * sg_opcodes: expand MLU (spc5r20)
  * sg_inq: update version descriptors to spc5r21
  * sg_vpd: 3pc VPD page add copy group descriptor
  * sg_xcopy: add --fco (fast copy only) (spc5r20) and --app=1
  * add nanosecond durations with SG3_UTILS_LINUX_NANO
- Earlier SUSE fixes now included upstream:
  * 58-scsi-sg3_symlink.rules: don't skip multipath members
  (bsc#1085212) [r815]
  * rescan-scsi-bus.sh: terminate scanning if last lun got removed
  (bsc#1087008) [r815]
  * Add scsi-enable-target-scan.sh (bsc#954600) [r814]
  * shellcheck cleanups for rescan-scsi-bus.sh [r814]</changelog>
  <changelog author="info@paolostivanin.com" date="1618920000">- Update to version 1.46:
  * sg_rep_pip: new utility: report provisioning initialization
    pattern command
  * sg_turs: estimated time-to-ready [spc6r03]
  - add --delay=MS option
  * sg_requests: substantial cleanup
  * sg_vpd: add Format presets and Concurrent positioning ranges
  - add hot-pluggable field in standard Inquiry [spc6r05]
  - fix vendor struct opts_t alignment
  * sg_inq: add hot-pluggable field in standard Inquiry
  * sg_dd: --verify : separate category for miscompare errors
  - --verify : oflag=coe continue on miscompares, counts them
  - add cdl= operand for command duration limit indexes
  - add oflag=nocreat and conv=nocreat : OFILE must exist
  - add iflag=00, ff, random flags
  - setup conditional auto rule for getrandom()
  - add command timeout after comma in time= operand
  * sg_get_elem_status: add ralwd bit sbc4r20a
  * sg_write_x: add dld bits to write(32) [sbc4r19a]
  * sg_rep_zones: print invalid write pointer LBA as -1 rather
    than 16 "f"s
  * sg_opcodes: improve handling of RWCDLP field
  * sg_ses: use fan speed factor field for calculation [ses4r04]
  - add --all (-a) option, same action as --join
  * sg_compare_and_write: add examples section to its manpage
  * sg_modes: document '-s' option (same as '-6')
  * sg_sanitize + sg_format: when --verbose given once report
    probable success; without --verbose 'no news is good news'
  * sg_zone: add Remove element and modify zones command
  * sg_raw: increase maximum data-in and data-out buffer size
    from 64 KB to 1 MB
  - fix --cmdfile= handling
  - add --nvm option to send commands from the NVM command set
  - add --cmdset option to bypass cdb heuristic
  - add --scan= first_opcode,last_opcode
  * sg_pt_freebsd: allow device names without leading /dev/
    thus fix for regression introduced in rev 731 (ver: 1.43)
  * sg_pt_solaris+sg_pt_osf1: fix problem with clear_scsi_pt_obj()
    which needs to remember is_nvme and dev_fd values
  * sg_lib: add ZBC (2020) feature set entries
  * sg_lib: restore elements and rebuild command added
  * sg_lib,sg_pt: add partial_clear_scsi_pt_obj(),
    get_scsi_pt_cdb_len() and get_scsi_pt_cdb_buf()
  - add do_nvm_pt() for the NVM (sub-)command set
  - tweak transport error handling in Linux
  * sg_lib: Linux NVMe SNTL: add read, write and verify;
    synchronize cache and write same translations
  - add dummy start stop unit and test unit ready commands
  - wire cache mpage's WCE to nvme 'volatile write cache'
  - fix crash in sg_f2hex_arr() when fname not found
  * sg_lib: reprint cdb with illegal request sense key
  - asc/ascq match asc-num.txt @t10 20200708 [spc6r02]
  * gcc-10: suppress warnings
  * autoconf: upgrade version 2.69 to 2.70
  * remove space from end of source lines for git-svn
  * testing/sg_mrq_testing: new, for blocking mrq usage
  * testing/sgs_dd: add evfd flags and eventfd processing
  * testing: remove master-slave terminology for sgv4
  * examples: add nvme_read_ctl.hex and nvme_write_ctl.hex
- Earlier SUSE fixes included in 1.46:
  * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY
    (bsc#840054, bsc#1131482)</changelog>
  <changelog author="mwilck@suse.com" date="1636632000">- Update to version 1.47:
  * sg_rep_zones: add support for REPORT ZONE DOMAINS and
    REPORT REALMS in this utility
  * sg_raw: fix prints of NVMe NVM command names
  * sg_logs: additions to Volume statistics lpage [ssc5r05c]
  - additions to Command duration limits statistics log
    page [spc6r06]
  * sg_vpd: fix do_hex type on some recent pages
  - zoned block dev char vpd: add zone alignment mode and
    zone starting LBA granularity [zbc2r11]
  * sg_read_buffer: fix --length= problem
  * sg_dd, sgm_dd, sgp_dd: don't close negative file descriptors
  * sg_dd: srand48_r() and mrand48_r() are GNU libc specific,
    put conditional in so non-reentrant version used otherwise
  - 'iflag=00,ff' places the 32 bit block address (big endian)
    into each block
  * sgp_dd: major rework, fix issue with error being ignored
  - new: --chkaddr which checks for block address in each block
  - add check for stdatomic.h presence in configure.ac
  * sg_xcopy: tweak CSCD identification descriptor
  * sg_get_elem_status: fix issue with '--maxlen=' option
  - add 2 depopulation revocation health attributes [sbc5r01]
  * transport error handling improved. To fix report of a
    BAD_TARGET transport error but the utility still continued.
  - introduce SG_LIB_TRANSPORT_ERROR [35] exit status
  * several utilities: override '--maxlen=LEN' when LEN
    is &lt; 16 (or 4), take default (or 4) instead
  * scripts: 55-scsi-sg3_id.rules remove outdated rule (bsc#1189297)
  * sg_lib: add sg_scsi_status_is_good(),
    sg_scsi_status_is_bad() and sg_get_zone_type_str()
  * pt_linux: fix verify(BytChk=0) which Linux SNTL translated
    to write, other SNTL cleanups
  * pt_linux_nvme: fix fua setting
  * pt: check_pt_file_handle() add return value of 5 for
- _service updates:
  * re-enable service, hadn't been used for 1.46 release
  * use upstream author's git repository, simplify versioning scheme
  * use obscpio format</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 1.47+2.388b767:
  * rescan-scsi-bus.sh: apply fix for '-r' (boo#1194293)
  * _service: use openSUSE github repo again (with cherry-picks
    from upstream)
  * spec file: suppress commit ID in library version</changelog>
  <changelog author="mwilck@suse.com" date="1644321600">- Update to version 1.47+3.adb7276:
  * rescan-scsi-bus.sh: fix garbled output (bsc#1195621)</changelog>
  <changelog author="mwilck@suse.com" date="1645444800">- Update to version 1.47+4.82fb156:
  * rescan_scsi_bus.sh: restore numeric ordering of hosts (bsc#1196244)</changelog>
  <changelog author="mwilck@suse.com" date="1654084800">- Update to version 1.47+5.d13bc56:
  * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248)</changelog>
  <changelog author="mwilck@suse.com" date="1674820800">- Update to version 1.47+13.75d23ac:
  * rescan-scsi-bus: speed large multipath scans (bsc#1207706)
  * rescan-scsi-bus.sh speed testonline()
  * rescan-scsi-bus.sh: add option --no-lip-scan
  * rescan-scsi-bus: sgdevice26: do not traverse sg class if scsi_device isnot added
  * rescan-scsi-bus.sh: fix handling of '-I &lt;secs&gt;' option</changelog>
</package>
<package pkgid="d2ecf8becd3e04a294b4649089010c332c64647adcbe6bbbbe7d0e4c3f6eea31" name="sg3_utils" arch="x86_64">
  <version epoch="0" ver="1.47+13.75d23ac" rel="150400.3.6.1"/>
  <changelog author="hare@suse.de" date="1502452800">- Drop patch merged with git repository
  * drop add-lunsearch-filter-to-searchexisting.patch
- Drop rules included in git repository
  * drop 40-usb-blacklist.rules
- Update to latest svn snapshot:
  * sg_rdac: add sanity checks for -f=lun value
  * sg_vpd improvements
  * sg_ses: fix uninitialized struct
  * sg_luns: resync with SAM and SPC drafts
  * sg_vpd: fix struct misalignment introduced by --force
  * sg_logs: add --vendor and fixup enumeration
- Port patches from SLES:
  * Add systemd service files for LUN masking (bsc#954600)
  * 55-scsi-sg3_id.rules: handle VPD page 0x80 correctly (bsc#1006469)
  * scripts: added udev rules for legacy CCISS (bsc#1006175)
  * rescan-scsi-bus.sh: Add lunsearch filter to findresized()
  (bsc#1027176)
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063)
  * 55-scsi-sg3_id.rules: allow to override sysfs inquiry
  (bsc#1012523)
  * sg_inq: export all NAA values (bsc#1050767)
  * Silence gcc warnings</changelog>
  <changelog author="hare@suse.de" date="1507896000">- Update to svn r721:
  * Merge SUSE-specific patches with upstream svn
  * sg_write_atomic: add new program for WRITE ATOMIC
  * sg_bg_ctl: new background control command
  * sg_ses: Improve output and option handling
  * sg_logs: Add --vendor and decode more pages
  * sg_get_lba_status: add new program
  * Install rescan-scsi-bus.sh and scsi_logging_level per default</changelog>
  <changelog author="hare@suse.de" date="1511956800">- Update to svn r730:
  * Move testing utilities to 'testing' directory
  * sg_opcode: check resid and trim response
  * sg_rep_zones: expand --help option
  * sg_mode: Add Out-of-band management control page
  * sg_ses: filer join output on dpage element presence
  * documentation cleanup
- rescan-scsi-bus.sh: Add '--ignore-rev' option
- Supplement SCSI modaliases (bsc#1065212)</changelog>
  <changelog author="hare@suse.de" date="1513598400">- sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431)
- rescan-scsi-bus.sh: new option for ignore rev change
- rescan-scsi-bus.sh: Remove white space
- Add 'coreutils' to Requires (bsc#1072744)
- Add 'posttrans' to rpm spec (bsc#1071972)</changelog>
  <changelog author="hare@suse.de" date="1513944000">- sg_inq: check VPD page 0x0 before reading serial number
  (bsc#1067839)
- sg_inq: add option '-o/--only' to skip reading VPD pages
  (bsc#1067839)
- Revert 'postun' rpm spec changes after review</changelog>
  <changelog author="hare@suse.de" date="1518004800">- Update to svn r744:
  * sg_write_x: new command for normal/atomic/orwrite etc
    SCSI WRITE variants
  * sg_ses: add NVMe support
  * sg_inq: decode NVMe controller / NSIDs
- rescan_scsi_bus.sh: Fix manpage for --forcerescan
- 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873)
- 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873)</changelog>
  <changelog author="hare@suse.de" date="1518091200">- Merge local patch with git repository
  * Delete sgut-libversioning.diff</changelog>
  <changelog author="hare@suse.de" date="1518177600">- Update to svn r751:
  * NVMe bugfixes
  * sg_seek: new utility
  * sg_stream_ctl: new utility program
- 54-before-scsi-sg3_id.rules: compability rule for systemd
  (bsc#1079873)
- Add dracut.conf to install new rule with dracut</changelog>
  <changelog author="mwilck@suse.com" date="1518436800">- dracut.conf: add whitespace at end of line (bsc#1080562)</changelog>
  <changelog author="hare@suse.de" date="1523016000">- Update to svn r763:
  * More NVMe bugfixes
  * sg_vpd: add device constituents vpd
  * sg_raw: add --raw option
  * sg_turs: add --low option
  * sg_ses: decoding dpage fixes; add --quiet option
- rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008)
- rescan-scsi-bus.sh: Fixes from shellcheck</changelog>
  <changelog author="mwilck@suse.com" date="1553601600">- Spec file:
  * add fc_wwpn_id (bsc#1005063)
  * add lun masking service (bsc#954600)
  * drop BuildRequires on udev
  * replace unversioned "Provides: scsi" with versioned
- Update to version sg3_utils-1.45~803+31.564be3d:
  * New versioning scheme for upstream pre-release:
    1.45 - upstream release target, 803 - upstream svn id,
    +31: SUSE commits on top of svn, 564be3d - git hash
  * rescan-scsi-bus.sh: terminate scanning if last lun got removed
  (bsc#1087008)
  * 58-scsi-sg3_symlink.rules: don't skip multipath members
  (bsc#1085212)
  * Add scsi-enable-target-scan.sh (bsc#954600)
- Update to svn r803:
  * sg_opcodes: expand MLU (18-102r0)
  * sg_format: add --dcrt used twice (FOV=1 DCRT=0)
  * rescan-scsi-bus: widen LUN 0 only scanning
  (bsc#1069384)
- Earlier SUSE fixes included in 1.45:
  * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384)
  [svn: r795]
  * sg_ses: fixup page decoding (bsc#1077787) [svn: r795]
  * sg_ses: allow to decode raw data instead of reading from a device
  (bsc#1050943) [svn: r795]
- Update to sg3_utils-1.44 [20180912] [svn: r791]
  * rescan-scsi-bus.sh: harden code
  - bump version to 20180615
  - add --ignore-rev to ignore revision change
  * introduce SG3_UTILS_DSENSE environment variable
  * sginfo: don't open /dev/snapshot
  * sg_timestamp: add '--no-timestamp' option
  - add --elapsed and --hex options
  * sg_wr_mode: add --rtd option for RTD bi
  * sg_unmap: add --all=ST,RN[,LA] option
  * sgm_dd, sg_dd: add --dry-run and --verbose options
  * sg_inq+sg_vpd: update Extended inquiry data vpd page
  * sg_ses: add 'hw_reset' and 'sw_reset' to enclosure services
    controller electronics element type (18-047r1)
  * sg_decode sense: add --cdb and --err=ES options
  * sg_format: add --dry-run option
  - extend --wait timeout for &gt; 4TB disks
  * sg_sanitize: add --dry-run option
- Earlier SUSE fixes included in 1.44:
  * sg_inq: decode standard INQUIRY for CD-ROMs correctly
  (bsc#1065448, bsc#1070431) [svn: r742]
  * sg_inq: export all NAA values (bsc#1050767) [svn: r715]
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063) (svn@715)
  * sg_vpd: struct opts_t misaligment (bsc#1050943) [svn: r707]</changelog>
  <changelog author="jengelh@inai.de" date="1555588800">- Replace old $RPM_* shell vars.</changelog>
  <changelog author="mwilck@suse.com" date="1556193600">- Update to version 1.45~815+5.6aa67ed:
  * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418)
- Update to svn r815:
  * sg_opcodes: expand MLU (spc5r20)
  * sg_inq: update version descriptors to spc5r21
  * sg_vpd: 3pc VPD page add copy group descriptor
  * sg_xcopy: add --fco (fast copy only) (spc5r20) and --app=1
  * add nanosecond durations with SG3_UTILS_LINUX_NANO
- Earlier SUSE fixes now included upstream:
  * 58-scsi-sg3_symlink.rules: don't skip multipath members
  (bsc#1085212) [r815]
  * rescan-scsi-bus.sh: terminate scanning if last lun got removed
  (bsc#1087008) [r815]
  * Add scsi-enable-target-scan.sh (bsc#954600) [r814]
  * shellcheck cleanups for rescan-scsi-bus.sh [r814]</changelog>
  <changelog author="info@paolostivanin.com" date="1618920000">- Update to version 1.46:
  * sg_rep_pip: new utility: report provisioning initialization
    pattern command
  * sg_turs: estimated time-to-ready [spc6r03]
  - add --delay=MS option
  * sg_requests: substantial cleanup
  * sg_vpd: add Format presets and Concurrent positioning ranges
  - add hot-pluggable field in standard Inquiry [spc6r05]
  - fix vendor struct opts_t alignment
  * sg_inq: add hot-pluggable field in standard Inquiry
  * sg_dd: --verify : separate category for miscompare errors
  - --verify : oflag=coe continue on miscompares, counts them
  - add cdl= operand for command duration limit indexes
  - add oflag=nocreat and conv=nocreat : OFILE must exist
  - add iflag=00, ff, random flags
  - setup conditional auto rule for getrandom()
  - add command timeout after comma in time= operand
  * sg_get_elem_status: add ralwd bit sbc4r20a
  * sg_write_x: add dld bits to write(32) [sbc4r19a]
  * sg_rep_zones: print invalid write pointer LBA as -1 rather
    than 16 "f"s
  * sg_opcodes: improve handling of RWCDLP field
  * sg_ses: use fan speed factor field for calculation [ses4r04]
  - add --all (-a) option, same action as --join
  * sg_compare_and_write: add examples section to its manpage
  * sg_modes: document '-s' option (same as '-6')
  * sg_sanitize + sg_format: when --verbose given once report
    probable success; without --verbose 'no news is good news'
  * sg_zone: add Remove element and modify zones command
  * sg_raw: increase maximum data-in and data-out buffer size
    from 64 KB to 1 MB
  - fix --cmdfile= handling
  - add --nvm option to send commands from the NVM command set
  - add --cmdset option to bypass cdb heuristic
  - add --scan= first_opcode,last_opcode
  * sg_pt_freebsd: allow device names without leading /dev/
    thus fix for regression introduced in rev 731 (ver: 1.43)
  * sg_pt_solaris+sg_pt_osf1: fix problem with clear_scsi_pt_obj()
    which needs to remember is_nvme and dev_fd values
  * sg_lib: add ZBC (2020) feature set entries
  * sg_lib: restore elements and rebuild command added
  * sg_lib,sg_pt: add partial_clear_scsi_pt_obj(),
    get_scsi_pt_cdb_len() and get_scsi_pt_cdb_buf()
  - add do_nvm_pt() for the NVM (sub-)command set
  - tweak transport error handling in Linux
  * sg_lib: Linux NVMe SNTL: add read, write and verify;
    synchronize cache and write same translations
  - add dummy start stop unit and test unit ready commands
  - wire cache mpage's WCE to nvme 'volatile write cache'
  - fix crash in sg_f2hex_arr() when fname not found
  * sg_lib: reprint cdb with illegal request sense key
  - asc/ascq match asc-num.txt @t10 20200708 [spc6r02]
  * gcc-10: suppress warnings
  * autoconf: upgrade version 2.69 to 2.70
  * remove space from end of source lines for git-svn
  * testing/sg_mrq_testing: new, for blocking mrq usage
  * testing/sgs_dd: add evfd flags and eventfd processing
  * testing: remove master-slave terminology for sgv4
  * examples: add nvme_read_ctl.hex and nvme_write_ctl.hex
- Earlier SUSE fixes included in 1.46:
  * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY
    (bsc#840054, bsc#1131482)</changelog>
  <changelog author="mwilck@suse.com" date="1636632000">- Update to version 1.47:
  * sg_rep_zones: add support for REPORT ZONE DOMAINS and
    REPORT REALMS in this utility
  * sg_raw: fix prints of NVMe NVM command names
  * sg_logs: additions to Volume statistics lpage [ssc5r05c]
  - additions to Command duration limits statistics log
    page [spc6r06]
  * sg_vpd: fix do_hex type on some recent pages
  - zoned block dev char vpd: add zone alignment mode and
    zone starting LBA granularity [zbc2r11]
  * sg_read_buffer: fix --length= problem
  * sg_dd, sgm_dd, sgp_dd: don't close negative file descriptors
  * sg_dd: srand48_r() and mrand48_r() are GNU libc specific,
    put conditional in so non-reentrant version used otherwise
  - 'iflag=00,ff' places the 32 bit block address (big endian)
    into each block
  * sgp_dd: major rework, fix issue with error being ignored
  - new: --chkaddr which checks for block address in each block
  - add check for stdatomic.h presence in configure.ac
  * sg_xcopy: tweak CSCD identification descriptor
  * sg_get_elem_status: fix issue with '--maxlen=' option
  - add 2 depopulation revocation health attributes [sbc5r01]
  * transport error handling improved. To fix report of a
    BAD_TARGET transport error but the utility still continued.
  - introduce SG_LIB_TRANSPORT_ERROR [35] exit status
  * several utilities: override '--maxlen=LEN' when LEN
    is &lt; 16 (or 4), take default (or 4) instead
  * scripts: 55-scsi-sg3_id.rules remove outdated rule (bsc#1189297)
  * sg_lib: add sg_scsi_status_is_good(),
    sg_scsi_status_is_bad() and sg_get_zone_type_str()
  * pt_linux: fix verify(BytChk=0) which Linux SNTL translated
    to write, other SNTL cleanups
  * pt_linux_nvme: fix fua setting
  * pt: check_pt_file_handle() add return value of 5 for
- _service updates:
  * re-enable service, hadn't been used for 1.46 release
  * use upstream author's git repository, simplify versioning scheme
  * use obscpio format</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 1.47+2.388b767:
  * rescan-scsi-bus.sh: apply fix for '-r' (boo#1194293)
  * _service: use openSUSE github repo again (with cherry-picks
    from upstream)
  * spec file: suppress commit ID in library version</changelog>
  <changelog author="mwilck@suse.com" date="1644321600">- Update to version 1.47+3.adb7276:
  * rescan-scsi-bus.sh: fix garbled output (bsc#1195621)</changelog>
  <changelog author="mwilck@suse.com" date="1645444800">- Update to version 1.47+4.82fb156:
  * rescan_scsi_bus.sh: restore numeric ordering of hosts (bsc#1196244)</changelog>
  <changelog author="mwilck@suse.com" date="1654084800">- Update to version 1.47+5.d13bc56:
  * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248)</changelog>
  <changelog author="mwilck@suse.com" date="1674820800">- Update to version 1.47+13.75d23ac:
  * rescan-scsi-bus: speed large multipath scans (bsc#1207706)
  * rescan-scsi-bus.sh speed testonline()
  * rescan-scsi-bus.sh: add option --no-lip-scan
  * rescan-scsi-bus: sgdevice26: do not traverse sg class if scsi_device isnot added
  * rescan-scsi-bus.sh: fix handling of '-I &lt;secs&gt;' option</changelog>
</package>
<package pkgid="2e50710de87a1555119ea5b38f9c06d6e19aceb0af295dd5f62c1efc528c62c5" name="shadow" arch="aarch64">
  <version epoch="0" ver="4.8.1" rel="150400.10.3.1"/>
  <changelog author="sbrabec@suse.com" date="1564142400">- Fix incorrect variable name in usermod
  (shadow-usermod-variable.patch).
- shadow-login_defs-comments.patch:
  * Drop SHA_CRYPT_*_ROUNDS that are in the upstream login.defs.
  * Add missing LASTLOG_UID_MAX.
  * Refresh shadow-login_defs-suse.patch.
- Port shadow-login_defs-check.sh to match the current spec file
  and login.defs.</changelog>
  <changelog author="kukuk@suse.de" date="1566216000">- encryption_method_nis.patch: drop, DES should really not be used
  anymore anywhere, even with NIS
- shadow-login_defs-suse.patch: remove encryption NIS entry</changelog>
  <changelog author="mvetter@suse.com" date="1567425600">- bsc#1144060: Add pam_keyinit.so to /etc/pam.d configuration files
  to support kernel keyring feature
- Update pamd.tar.bz2 with pam configuration files accordingly</changelog>
  <changelog author="kukuk@suse.de" date="1570449600">- libeconf.patch: Add support for libeconf and /usr/etc for
  login.defs.
- Move first configuration files and pam config files to /usr/etc</changelog>
  <changelog author="mvetter@suse.com" date="1576584000">- Update to 4.8:
  * Initial optional bcrypt support.
  * Make build/install of 'su' optional.
  * Fix for vipw not resuming correctly when suspended
  * Sync password field descriptions in manpages
  * Check for valid shell argument in useradd
  * Allow translation of new strings through POTFILES.in
  * Migrate to itstool for translations
  * Migrate to new SELinux api
  * Support --enable-vendordir
  * pwck: Only check homedir if set and not a system user
  * Support nonstandard usernames
  * sget{pw,gr}ent: check for data at EOL
  * Add YYY-MM-DD support in chage
  * Fix failing chmod calls for suidubins
  * Fix --sbindir and --bindir for binary installations
  * Fix LASTLOG_UID_MAX in login.defs
  * Fix configure error with dash
- Remove because upstreamed:
  * libeconf.patch
  * shadow-usermod-variable.patch
- Rebase:
  * shadow-login_defs-unused-by-pam.patch
  * chkname-regex.patch
  * shadow-util-linux.patch
  * shadow-login_defs-comments.patch
- Add shadow-4.8-selinux-include.patch
  See https://github.com/shadow-maint/shadow/pull/200</changelog>
  <changelog author="mvetter@suse.com" date="1579176000">- bsc#1160729: Make valid shell check only a warning
  * Add shadow-4.8-shell-check.patch</changelog>
  <changelog author="mvetter@suse.com" date="1579521600">- Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers,
  useradd, userdel, usermod explicitly.</changelog>
  <changelog author="mvetter@suse.com" date="1579867200">- Update to 4.8.1:
  * selinux: include stdio
  * man: don't suggest making groupmems user-writeable
  * Makefile: bail out on error in for loops
  * Adding logging of SSH_ORIGINAL_COMMAND to nologin
  * add new HOME_MODE login.defs option
  * Add tty logging to useradd
  * Useradd: make non-executable shell check only a warning
  * Update Dutch translation
  * user_busy: Do not mistake a regular user process for a namespaced one
  * Revert "Honor --sbindir and --bindir for binary installation"
- Remove shadow-4.8-shell-check.patch: included
- Remove shadow-4.8-selinux-include.patch: upstreamed</changelog>
  <changelog author="fvogt@suse.com" date="1590148800">- Use pure #!/bin/sh in:
  * useradd.local
  * userdel-post.local
  * userdel-pre.local</changelog>
  <changelog author="sbrabec@suse.com" date="1599566400">- login.defs: Add support for new util-linux-2.36 login variable
  MOTD_FIRSTONLY (shadow-util-linux.patch).
- shadow-login_defs-comments.patch: Remove duplicated
  LASTLOG_UID_MAX.
- shadow-login_defs-check.sh: Update for new build system.
- shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is
  not used in SUSE Linux.
- Refresh shadow-login_defs-suse.patch and
  shadow-login_defs-comments.patch.</changelog>
  <changelog author="sbrabec@suse.com" date="1602158400">- shadow-login_defs-check.sh: Fix the regexp to get a real variable
  list (boo#1164274).</changelog>
  <changelog author="werner@suse.de" date="1602244800">- Add support for /usr/etc/skel to useradd.local script (boo#1173321)</changelog>
  <changelog author="werner@suse.de" date="1604318400">- Change again useradd.local script to let it work even for system
  accounts and work together with SELinux (bsc#1178296)
- Change patch useradd-script.patch to support the four arguments
  used by the useradd.local script (bsc#1178296)</changelog>
  <changelog author="werner@suse.de" date="1605096000">- Add patch useradd-userkeleton.patch to extend original C code
  of useradd to handle /usr/etc/skel (boo#1173321)
- Remove /usr/etc/skel support in useradd.local script</changelog>
  <changelog author="fvogt@suse.com" date="1605096001">- Amend patches/useradd-userkeleton.patch to also write into
  existing directories and prefer files from /etc</changelog>
  <changelog author="kukuk@suse.com" date="1611230400">- Split login.defs configuration file into own sub-package, which
  allows to install util-linux or pam on small embedded/edge
  systems or container without the need to pull in the full shadow
  suite.</changelog>
  <changelog author="sbrabec@suse.com" date="1611835200">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- shadow-util-linux.patch:
  * Add support for LOGIN_KEEP_USERNAME from util-linux &gt;= 2.37.
- Refresh shadow-login_defs-suse.patch.</changelog>
  <changelog author="sbrabec@suse.com" date="1641988800">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- Added patch:
  * shadow-4.8.1-AUDIT_NO_ID.patch
    + fix bsc#1205502: useradd audit event user id field cannot
    be interpreted</changelog>
</package>
<package pkgid="70f3a0f1c1389de1fa2a15fb93a06c052a35c1efb0bbdf797609577d3e56e2ca" name="shadow" arch="src">
  <version epoch="0" ver="4.8.1" rel="150400.10.3.1"/>
  <changelog author="sbrabec@suse.com" date="1564142400">- Fix incorrect variable name in usermod
  (shadow-usermod-variable.patch).
- shadow-login_defs-comments.patch:
  * Drop SHA_CRYPT_*_ROUNDS that are in the upstream login.defs.
  * Add missing LASTLOG_UID_MAX.
  * Refresh shadow-login_defs-suse.patch.
- Port shadow-login_defs-check.sh to match the current spec file
  and login.defs.</changelog>
  <changelog author="kukuk@suse.de" date="1566216000">- encryption_method_nis.patch: drop, DES should really not be used
  anymore anywhere, even with NIS
- shadow-login_defs-suse.patch: remove encryption NIS entry</changelog>
  <changelog author="mvetter@suse.com" date="1567425600">- bsc#1144060: Add pam_keyinit.so to /etc/pam.d configuration files
  to support kernel keyring feature
- Update pamd.tar.bz2 with pam configuration files accordingly</changelog>
  <changelog author="kukuk@suse.de" date="1570449600">- libeconf.patch: Add support for libeconf and /usr/etc for
  login.defs.
- Move first configuration files and pam config files to /usr/etc</changelog>
  <changelog author="mvetter@suse.com" date="1576584000">- Update to 4.8:
  * Initial optional bcrypt support.
  * Make build/install of 'su' optional.
  * Fix for vipw not resuming correctly when suspended
  * Sync password field descriptions in manpages
  * Check for valid shell argument in useradd
  * Allow translation of new strings through POTFILES.in
  * Migrate to itstool for translations
  * Migrate to new SELinux api
  * Support --enable-vendordir
  * pwck: Only check homedir if set and not a system user
  * Support nonstandard usernames
  * sget{pw,gr}ent: check for data at EOL
  * Add YYY-MM-DD support in chage
  * Fix failing chmod calls for suidubins
  * Fix --sbindir and --bindir for binary installations
  * Fix LASTLOG_UID_MAX in login.defs
  * Fix configure error with dash
- Remove because upstreamed:
  * libeconf.patch
  * shadow-usermod-variable.patch
- Rebase:
  * shadow-login_defs-unused-by-pam.patch
  * chkname-regex.patch
  * shadow-util-linux.patch
  * shadow-login_defs-comments.patch
- Add shadow-4.8-selinux-include.patch
  See https://github.com/shadow-maint/shadow/pull/200</changelog>
  <changelog author="mvetter@suse.com" date="1579176000">- bsc#1160729: Make valid shell check only a warning
  * Add shadow-4.8-shell-check.patch</changelog>
  <changelog author="mvetter@suse.com" date="1579521600">- Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers,
  useradd, userdel, usermod explicitly.</changelog>
  <changelog author="mvetter@suse.com" date="1579867200">- Update to 4.8.1:
  * selinux: include stdio
  * man: don't suggest making groupmems user-writeable
  * Makefile: bail out on error in for loops
  * Adding logging of SSH_ORIGINAL_COMMAND to nologin
  * add new HOME_MODE login.defs option
  * Add tty logging to useradd
  * Useradd: make non-executable shell check only a warning
  * Update Dutch translation
  * user_busy: Do not mistake a regular user process for a namespaced one
  * Revert "Honor --sbindir and --bindir for binary installation"
- Remove shadow-4.8-shell-check.patch: included
- Remove shadow-4.8-selinux-include.patch: upstreamed</changelog>
  <changelog author="fvogt@suse.com" date="1590148800">- Use pure #!/bin/sh in:
  * useradd.local
  * userdel-post.local
  * userdel-pre.local</changelog>
  <changelog author="sbrabec@suse.com" date="1599566400">- login.defs: Add support for new util-linux-2.36 login variable
  MOTD_FIRSTONLY (shadow-util-linux.patch).
- shadow-login_defs-comments.patch: Remove duplicated
  LASTLOG_UID_MAX.
- shadow-login_defs-check.sh: Update for new build system.
- shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is
  not used in SUSE Linux.
- Refresh shadow-login_defs-suse.patch and
  shadow-login_defs-comments.patch.</changelog>
  <changelog author="sbrabec@suse.com" date="1602158400">- shadow-login_defs-check.sh: Fix the regexp to get a real variable
  list (boo#1164274).</changelog>
  <changelog author="werner@suse.de" date="1602244800">- Add support for /usr/etc/skel to useradd.local script (boo#1173321)</changelog>
  <changelog author="werner@suse.de" date="1604318400">- Change again useradd.local script to let it work even for system
  accounts and work together with SELinux (bsc#1178296)
- Change patch useradd-script.patch to support the four arguments
  used by the useradd.local script (bsc#1178296)</changelog>
  <changelog author="werner@suse.de" date="1605096000">- Add patch useradd-userkeleton.patch to extend original C code
  of useradd to handle /usr/etc/skel (boo#1173321)
- Remove /usr/etc/skel support in useradd.local script</changelog>
  <changelog author="fvogt@suse.com" date="1605096001">- Amend patches/useradd-userkeleton.patch to also write into
  existing directories and prefer files from /etc</changelog>
  <changelog author="kukuk@suse.com" date="1611230400">- Split login.defs configuration file into own sub-package, which
  allows to install util-linux or pam on small embedded/edge
  systems or container without the need to pull in the full shadow
  suite.</changelog>
  <changelog author="sbrabec@suse.com" date="1611835200">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- shadow-util-linux.patch:
  * Add support for LOGIN_KEEP_USERNAME from util-linux &gt;= 2.37.
- Refresh shadow-login_defs-suse.patch.</changelog>
  <changelog author="sbrabec@suse.com" date="1641988800">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- Added patch:
  * shadow-4.8.1-AUDIT_NO_ID.patch
    + fix bsc#1205502: useradd audit event user id field cannot
    be interpreted</changelog>
</package>
<package pkgid="2d35af97037c6d9225b05ce8157e122184e9356e89257f8fd6c0b49dc0fbc178" name="shadow" arch="x86_64">
  <version epoch="0" ver="4.8.1" rel="150400.10.3.1"/>
  <changelog author="sbrabec@suse.com" date="1564142400">- Fix incorrect variable name in usermod
  (shadow-usermod-variable.patch).
- shadow-login_defs-comments.patch:
  * Drop SHA_CRYPT_*_ROUNDS that are in the upstream login.defs.
  * Add missing LASTLOG_UID_MAX.
  * Refresh shadow-login_defs-suse.patch.
- Port shadow-login_defs-check.sh to match the current spec file
  and login.defs.</changelog>
  <changelog author="kukuk@suse.de" date="1566216000">- encryption_method_nis.patch: drop, DES should really not be used
  anymore anywhere, even with NIS
- shadow-login_defs-suse.patch: remove encryption NIS entry</changelog>
  <changelog author="mvetter@suse.com" date="1567425600">- bsc#1144060: Add pam_keyinit.so to /etc/pam.d configuration files
  to support kernel keyring feature
- Update pamd.tar.bz2 with pam configuration files accordingly</changelog>
  <changelog author="kukuk@suse.de" date="1570449600">- libeconf.patch: Add support for libeconf and /usr/etc for
  login.defs.
- Move first configuration files and pam config files to /usr/etc</changelog>
  <changelog author="mvetter@suse.com" date="1576584000">- Update to 4.8:
  * Initial optional bcrypt support.
  * Make build/install of 'su' optional.
  * Fix for vipw not resuming correctly when suspended
  * Sync password field descriptions in manpages
  * Check for valid shell argument in useradd
  * Allow translation of new strings through POTFILES.in
  * Migrate to itstool for translations
  * Migrate to new SELinux api
  * Support --enable-vendordir
  * pwck: Only check homedir if set and not a system user
  * Support nonstandard usernames
  * sget{pw,gr}ent: check for data at EOL
  * Add YYY-MM-DD support in chage
  * Fix failing chmod calls for suidubins
  * Fix --sbindir and --bindir for binary installations
  * Fix LASTLOG_UID_MAX in login.defs
  * Fix configure error with dash
- Remove because upstreamed:
  * libeconf.patch
  * shadow-usermod-variable.patch
- Rebase:
  * shadow-login_defs-unused-by-pam.patch
  * chkname-regex.patch
  * shadow-util-linux.patch
  * shadow-login_defs-comments.patch
- Add shadow-4.8-selinux-include.patch
  See https://github.com/shadow-maint/shadow/pull/200</changelog>
  <changelog author="mvetter@suse.com" date="1579176000">- bsc#1160729: Make valid shell check only a warning
  * Add shadow-4.8-shell-check.patch</changelog>
  <changelog author="mvetter@suse.com" date="1579521600">- Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers,
  useradd, userdel, usermod explicitly.</changelog>
  <changelog author="mvetter@suse.com" date="1579867200">- Update to 4.8.1:
  * selinux: include stdio
  * man: don't suggest making groupmems user-writeable
  * Makefile: bail out on error in for loops
  * Adding logging of SSH_ORIGINAL_COMMAND to nologin
  * add new HOME_MODE login.defs option
  * Add tty logging to useradd
  * Useradd: make non-executable shell check only a warning
  * Update Dutch translation
  * user_busy: Do not mistake a regular user process for a namespaced one
  * Revert "Honor --sbindir and --bindir for binary installation"
- Remove shadow-4.8-shell-check.patch: included
- Remove shadow-4.8-selinux-include.patch: upstreamed</changelog>
  <changelog author="fvogt@suse.com" date="1590148800">- Use pure #!/bin/sh in:
  * useradd.local
  * userdel-post.local
  * userdel-pre.local</changelog>
  <changelog author="sbrabec@suse.com" date="1599566400">- login.defs: Add support for new util-linux-2.36 login variable
  MOTD_FIRSTONLY (shadow-util-linux.patch).
- shadow-login_defs-comments.patch: Remove duplicated
  LASTLOG_UID_MAX.
- shadow-login_defs-check.sh: Update for new build system.
- shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is
  not used in SUSE Linux.
- Refresh shadow-login_defs-suse.patch and
  shadow-login_defs-comments.patch.</changelog>
  <changelog author="sbrabec@suse.com" date="1602158400">- shadow-login_defs-check.sh: Fix the regexp to get a real variable
  list (boo#1164274).</changelog>
  <changelog author="werner@suse.de" date="1602244800">- Add support for /usr/etc/skel to useradd.local script (boo#1173321)</changelog>
  <changelog author="werner@suse.de" date="1604318400">- Change again useradd.local script to let it work even for system
  accounts and work together with SELinux (bsc#1178296)
- Change patch useradd-script.patch to support the four arguments
  used by the useradd.local script (bsc#1178296)</changelog>
  <changelog author="werner@suse.de" date="1605096000">- Add patch useradd-userkeleton.patch to extend original C code
  of useradd to handle /usr/etc/skel (boo#1173321)
- Remove /usr/etc/skel support in useradd.local script</changelog>
  <changelog author="fvogt@suse.com" date="1605096001">- Amend patches/useradd-userkeleton.patch to also write into
  existing directories and prefer files from /etc</changelog>
  <changelog author="kukuk@suse.com" date="1611230400">- Split login.defs configuration file into own sub-package, which
  allows to install util-linux or pam on small embedded/edge
  systems or container without the need to pull in the full shadow
  suite.</changelog>
  <changelog author="sbrabec@suse.com" date="1611835200">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- shadow-util-linux.patch:
  * Add support for LOGIN_KEEP_USERNAME from util-linux &gt;= 2.37.
- Refresh shadow-login_defs-suse.patch.</changelog>
  <changelog author="sbrabec@suse.com" date="1641988800">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- Added patch:
  * shadow-4.8.1-AUDIT_NO_ID.patch
    + fix bsc#1205502: useradd audit event user id field cannot
    be interpreted</changelog>
</package>
<package pkgid="621997e8a58bf56e3c1dfd34ada9bca7ceadf4928ddd93217a1d3f368ef8b7d6" name="slirp4netns" arch="aarch64">
  <version epoch="0" ver="0.4.7" rel="150100.3.18.1"/>
  <changelog author="vrothberg@suse.com" date="1539777600">- Introduce slirp4netns in version 0.1 to support rootless Podman:
  slirp4netns provides user-mode networking ("slirp") for unprivileged network
  namespaces. A common use-case of slirp4netns is to enable network access for
  rootless container engines such as Podman.</changelog>
  <changelog author="appleonkel@opensuse.org" date="1552910400">- Update to 0.3.0-beta1
  * Support protecting 127.0.0.1 on the host (--disable-host-loopback)
  * Support specifying CIDR like 10.0.2.0/24 (--cidr)
  * Fix CVE-2019-6778
  * Synced with QEMU upstream</changelog>
  <changelog author="rbrown@suse.com" date="1553083200">- Change _service to use releases instead of git commit references</changelog>
  <changelog author="sgrunert@suse.com" date="1553860800">- Update to 0.3.0
  * QMP-like JSON API for exposing node ports (--api-socket)</changelog>
  <changelog author="sgrunert@suse.com" date="1564660800">- Update to 0.3.1
  * Fix use-after-free</changelog>
  <changelog author="sgrunert@suse.com" date="1565006400">- Update to 0.3.2
  * Fix heap overflow in `ip_reass` on big packet input</changelog>
  <changelog author="sgrunert@suse.com" date="1565179200">- Add missing licenses to spec file</changelog>
  <changelog author="sgrunert@suse.com" date="1567080000">- Update to 0.3.3
  * Fix use-after-free in libslirp</changelog>
  <changelog author="sgrunert@suse.com" date="1567166400">- Update to 0.4.1
  * Support specifying netns path (slirp4netns --netns-type=path PATH
    TAPNAME)
  * Support specifying --userns-path
  * Vendor https://gitlab.freedesktop.org/slirp/libslirp (QEMU v4.1+)
  * Bring up loopback device when --configure is specified
  * Support sandboxing by creating a mount namespace
    (--enable-sandbox)
  * Support seccomp (--enable-seccomp)
- Add new build dependencies libcap-devel and libseccomp-devel</changelog>
  <changelog author="sgrunert@suse.com" date="1571659200">- Update to 0.4.2
  * Do not propagate mounts to the parent ns in sandbox</changelog>
  <changelog author="sgrunert@suse.com" date="1576670400">- Update to 0.4.3
  * api: raise an error if the socket path is too long
  * libslirp: update to v4.1.0: Including the fix for libslirp
    sends RST to app in response to arriving FIN when containerized
    socket is shutdown() with SHUT_WR
  * Fix create_sandbox error</changelog>
  <changelog author="rhafer@suse.com" date="1585310400">- Update to 0.4.4 (bsc#1167850)
  * libslirp: Update to v4.2.0:
  * New API function slirp_add_unix: add a forward rule to a Unix
    socket.
  * New API function slirp_remove_guestfwd: remove a forward rule
    previously added by slirp_add_exec, slirp_add_unix or
    slirp_add_guestfwd
  * New SlirpConfig.outbound_addr{,6} fields to bind output
    socket to a specific address
  * socket: do not fallback on host loopback if get_dns_addr()
    failed or the address is in slirp network
  * ncsi: fix checksum OOB memory access
  * tcp_emu(): fix OOB accesses
  * tftp: restrict relative path access
  * state: fix loading of guestfwd state</changelog>
  <changelog author="rhafer@suse.com" date="1588593600">- Update to 0.4.5 (bsc#1170940)
  * libslirp: update to v4.3.0:
  * Fix use-afte-free in ip_reass() (CVE-2020-1983)</changelog>
  <changelog author="rhafer@suse.com" date="1594296000">- Update to 0.4.7 (bsc#1172380)
  * libslirp: update to v4.3.1 (Fix CVE-2020-10756)
  * Fix config_from_options() to correctly enable ipv6</changelog>
  <changelog author="pgajdos@suse.com" date="1646740800">- security update
- added patches
  fix CVE-2020-29130 [bsc#1179467], out-of-bounds access while processing ARP packets
  + slirp4netns-CVE-2020-29130.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678363200">- security update
  - slirp4netns-CVE-2020-29130.patch renamed to slirp4netns-CVE-2020-29129,29130.patch,
    fixes both
    CVE-2020-29129 [bsc#1179466], out-of-bounds access while processing NCSI packets
    CVE-2020-29130 [bsc#1179467], out-of-bounds access while processing ARP packets
  + slirp4netns-CVE-2020-29129,29130.patch</changelog>
</package>
<package pkgid="ac73490adbc616be9d4878d60a42058ac136cc965766a788a933f58075ca5d20" name="slirp4netns" arch="src">
  <version epoch="0" ver="0.4.7" rel="150100.3.18.1"/>
  <changelog author="vrothberg@suse.com" date="1539777600">- Introduce slirp4netns in version 0.1 to support rootless Podman:
  slirp4netns provides user-mode networking ("slirp") for unprivileged network
  namespaces. A common use-case of slirp4netns is to enable network access for
  rootless container engines such as Podman.</changelog>
  <changelog author="appleonkel@opensuse.org" date="1552910400">- Update to 0.3.0-beta1
  * Support protecting 127.0.0.1 on the host (--disable-host-loopback)
  * Support specifying CIDR like 10.0.2.0/24 (--cidr)
  * Fix CVE-2019-6778
  * Synced with QEMU upstream</changelog>
  <changelog author="rbrown@suse.com" date="1553083200">- Change _service to use releases instead of git commit references</changelog>
  <changelog author="sgrunert@suse.com" date="1553860800">- Update to 0.3.0
  * QMP-like JSON API for exposing node ports (--api-socket)</changelog>
  <changelog author="sgrunert@suse.com" date="1564660800">- Update to 0.3.1
  * Fix use-after-free</changelog>
  <changelog author="sgrunert@suse.com" date="1565006400">- Update to 0.3.2
  * Fix heap overflow in `ip_reass` on big packet input</changelog>
  <changelog author="sgrunert@suse.com" date="1565179200">- Add missing licenses to spec file</changelog>
  <changelog author="sgrunert@suse.com" date="1567080000">- Update to 0.3.3
  * Fix use-after-free in libslirp</changelog>
  <changelog author="sgrunert@suse.com" date="1567166400">- Update to 0.4.1
  * Support specifying netns path (slirp4netns --netns-type=path PATH
    TAPNAME)
  * Support specifying --userns-path
  * Vendor https://gitlab.freedesktop.org/slirp/libslirp (QEMU v4.1+)
  * Bring up loopback device when --configure is specified
  * Support sandboxing by creating a mount namespace
    (--enable-sandbox)
  * Support seccomp (--enable-seccomp)
- Add new build dependencies libcap-devel and libseccomp-devel</changelog>
  <changelog author="sgrunert@suse.com" date="1571659200">- Update to 0.4.2
  * Do not propagate mounts to the parent ns in sandbox</changelog>
  <changelog author="sgrunert@suse.com" date="1576670400">- Update to 0.4.3
  * api: raise an error if the socket path is too long
  * libslirp: update to v4.1.0: Including the fix for libslirp
    sends RST to app in response to arriving FIN when containerized
    socket is shutdown() with SHUT_WR
  * Fix create_sandbox error</changelog>
  <changelog author="rhafer@suse.com" date="1585310400">- Update to 0.4.4 (bsc#1167850)
  * libslirp: Update to v4.2.0:
  * New API function slirp_add_unix: add a forward rule to a Unix
    socket.
  * New API function slirp_remove_guestfwd: remove a forward rule
    previously added by slirp_add_exec, slirp_add_unix or
    slirp_add_guestfwd
  * New SlirpConfig.outbound_addr{,6} fields to bind output
    socket to a specific address
  * socket: do not fallback on host loopback if get_dns_addr()
    failed or the address is in slirp network
  * ncsi: fix checksum OOB memory access
  * tcp_emu(): fix OOB accesses
  * tftp: restrict relative path access
  * state: fix loading of guestfwd state</changelog>
  <changelog author="rhafer@suse.com" date="1588593600">- Update to 0.4.5 (bsc#1170940)
  * libslirp: update to v4.3.0:
  * Fix use-afte-free in ip_reass() (CVE-2020-1983)</changelog>
  <changelog author="rhafer@suse.com" date="1594296000">- Update to 0.4.7 (bsc#1172380)
  * libslirp: update to v4.3.1 (Fix CVE-2020-10756)
  * Fix config_from_options() to correctly enable ipv6</changelog>
  <changelog author="pgajdos@suse.com" date="1646740800">- security update
- added patches
  fix CVE-2020-29130 [bsc#1179467], out-of-bounds access while processing ARP packets
  + slirp4netns-CVE-2020-29130.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678363200">- security update
  - slirp4netns-CVE-2020-29130.patch renamed to slirp4netns-CVE-2020-29129,29130.patch,
    fixes both
    CVE-2020-29129 [bsc#1179466], out-of-bounds access while processing NCSI packets
    CVE-2020-29130 [bsc#1179467], out-of-bounds access while processing ARP packets
  + slirp4netns-CVE-2020-29129,29130.patch</changelog>
</package>
<package pkgid="1cc22b9386c49d4a2a031a1c2435e80025f2fb3880731280b5c1f7e24fcb39f7" name="slirp4netns" arch="x86_64">
  <version epoch="0" ver="0.4.7" rel="150100.3.18.1"/>
  <changelog author="vrothberg@suse.com" date="1539777600">- Introduce slirp4netns in version 0.1 to support rootless Podman:
  slirp4netns provides user-mode networking ("slirp") for unprivileged network
  namespaces. A common use-case of slirp4netns is to enable network access for
  rootless container engines such as Podman.</changelog>
  <changelog author="appleonkel@opensuse.org" date="1552910400">- Update to 0.3.0-beta1
  * Support protecting 127.0.0.1 on the host (--disable-host-loopback)
  * Support specifying CIDR like 10.0.2.0/24 (--cidr)
  * Fix CVE-2019-6778
  * Synced with QEMU upstream</changelog>
  <changelog author="rbrown@suse.com" date="1553083200">- Change _service to use releases instead of git commit references</changelog>
  <changelog author="sgrunert@suse.com" date="1553860800">- Update to 0.3.0
  * QMP-like JSON API for exposing node ports (--api-socket)</changelog>
  <changelog author="sgrunert@suse.com" date="1564660800">- Update to 0.3.1
  * Fix use-after-free</changelog>
  <changelog author="sgrunert@suse.com" date="1565006400">- Update to 0.3.2
  * Fix heap overflow in `ip_reass` on big packet input</changelog>
  <changelog author="sgrunert@suse.com" date="1565179200">- Add missing licenses to spec file</changelog>
  <changelog author="sgrunert@suse.com" date="1567080000">- Update to 0.3.3
  * Fix use-after-free in libslirp</changelog>
  <changelog author="sgrunert@suse.com" date="1567166400">- Update to 0.4.1
  * Support specifying netns path (slirp4netns --netns-type=path PATH
    TAPNAME)
  * Support specifying --userns-path
  * Vendor https://gitlab.freedesktop.org/slirp/libslirp (QEMU v4.1+)
  * Bring up loopback device when --configure is specified
  * Support sandboxing by creating a mount namespace
    (--enable-sandbox)
  * Support seccomp (--enable-seccomp)
- Add new build dependencies libcap-devel and libseccomp-devel</changelog>
  <changelog author="sgrunert@suse.com" date="1571659200">- Update to 0.4.2
  * Do not propagate mounts to the parent ns in sandbox</changelog>
  <changelog author="sgrunert@suse.com" date="1576670400">- Update to 0.4.3
  * api: raise an error if the socket path is too long
  * libslirp: update to v4.1.0: Including the fix for libslirp
    sends RST to app in response to arriving FIN when containerized
    socket is shutdown() with SHUT_WR
  * Fix create_sandbox error</changelog>
  <changelog author="rhafer@suse.com" date="1585310400">- Update to 0.4.4 (bsc#1167850)
  * libslirp: Update to v4.2.0:
  * New API function slirp_add_unix: add a forward rule to a Unix
    socket.
  * New API function slirp_remove_guestfwd: remove a forward rule
    previously added by slirp_add_exec, slirp_add_unix or
    slirp_add_guestfwd
  * New SlirpConfig.outbound_addr{,6} fields to bind output
    socket to a specific address
  * socket: do not fallback on host loopback if get_dns_addr()
    failed or the address is in slirp network
  * ncsi: fix checksum OOB memory access
  * tcp_emu(): fix OOB accesses
  * tftp: restrict relative path access
  * state: fix loading of guestfwd state</changelog>
  <changelog author="rhafer@suse.com" date="1588593600">- Update to 0.4.5 (bsc#1170940)
  * libslirp: update to v4.3.0:
  * Fix use-afte-free in ip_reass() (CVE-2020-1983)</changelog>
  <changelog author="rhafer@suse.com" date="1594296000">- Update to 0.4.7 (bsc#1172380)
  * libslirp: update to v4.3.1 (Fix CVE-2020-10756)
  * Fix config_from_options() to correctly enable ipv6</changelog>
  <changelog author="pgajdos@suse.com" date="1646740800">- security update
- added patches
  fix CVE-2020-29130 [bsc#1179467], out-of-bounds access while processing ARP packets
  + slirp4netns-CVE-2020-29130.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678363200">- security update
  - slirp4netns-CVE-2020-29130.patch renamed to slirp4netns-CVE-2020-29129,29130.patch,
    fixes both
    CVE-2020-29129 [bsc#1179466], out-of-bounds access while processing NCSI packets
    CVE-2020-29130 [bsc#1179467], out-of-bounds access while processing ARP packets
  + slirp4netns-CVE-2020-29129,29130.patch</changelog>
</package>
<package pkgid="a5baade9dc5abaa2c4d53212c60c93cae4822265cff77d6e3bcba5dd17caa510" name="snmp-mibs" arch="aarch64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="cee8fc82e2129ce9e6b898f28464f7d30db1eaa54832d825afbcdaead7f5742f" name="snmp-mibs" arch="x86_64">
  <version epoch="0" ver="5.9.3" rel="150300.15.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1463832000">- Fix build with perl 5.24.0:
  + Add net-snmp-5.7.3-Fix-Makefile.PL.patch: Fix build system
    recursiely loading Makefile.Pl and destroying its internas.
    See https://rt.perl.org/Public/Bug/Display.html?id=125907
  + net-snmp-5.7.3-Remove-U64-typedef.patch: The U64 typedef
    conflicts with a typedef in a Perl header file. Hence remove
    the U64 typedef from the Net-SNMP header files. Backported from
    upstream commit 477b4307ef1.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497355200">- Fix build with OpenSSL 1.1 (bsc#1042664):
  + Add net-snmp-5.7.3-build-with-openssl-1.1.patch, cumulated
    squash-patch from the following upstream commits:
    bbed6b86e70b5a3c54f14992696f2308a8d79511
    14bb72fd12bf5b68662893f7d8afbc4a8d52a6c8
    9641b472ef01208f92631016e91b0a4a518163f0
    e4c6937483d4a680570cec05388d2e4b291868a6
    b906c60c8a436d7360267a6d242526b33a9aaac8</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
</package>
<package pkgid="0ba8f2aafd7051d63b1ceff48131e52e8fbf7038b7787d5d1233ac95e8c8ebfb" name="snmp-mibs" arch="aarch64">
  <version epoch="0" ver="5.9.3" rel="150300.15.8.1"/>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
  <changelog author="abergmann@suse.com" date="1672920000">- Fixed NULL pointer exception issue when handling ipDefaultTTL or
  pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792).
  add:
  * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch
- Enable AES-192 and AES-256 privacy protocol (bsc#1206828).</changelog>
  <changelog author="abergmann@suse.com" date="1673265600">- Hardening systemd services setting "ProtectHome=true" caused home directory
  size and allocation to be listed incorrectly (bsc#1206044).
  add:
  * net-snmp-5.9.3-harden_snmpd.service.patch
  * net-snmp-5.9.3-harden_snmptrapd.service.patch
  delete:
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch</changelog>
</package>
<package pkgid="71d4f7c2db58ffda51ec2d3c2e0e0ce401aa19eb947e5e132fa3c15997b8a651" name="snmp-mibs" arch="x86_64">
  <version epoch="0" ver="5.9.3" rel="150300.15.8.1"/>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (&gt;=
  4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being
  removed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516363200">- Format with spec-cleaner
- Drop sle11 support as it fails to build anyway for ages
- Rename python packages to be python-%{name} with obsoletes
  * Use new singlespec macros
  * Add patch converting the py files to python3/2 compat mode
    net-snmp-python3.patch
- Run full autoreconf instead of partial
- Build with threads by building few targets first</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Take systemd service files from fedora to replace sysV scripts
- Also convert the sysconfig files to match fedora ones, they
  get bit more terse but it works seamlessly with systemd</changelog>
  <changelog author="tchvatal@suse.com" date="1516795200">- Add patch from Fedora to support natively systemd:
  * net-snmp-5.7.2-systemd.patch
- Drop the check phase as whole 90% of the tests fail it makes
  more sense to run them somewhere localy</changelog>
  <changelog author="tchvatal@suse.com" date="1516795201">- Properly conditionalize the py2 build</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM group for shlib subpackage.</changelog>
  <changelog author="abergmann@suse.com" date="1523880000">- Remove executable flags from systemd service files (bsc#1089295).</changelog>
  <changelog author="tchvatal@suse.com" date="1524052800">- Fix permissions on unit files wrt bsc#1087977
- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1529323200">- Create /var/agentx via systemd tmpfiles in case of rollback,
  snapshots and transactional updates [bsc#1098032]</changelog>
  <changelog author="abergmann@suse.com" date="1539086400">- Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065)
  Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
- swintst_rpm: Protect against unspecified Group name (bsc#1102775)
  Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
- Add tsm and tlstm MIBs and the USM security module. (bsc#1081164)
- Fix agentx freezing on timeout (bsc#1027353)
  Add net-snmp-fix-agentx-freezing-on-timeout.patch</changelog>
  <changelog author="abergmann@suse.com" date="1562328000">- Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120).
  Add net-snmp-5.7.3-add-lustre-fs-support.patch
- Add info about the original agent which triggered the trap.
  When the trap is forwarded there was no info about the original
  agent (bsc#1116807).
  Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
- Fix missing sysconfig files creation (bsc#1108471).</changelog>
  <changelog author="abergmann@suse.com" date="1639742400">- Make extended MIB read-only (bsc#1174961, CVE-2020-15862).
  Add net-snmp-5.7.3-make-extended-mib-read-only.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640001600">- Fix output for high memTotalReal RAM values (bsc#1152968).
  Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640174400">- Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864).
  Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
- Fix NSS mounted volumes in hrStorageDescr (bsc#1100146).
  Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch
- Fix subagent crash at save_set_var() (bsc#1178021).
  Add net-snmp-5.7.3-subagent-set-response.patch
- Fix subagent data corruption (bsc#1178351, bsc#1179009).
  Add net-snmp-5.7.3-fix-subagent-data-corruption.patch</changelog>
  <changelog author="abergmann@suse.com" date="1640260800">- Fix LFH violation during v3 user creation (bsc#1181591).
  Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch</changelog>
  <changelog author="abergmann@suse.com" date="1646827200">- Decouple snmp-mibs from net-snmp version to allow major version
  upgrade (bsc#1196955).</changelog>
  <changelog author="abergmann@suse.com" date="1665057600">- update to 5.9.3 (bsc#1201103, jsc#SLE-11203):
  - security:
  - These two CVEs can be exploited by a user with read-only credentials:
  - CVE-2022-24805A buffer overflow in the handling of the INDEX of
    NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  - CVE-2022-24809A malformed OID in a GET-NEXT to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - These CVEs can be exploited by a user with read-write credentials:
  - CVE-2022-24806Improper Input Validation when SETing malformed
    OIDs in master agent and subagent simultaneously
  - CVE-2022-24807A malformed OID in a SET request to
    SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
    out-of-bounds memory access.
  - CVE-2022-24808A malformed OID in a SET request to
    NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  - CVE-2022-24810A malformed OID in a SET to the nsVacmAccessTable
    can cause a NULL pointer dereference.
  - Fixed library versioning bug found in 5.9.2.
  - Library version change to libsnmp40.
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Fixed python2 backward compability.
  add:
  * net-snmp-5.9.3-fixed-python2-bindings.patch
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Change to use systemd service files directly from net-snmp package.
  add:
  * net-snmp-5.9.1-suse-systemd-service-files.patch
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch
  remove:
  * snmpd.service
  * snmptrapd.service
  * harden_snmpd.service.patch
  * harden_snmptrapd.service.patch
- Refactor and remove obsolete patches to work with version number 5.9.3:
  add:
  * net-snmp-5.9.3-pie.patch
  * net-snmp-5.9.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.9.1-add-lustre-fs-support.patch
  * net-snmp-5.9.1-fix-Makefile.PL.patch
  * net-snmp-5.9.1-modern-rpm-api.patch
  * net-snmp-5.9.1-net-snmp-config-headercheck.patch
  * net-snmp-5.9.1-perl-tk-warning.patch
  * net-snmp-5.9.1-snmpstatus-suppress-output.patch
  * net-snmp-5.9.1-socket-path.patch
  * net-snmp-5.9.1-subagent-set-response.patch
  * net-snmp-5.9.1-testing-empty-arptable.patch
  * net-snmp-5.9.1-velocity-mib.patch
  remove:
  * net-snmp-5.9.1-pie.patch
  * net-snmp-5.9.1-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-add-lustre-fs-support.patch
  * net-snmp-5.7.3-Fix-Makefile.PL.patch
  * net-snmp-5.7.3-modern-rpm-api.patch
  * net-snmp-5.7.3-net-snmp-config-headercheck.patch
  * net-snmp-5.7.3-perl-tk-warning.patch
  * net-snmp-5.7.3-snmpstatus-suppress-output.patch
  * net-snmp-5.7.3-socket-path.patch
  * net-snmp-5.7.3-subagent-set-response.patch
  * net-snmp-5.7.3-testing-empty-arptable.patch
  * net-snmp-5.7.3-velocity-mib.patch
  * net-snmp-5.7.3-fix-create-v3-user-outfile.patch
  * net-snmp-5.7.3-pie.patch
  * net-snmp-4.7.2-systemd.patch
  * net-snmp-5.7.3-build-with-openssl-1.1.patch
  * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch
  * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch
  * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch
  * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch
  * net-snmp-5.7.3-fix-subagent-data-corruption.patch
  * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch
  * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch
  * net-snmp-5.7.3-make-extended-mib-read-only.patch
  * net-snmp-5.7.3-netgroups.patch
  * net-snmp-5.7.3-Remove-U64-typedef.patch
  * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch
  * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch
  * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch
  * net-snmp-python3.patch</changelog>
  <changelog author="abergmann@suse.com" date="1672920000">- Fixed NULL pointer exception issue when handling ipDefaultTTL or
  pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792).
  add:
  * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch
- Enable AES-192 and AES-256 privacy protocol (bsc#1206828).</changelog>
  <changelog author="abergmann@suse.com" date="1673265600">- Hardening systemd services setting "ProtectHome=true" caused home directory
  size and allocation to be listed incorrectly (bsc#1206044).
  add:
  * net-snmp-5.9.3-harden_snmpd.service.patch
  * net-snmp-5.9.3-harden_snmptrapd.service.patch
  delete:
  * net-snmp-5.9.1-harden_snmpd.service.patch
  * net-snmp-5.9.1-harden_snmptrapd.service.patch</changelog>
</package>
<package pkgid="13a87090eb1eb118a8d40264748ceb400395af1741c313c53ec462435f92a6c6" name="sqlite3" arch="src">
  <version epoch="0" ver="3.39.3" rel="150000.3.20.1"/>
  <changelog author="astieger@suse.com" date="1522670400">- update to 3.23.0:
  * Add the sqlite3_serialize() and sqlite3_deserialize()
    interfaces when the SQLITE_ENABLE_DESERIALIZE compile-time
    option is used.
  * Recognize TRUE and FALSE as constants. (For compatibility, if
    there exist columns named "true" or "false", then the
    identifiers refer to the columns rather than Boolean constants.)
  * Support operators IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE.
  * Added the SQLITE_DBSTATUS_CACHE_SPILL option to
    sqlite3_db_status() for reporting the number of cache spills
    that have occurred.
  * The "alternate-form-2" flag ("!") on the built-in printf
    implementation now causes string substitutions to measure the
    width and precision in characters instead of bytes.
  * If the xColumn method in a virtual table implementation returns
    an error message using sqlite3_result_error() then give that
    error message preference over internally-generated messages.
  * Added the -A command-line option to the CLI to make it easier to
    manage SQLite Archive files.
  * Add support for INSERT OR REPLACE, INSERT OR IGNORE, and UPDATE
    OR REPLACE in the Zipfile virtual table.
  * Enhance the sqlite3changeset_apply() interface so that it is
    hardened against attacks from deliberately corrupted changeset
    objects.
  * Added the sqlite3_normalize() extension function.
  * Query optimizer enhancements
  * Various bug fixes
  * Fix various issues reported by fuzzers, including:
    + CVE-2018-8740: NULL pointer dereference on CREATE TABLE as
    (bsc#1085790)</changelog>
  <changelog author="astieger@suse.com" date="1523448000">- update to 3.23.1:
  * Fix two problems in the new LEFT JOIN strength reduction
    optimization
  * Fix misbehavior of the FTS5 xBestIndex method
  * Fix a harmless reference to an uninitialized virtual machine
    register
  * Fix the eval.c extension so that it works with PRAGMA
    empty_result_callbacks=ON
  * Fix the generate_series virtual table so that it correctly
    returns no rows if any of its constraints are NULL
  * Performance enhancements in the parser</changelog>
  <changelog author="max@suse.com" date="1552996800">- CVE-2018-20346, bsc#1119687: Upgrade to the most recent version
  to fix a remote code execution vulnerability in FTS3 (Magellan).
- Drop sqlite-fts5-link.patch and do it in the spec file instead.
- Version 3.27.2:
  * Add the VACUUM INTO command
  * Issue an SQLITE_WARNING message on the error log if a
    double-quoted string literal is used
  * Add the remove_diacritics=2 option to FTS3 and FTS5.
  * Add  the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3().
    Use that option to prevent circular references to shadow tables
    from causing resource leaks.
  * Enhancements to the sqlite3_deserialize() interface
  * Enhancements to the CLI, mostly to support testing and debugging
    of the SQLite library itself
  * Increased robustness against malicious SQL that is run against
    a maliciously corrupted database
- Version 3.26.0:
  * Optimization: When doing an UPDATE on a table with indexes on
    expressions, do not update the expression indexes if they do
    not refer to any of the columns of the table being updated.
  * Allow the xBestIndex() method of virtual table implementations
    to return SQLITE_CONSTRAINT to indicate that the proposed query
    plan is unusable and should not be given further consideration.
  * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the
    ability to create corrupt database files using ordinary SQL.
  * Added support for read-only shadow tables when the
    SQLITE_DBCONFIG_DEFENSIVE option is enabled.
  * Added the PRAGMA legacy_alter_table command, which if enabled
    causes the ALTER TABLE command to behave like older version of
    SQLite (prior to version 3.25.0) for compatibility.
  * Added PRAGMA table_xinfo that works just like PRAGMA table_info
    except that it also shows hidden columns in virtual tables.
  * Added the explain virtual table as a run-time loadable
    extension.
  * Add a limit counter to the query planner to prevent excessive
    sqlite3_prepare() times for certain pathological SQL inputs.
  * Added support for the sqlite3_normalized_sql() interface, when
    compiling with SQLITE_ENABLE_NORMALIZE.
  * Enhanced triggers so that they can use table-valued functions
    that exist in schemas other than the schema where the trigger
    is defined.
  * Improvements to the ".help" command in the CLI.
  * The SQLITE_HISTORY environment variable, if it exists,
    specifies the name of the command-line editing history file.
  * The --deserialize option associated with opening a new database
    in the CLI cause the database file to be read into memory and
    accessed using the sqlite3_deserialize() API. This simplifies
    running tests on a database without modifying the file on disk.
- Version 3.25.2:
  * Add the PRAGMA legacy_alter_table=ON command that causes the
    "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier
  * Fix issue with some expressions with windows functions in views
- Version 3.25.1:
  * Avoid false-positive error checks on ALTER TABLE
  * Further ORDER BY LIMIT optimization fixes for window functions
- Version 3.25.0:
  * Add support for window functions
  * Add support for renaming columns within a table
  * Query optimizer improvements
  * slightly better concurrency in multi-threaded environments
  * The ORDER BY LIMIT optimization might have caused an infinite
    loop in the byte code of the prepared statement under very
    obscure circumstances, due to a confluence of minor defects in
    the query optimizer
- Version 3.24.0:
  * Add support for PostgreSQL-style UPSERT
  * Add support for auxiliary columns in r-tree tables
  * Add C-language APIs for discovering SQL keywords used by SQLite
  * Add C-language APIs for dynamic strings based on sqlite3_str
  * Enhance ALTER TABLE so that it recognizes "true" and "false" as
    valid arguments to DEFAULT
  * Add the sorter-reference optimization as a compile-time option
  * Improve the format of the EXPLAIN QUERY PLAN raw output, so that
  it gives better information about the query plan and about the
    relationships between the various components of the plan
  * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the
    sqlite3_db_config() API.
  * Automatically intercept the raw EXPLAIN QUERY PLAN output an
    reformat it into an ASCII-art graph.
  * Lines that begin with "#" and that are not in the middle of an
    SQL statement are interpreted as comments
  * Add the --append option to the ".backup" command
  * Add the ".dbconfig" command
  * various performance improvements
  * various bug fixes</changelog>
  <changelog author="max@suse.com" date="1555502400">- Upgrade to 3.28.0:
  * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside
    a transaction could trigger a heap-based buffer over-read.
  * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a
    single transaction with an fts5 virtual table will lead to a
    NULL Pointer Dereference.
  * Enhanced window functions
  * Enhanced VACUUM INTO so that it works for read-only databases.
  * New query optimizations.
  * Added the sqlite3_value_frombind() API for determining if the
    argument to an SQL function is from a bound parameter.
  * Security and compatibilities enhancements to fts3_tokenizer().
  * Improved robustness against corrupt database files.</changelog>
  <changelog author="max@suse.com" date="1568116800">- bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch:
  Improper validation of qlite_stat1 sz field leads to division by
  zero.</changelog>
  <changelog author="max@suse.com" date="1625054400">- Sync version 3.36.0 from Factory to implement jsc#SLE-16032.
- Obsoletes sqlite3-CVE-2019-16168.patch.
- The following CVEs have been fixed in upstream releases up to
  this point, but were not mentioned in the change log so far:
  * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in
    multiSelectOrderBy due to mishandling of query-flattener
    optimization
  * bsc#1164719, CVE-2020-9327: NULL pointer dereference and
    segmentation fault because of generated column optimizations in
    isAuxiliaryVtabOperator
  * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds
    with WITH stack unwinding even after a parsing error
  * bsc#1160438, CVE-2019-19959: memory-management error via
    ext/misc/zipfile.c involving embedded '\0' input
  * bsc#1160309, CVE-2019-19923: improper handling  of  certain uses
    of SELECT DISTINCT in flattenSubquery may lead to null pointer
    dereference
  * bsc#1159850, CVE-2019-19924: improper error handling in
    sqlite3WindowRewrite()
  * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname
    during an update of a ZIP archive
  * bsc#1159715, CVE-2019-19926: improper handling  of certain
    errors during parsing  multiSelect in select.c
  * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c
    allows attackers to trigger an invalid pointer dereference
  * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE
    and CREATE VIEW statements, does not consider confusion with
    a shadow table name
  * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an
    integrity_check PRAGMA command in certain cases of generated
    columns
  * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger
    infinite recursion via certain types of self-referential views
    in conjunction with ALTER TABLE statements
  * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits
    from the colUsed bitmask in the case of a generated column,
    which allows attackers to cause a denial of service
  * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The
    function sqlite3Select in select.c allows a crash if a
    sub-select uses both DISTINCT and window functions, and also
    has certain ORDER BY usage
  * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator
    vulnerability
  * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of
    collation-sequence names
  * CVE-2020-13434 boo#1172115: integer overflow in
    sqlite3_str_vappendf
  * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow
  * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed
    to one of its shadow tables
  * CVE-2020-13632 boo#1172240: NULL pointer dereference via
    crafted matchinfo() query
  * CVE-2020-13435: Malicious SQL statements could have crashed the
    process that is running SQLite (boo#1172091)</changelog>
  <changelog author="max@suse.com" date="1638273600">- SQLite3 3.37.0:
  * STRICT tables provide a prescriptive style of data type
    management, for developers who prefer that kind of thing.
  * When adding columns that contain a CHECK constraint or a
    generated column containing a NOT NULL constraint, the
    ALTER TABLE ADD COLUMN now checks new constraints against
    preexisting rows in the database and will only proceed if no
    constraints are violated.
  * Added the PRAGMA table_list statement.
  * Add the .connection command, allowing the CLI to keep multiple
    database connections open at the same time.
  * Add the --safe command-line option that disables dot-commands
    and SQL statements that might cause side-effects that extend
    beyond the single database file named on the command-line.
  * CLI: Performance improvements when reading SQL statements that
    span many lines.
  * Added the sqlite3_autovacuum_pages() interface.
  * The sqlite3_deserialize() does not and has never worked
    for the TEMP database. That limitation is now noted in the
    documentation.
  * The query planner now omits ORDER BY clauses on subqueries and
    views if removing those clauses does not change the semantics
    of the query.
  * The generate_series table-valued function extension is modified
    so that the first parameter ("START") is now required. This is
    done as a way to demonstrate how to write table-valued
    functions with required parameters. The legacy behavior is
    available using the -DZERO_ARGUMENT_GENERATE_SERIES
    compile-time option.
  * Added new sqlite3_changes64() and sqlite3_total_changes64()
    interfaces.
  * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
  * Use less memory to hold the database schema.
  * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert
    extension when a column has no collating sequence.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641124800">- update to 3.37.1:
  * Fix a bug introduced by the UPSERT enhancements of version
    3.35.0 that can cause incorrect byte-code to be generated for
    some obscure but valid SQL, possibly resulting in a NULL-
    pointer dereference.
  * Fix an OOB read that can occur in FTS5 when reading corrupt
    database files.
  * Improved robustness of the --safe option in the CLI.
  * Other minor fixes to assert() statements and test cases.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641988800">- update to 3.37.2:
  * Fix a bug introduced in version 3.35.0 (2021-03-12) that can
    cause database corruption if a SAVEPOINT is rolled back while
    in PRAGMA temp_store=MEMORY mode, and other changes are made,
    and then the outer transaction commits
  * Fix a long-standing problem with ON DELETE CASCADE and ON
    UPDATE CASCADE in which a cache of the bytecode used to
    implement the cascading change was not being reset following a
    local DDL change</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1645876800">- update to 3.38.0
  * Add the -&gt; and -&gt;&gt; operators for easier processing of JSON
  * The JSON functions are now built-ins
  * Enhancements to date and time functions
  * Rename the printf() SQL function to format() for better
    compatibility, with alias for backwards compatibility.
  * Add the sqlite3_error_offset() interface for helping localize
    an SQL error to a specific character in the input SQL text
  * Enhance the interface to virtual tables
  * CLI columnar output modes are enhanced to correctly handle tabs
    and newlines embedded in text, and add options like "--wrap N",
    "--wordwrap on", and "--quote" to the columnar output modes.
  * Query planner enhancements using a Bloom filter to speed up
    large analytic queries, and a balanced merge tree to evaluate
    UNION or UNION ALL compound SELECT statements that have an
    ORDER BY clause.
  * The ALTER TABLE statement is changed to silently ignores
    entries in the sqlite_schema table that do not parse when
    PRAGMA writable_schema=ON</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1647172800">- update to 3.38.1:
  * Fix problems with the new Bloom filter optimization that might
    cause some obscure queries to get an incorrect answer.
  * Fix the localtime modifier of the date and time functions so
    that it preserves fractional seconds.
  * Fix the sqlite_offset SQL function so that it works correctly
    even in corner cases such as when the argument is a virtual
    column or the column of a view.
  * Fix row value IN operator constraints on virtual tables so that
    they work correctly even if the virtual table implementation
    relies on bytecode to filter rows that do not satisfy the
    constraint.
  * Other minor fixes to assert() statements, test cases, and
    documentation. See the source code timeline for details.
- add upstream patch to run atof1 tests only on x86_64
  sqlite-src-3380100-atof1.patch</changelog>
  <changelog author="max@suse.com" date="1647432000">- Remove obsolete configure flags
- Package the Tcl bindings here again so that we only ship one copy
  of SQLite (bsc#1195773).</changelog>
  <changelog author="max@suse.com" date="1648555200">- update to 3.38.2:
  * Fix a problem with the Bloom filter optimization that might
    cause an incorrect answer when doing a LEFT JOIN with a WHERE
    clause constraint that says that one of the columns on the
    right table of the LEFT JOIN is NULL.
  * Other minor patches.</changelog>
  <changelog author="info@paolostivanin.com" date="1651147200">- update to 3.38.3:
  * Fix a case of the query planner be overly aggressive with
    optimizing automatic-index and Bloom-filter construction,
    using inappropriate ON clause terms to restrict the size of the
    automatic-index or Bloom filter, and resulting in missing rows
    in the output.
  * Other minor patches. See the timeline for details.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652011200">- update to 3.38.5:
  * Fix a blunder in the CLI of the 3.38.4 release
- includes changes from 3.38.4:
  * fix a byte-code problem in the Bloom filter pull-down
    optimization added by release 3.38.0 in which an error in the
    byte code causes the byte code engine to enter an infinite loop
    when the pull-down optimization encounters a NULL key</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1656676800">- update to 3.39.0:
  * Add (long overdue) support for RIGHT and FULL OUTER JOIN
  * Add new binary comparison operators IS NOT DISTINCT FROM and
    IS DISTINCT FROM that are equivalent to IS and IS NOT,
    respective, for compatibility with PostgreSQL and SQL standards
  * Add a new return code (value "3") from the sqlite3_vtab_distinct()
    interface that indicates a query that has both DISTINCT and
    ORDER BY clauses
  * Added the sqlite3_db_name() interface
  * The unix os interface resolves all symbolic links in database
    filenames to create a canonical name for the database before
    the file is opened
  * Defer materializing views until the materialization is actually
    needed, thus avoiding unnecessary work if the materialization
    turns out to never be used
  * The HAVING clause of a SELECT statement is now allowed on any
    aggregate query, even queries that do not have a GROUP BY
    clause
  * Many microoptimizations collectively reduce CPU cycles by about
    2.3%.
- drop sqlite-src-3380100-atof1.patch, included upstream
- add sqlite-src-3390000-func7-pg-181.patch to skip float precision
  related test failures on 32 bit</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1657886400">- update to 3.39.1:
  * Fix an incorrect result from a query that uses a view that
    contains a compound SELECT in which only one arm contains a
    RIGHT JOIN and where the view is not the first FROM clause term
    of the query that contains the view
  * Fix a long-standing problem with ALTER TABLE RENAME that can
    only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set
    to a very small value.
  * Fix a long-standing problem in FTS3 that can only arise when
    compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time
    option.
  * Fix the initial-prefix optimization for the REGEXP extension so
    that it works correctly even if the prefix contains characters
    that require a 3-byte UTF8 encoding.
  * Enhance the sqlite_stmt virtual table so that it buffers all of
    its output.</changelog>
  <changelog author="max@suse.com" date="1658404800">- update to 3.39.2:
  * Fix a performance regression in the query planner associated
    with rearranging the order of FROM clause terms in the
    presences of a LEFT JOIN.
  * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and
    1345947, forum post 3607259d3c, and other minor problems
    discovered by internal testing. [boo#1201783]</changelog>
  <changelog author="max@suse.com" date="1662379200">- update to 3.39.3:
  * Use a statement journal on DML statement affecting two or more
    database rows if the statement makes use of a SQL functions
    that might abort.
  * Use a mutex to protect the PRAGMA temp_store_directory and
    PRAGMA data_store_directory statements, even though they are
    decremented and documented as not being threadsafe.</changelog>
  <changelog author="max@suse.com" date="1670932800">- bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch:
  relying on --safe for execution of an untrusted CLI script</changelog>
</package>
<package pkgid="f40b934e62c42917d330340d832db3a67879ef8123ee4b3c65f72afcf9cf22cb" name="sqlite3-tcl" arch="aarch64">
  <version epoch="0" ver="3.39.3" rel="150000.3.20.1"/>
  <changelog author="astieger@suse.com" date="1522670400">- update to 3.23.0:
  * Add the sqlite3_serialize() and sqlite3_deserialize()
    interfaces when the SQLITE_ENABLE_DESERIALIZE compile-time
    option is used.
  * Recognize TRUE and FALSE as constants. (For compatibility, if
    there exist columns named "true" or "false", then the
    identifiers refer to the columns rather than Boolean constants.)
  * Support operators IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE.
  * Added the SQLITE_DBSTATUS_CACHE_SPILL option to
    sqlite3_db_status() for reporting the number of cache spills
    that have occurred.
  * The "alternate-form-2" flag ("!") on the built-in printf
    implementation now causes string substitutions to measure the
    width and precision in characters instead of bytes.
  * If the xColumn method in a virtual table implementation returns
    an error message using sqlite3_result_error() then give that
    error message preference over internally-generated messages.
  * Added the -A command-line option to the CLI to make it easier to
    manage SQLite Archive files.
  * Add support for INSERT OR REPLACE, INSERT OR IGNORE, and UPDATE
    OR REPLACE in the Zipfile virtual table.
  * Enhance the sqlite3changeset_apply() interface so that it is
    hardened against attacks from deliberately corrupted changeset
    objects.
  * Added the sqlite3_normalize() extension function.
  * Query optimizer enhancements
  * Various bug fixes
  * Fix various issues reported by fuzzers, including:
    + CVE-2018-8740: NULL pointer dereference on CREATE TABLE as
    (bsc#1085790)</changelog>
  <changelog author="astieger@suse.com" date="1523448000">- update to 3.23.1:
  * Fix two problems in the new LEFT JOIN strength reduction
    optimization
  * Fix misbehavior of the FTS5 xBestIndex method
  * Fix a harmless reference to an uninitialized virtual machine
    register
  * Fix the eval.c extension so that it works with PRAGMA
    empty_result_callbacks=ON
  * Fix the generate_series virtual table so that it correctly
    returns no rows if any of its constraints are NULL
  * Performance enhancements in the parser</changelog>
  <changelog author="max@suse.com" date="1552996800">- CVE-2018-20346, bsc#1119687: Upgrade to the most recent version
  to fix a remote code execution vulnerability in FTS3 (Magellan).
- Drop sqlite-fts5-link.patch and do it in the spec file instead.
- Version 3.27.2:
  * Add the VACUUM INTO command
  * Issue an SQLITE_WARNING message on the error log if a
    double-quoted string literal is used
  * Add the remove_diacritics=2 option to FTS3 and FTS5.
  * Add  the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3().
    Use that option to prevent circular references to shadow tables
    from causing resource leaks.
  * Enhancements to the sqlite3_deserialize() interface
  * Enhancements to the CLI, mostly to support testing and debugging
    of the SQLite library itself
  * Increased robustness against malicious SQL that is run against
    a maliciously corrupted database
- Version 3.26.0:
  * Optimization: When doing an UPDATE on a table with indexes on
    expressions, do not update the expression indexes if they do
    not refer to any of the columns of the table being updated.
  * Allow the xBestIndex() method of virtual table implementations
    to return SQLITE_CONSTRAINT to indicate that the proposed query
    plan is unusable and should not be given further consideration.
  * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the
    ability to create corrupt database files using ordinary SQL.
  * Added support for read-only shadow tables when the
    SQLITE_DBCONFIG_DEFENSIVE option is enabled.
  * Added the PRAGMA legacy_alter_table command, which if enabled
    causes the ALTER TABLE command to behave like older version of
    SQLite (prior to version 3.25.0) for compatibility.
  * Added PRAGMA table_xinfo that works just like PRAGMA table_info
    except that it also shows hidden columns in virtual tables.
  * Added the explain virtual table as a run-time loadable
    extension.
  * Add a limit counter to the query planner to prevent excessive
    sqlite3_prepare() times for certain pathological SQL inputs.
  * Added support for the sqlite3_normalized_sql() interface, when
    compiling with SQLITE_ENABLE_NORMALIZE.
  * Enhanced triggers so that they can use table-valued functions
    that exist in schemas other than the schema where the trigger
    is defined.
  * Improvements to the ".help" command in the CLI.
  * The SQLITE_HISTORY environment variable, if it exists,
    specifies the name of the command-line editing history file.
  * The --deserialize option associated with opening a new database
    in the CLI cause the database file to be read into memory and
    accessed using the sqlite3_deserialize() API. This simplifies
    running tests on a database without modifying the file on disk.
- Version 3.25.2:
  * Add the PRAGMA legacy_alter_table=ON command that causes the
    "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier
  * Fix issue with some expressions with windows functions in views
- Version 3.25.1:
  * Avoid false-positive error checks on ALTER TABLE
  * Further ORDER BY LIMIT optimization fixes for window functions
- Version 3.25.0:
  * Add support for window functions
  * Add support for renaming columns within a table
  * Query optimizer improvements
  * slightly better concurrency in multi-threaded environments
  * The ORDER BY LIMIT optimization might have caused an infinite
    loop in the byte code of the prepared statement under very
    obscure circumstances, due to a confluence of minor defects in
    the query optimizer
- Version 3.24.0:
  * Add support for PostgreSQL-style UPSERT
  * Add support for auxiliary columns in r-tree tables
  * Add C-language APIs for discovering SQL keywords used by SQLite
  * Add C-language APIs for dynamic strings based on sqlite3_str
  * Enhance ALTER TABLE so that it recognizes "true" and "false" as
    valid arguments to DEFAULT
  * Add the sorter-reference optimization as a compile-time option
  * Improve the format of the EXPLAIN QUERY PLAN raw output, so that
  it gives better information about the query plan and about the
    relationships between the various components of the plan
  * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the
    sqlite3_db_config() API.
  * Automatically intercept the raw EXPLAIN QUERY PLAN output an
    reformat it into an ASCII-art graph.
  * Lines that begin with "#" and that are not in the middle of an
    SQL statement are interpreted as comments
  * Add the --append option to the ".backup" command
  * Add the ".dbconfig" command
  * various performance improvements
  * various bug fixes</changelog>
  <changelog author="max@suse.com" date="1555502400">- Upgrade to 3.28.0:
  * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside
    a transaction could trigger a heap-based buffer over-read.
  * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a
    single transaction with an fts5 virtual table will lead to a
    NULL Pointer Dereference.
  * Enhanced window functions
  * Enhanced VACUUM INTO so that it works for read-only databases.
  * New query optimizations.
  * Added the sqlite3_value_frombind() API for determining if the
    argument to an SQL function is from a bound parameter.
  * Security and compatibilities enhancements to fts3_tokenizer().
  * Improved robustness against corrupt database files.</changelog>
  <changelog author="max@suse.com" date="1568116800">- bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch:
  Improper validation of qlite_stat1 sz field leads to division by
  zero.</changelog>
  <changelog author="max@suse.com" date="1625054400">- Sync version 3.36.0 from Factory to implement jsc#SLE-16032.
- Obsoletes sqlite3-CVE-2019-16168.patch.
- The following CVEs have been fixed in upstream releases up to
  this point, but were not mentioned in the change log so far:
  * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in
    multiSelectOrderBy due to mishandling of query-flattener
    optimization
  * bsc#1164719, CVE-2020-9327: NULL pointer dereference and
    segmentation fault because of generated column optimizations in
    isAuxiliaryVtabOperator
  * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds
    with WITH stack unwinding even after a parsing error
  * bsc#1160438, CVE-2019-19959: memory-management error via
    ext/misc/zipfile.c involving embedded '\0' input
  * bsc#1160309, CVE-2019-19923: improper handling  of  certain uses
    of SELECT DISTINCT in flattenSubquery may lead to null pointer
    dereference
  * bsc#1159850, CVE-2019-19924: improper error handling in
    sqlite3WindowRewrite()
  * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname
    during an update of a ZIP archive
  * bsc#1159715, CVE-2019-19926: improper handling  of certain
    errors during parsing  multiSelect in select.c
  * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c
    allows attackers to trigger an invalid pointer dereference
  * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE
    and CREATE VIEW statements, does not consider confusion with
    a shadow table name
  * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an
    integrity_check PRAGMA command in certain cases of generated
    columns
  * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger
    infinite recursion via certain types of self-referential views
    in conjunction with ALTER TABLE statements
  * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits
    from the colUsed bitmask in the case of a generated column,
    which allows attackers to cause a denial of service
  * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The
    function sqlite3Select in select.c allows a crash if a
    sub-select uses both DISTINCT and window functions, and also
    has certain ORDER BY usage
  * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator
    vulnerability
  * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of
    collation-sequence names
  * CVE-2020-13434 boo#1172115: integer overflow in
    sqlite3_str_vappendf
  * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow
  * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed
    to one of its shadow tables
  * CVE-2020-13632 boo#1172240: NULL pointer dereference via
    crafted matchinfo() query
  * CVE-2020-13435: Malicious SQL statements could have crashed the
    process that is running SQLite (boo#1172091)</changelog>
  <changelog author="max@suse.com" date="1638273600">- SQLite3 3.37.0:
  * STRICT tables provide a prescriptive style of data type
    management, for developers who prefer that kind of thing.
  * When adding columns that contain a CHECK constraint or a
    generated column containing a NOT NULL constraint, the
    ALTER TABLE ADD COLUMN now checks new constraints against
    preexisting rows in the database and will only proceed if no
    constraints are violated.
  * Added the PRAGMA table_list statement.
  * Add the .connection command, allowing the CLI to keep multiple
    database connections open at the same time.
  * Add the --safe command-line option that disables dot-commands
    and SQL statements that might cause side-effects that extend
    beyond the single database file named on the command-line.
  * CLI: Performance improvements when reading SQL statements that
    span many lines.
  * Added the sqlite3_autovacuum_pages() interface.
  * The sqlite3_deserialize() does not and has never worked
    for the TEMP database. That limitation is now noted in the
    documentation.
  * The query planner now omits ORDER BY clauses on subqueries and
    views if removing those clauses does not change the semantics
    of the query.
  * The generate_series table-valued function extension is modified
    so that the first parameter ("START") is now required. This is
    done as a way to demonstrate how to write table-valued
    functions with required parameters. The legacy behavior is
    available using the -DZERO_ARGUMENT_GENERATE_SERIES
    compile-time option.
  * Added new sqlite3_changes64() and sqlite3_total_changes64()
    interfaces.
  * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
  * Use less memory to hold the database schema.
  * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert
    extension when a column has no collating sequence.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641124800">- update to 3.37.1:
  * Fix a bug introduced by the UPSERT enhancements of version
    3.35.0 that can cause incorrect byte-code to be generated for
    some obscure but valid SQL, possibly resulting in a NULL-
    pointer dereference.
  * Fix an OOB read that can occur in FTS5 when reading corrupt
    database files.
  * Improved robustness of the --safe option in the CLI.
  * Other minor fixes to assert() statements and test cases.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641988800">- update to 3.37.2:
  * Fix a bug introduced in version 3.35.0 (2021-03-12) that can
    cause database corruption if a SAVEPOINT is rolled back while
    in PRAGMA temp_store=MEMORY mode, and other changes are made,
    and then the outer transaction commits
  * Fix a long-standing problem with ON DELETE CASCADE and ON
    UPDATE CASCADE in which a cache of the bytecode used to
    implement the cascading change was not being reset following a
    local DDL change</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1645876800">- update to 3.38.0
  * Add the -&gt; and -&gt;&gt; operators for easier processing of JSON
  * The JSON functions are now built-ins
  * Enhancements to date and time functions
  * Rename the printf() SQL function to format() for better
    compatibility, with alias for backwards compatibility.
  * Add the sqlite3_error_offset() interface for helping localize
    an SQL error to a specific character in the input SQL text
  * Enhance the interface to virtual tables
  * CLI columnar output modes are enhanced to correctly handle tabs
    and newlines embedded in text, and add options like "--wrap N",
    "--wordwrap on", and "--quote" to the columnar output modes.
  * Query planner enhancements using a Bloom filter to speed up
    large analytic queries, and a balanced merge tree to evaluate
    UNION or UNION ALL compound SELECT statements that have an
    ORDER BY clause.
  * The ALTER TABLE statement is changed to silently ignores
    entries in the sqlite_schema table that do not parse when
    PRAGMA writable_schema=ON</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1647172800">- update to 3.38.1:
  * Fix problems with the new Bloom filter optimization that might
    cause some obscure queries to get an incorrect answer.
  * Fix the localtime modifier of the date and time functions so
    that it preserves fractional seconds.
  * Fix the sqlite_offset SQL function so that it works correctly
    even in corner cases such as when the argument is a virtual
    column or the column of a view.
  * Fix row value IN operator constraints on virtual tables so that
    they work correctly even if the virtual table implementation
    relies on bytecode to filter rows that do not satisfy the
    constraint.
  * Other minor fixes to assert() statements, test cases, and
    documentation. See the source code timeline for details.
- add upstream patch to run atof1 tests only on x86_64
  sqlite-src-3380100-atof1.patch</changelog>
  <changelog author="max@suse.com" date="1647432000">- Remove obsolete configure flags
- Package the Tcl bindings here again so that we only ship one copy
  of SQLite (bsc#1195773).</changelog>
  <changelog author="max@suse.com" date="1648555200">- update to 3.38.2:
  * Fix a problem with the Bloom filter optimization that might
    cause an incorrect answer when doing a LEFT JOIN with a WHERE
    clause constraint that says that one of the columns on the
    right table of the LEFT JOIN is NULL.
  * Other minor patches.</changelog>
  <changelog author="info@paolostivanin.com" date="1651147200">- update to 3.38.3:
  * Fix a case of the query planner be overly aggressive with
    optimizing automatic-index and Bloom-filter construction,
    using inappropriate ON clause terms to restrict the size of the
    automatic-index or Bloom filter, and resulting in missing rows
    in the output.
  * Other minor patches. See the timeline for details.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652011200">- update to 3.38.5:
  * Fix a blunder in the CLI of the 3.38.4 release
- includes changes from 3.38.4:
  * fix a byte-code problem in the Bloom filter pull-down
    optimization added by release 3.38.0 in which an error in the
    byte code causes the byte code engine to enter an infinite loop
    when the pull-down optimization encounters a NULL key</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1656676800">- update to 3.39.0:
  * Add (long overdue) support for RIGHT and FULL OUTER JOIN
  * Add new binary comparison operators IS NOT DISTINCT FROM and
    IS DISTINCT FROM that are equivalent to IS and IS NOT,
    respective, for compatibility with PostgreSQL and SQL standards
  * Add a new return code (value "3") from the sqlite3_vtab_distinct()
    interface that indicates a query that has both DISTINCT and
    ORDER BY clauses
  * Added the sqlite3_db_name() interface
  * The unix os interface resolves all symbolic links in database
    filenames to create a canonical name for the database before
    the file is opened
  * Defer materializing views until the materialization is actually
    needed, thus avoiding unnecessary work if the materialization
    turns out to never be used
  * The HAVING clause of a SELECT statement is now allowed on any
    aggregate query, even queries that do not have a GROUP BY
    clause
  * Many microoptimizations collectively reduce CPU cycles by about
    2.3%.
- drop sqlite-src-3380100-atof1.patch, included upstream
- add sqlite-src-3390000-func7-pg-181.patch to skip float precision
  related test failures on 32 bit</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1657886400">- update to 3.39.1:
  * Fix an incorrect result from a query that uses a view that
    contains a compound SELECT in which only one arm contains a
    RIGHT JOIN and where the view is not the first FROM clause term
    of the query that contains the view
  * Fix a long-standing problem with ALTER TABLE RENAME that can
    only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set
    to a very small value.
  * Fix a long-standing problem in FTS3 that can only arise when
    compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time
    option.
  * Fix the initial-prefix optimization for the REGEXP extension so
    that it works correctly even if the prefix contains characters
    that require a 3-byte UTF8 encoding.
  * Enhance the sqlite_stmt virtual table so that it buffers all of
    its output.</changelog>
  <changelog author="max@suse.com" date="1658404800">- update to 3.39.2:
  * Fix a performance regression in the query planner associated
    with rearranging the order of FROM clause terms in the
    presences of a LEFT JOIN.
  * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and
    1345947, forum post 3607259d3c, and other minor problems
    discovered by internal testing. [boo#1201783]</changelog>
  <changelog author="max@suse.com" date="1662379200">- update to 3.39.3:
  * Use a statement journal on DML statement affecting two or more
    database rows if the statement makes use of a SQL functions
    that might abort.
  * Use a mutex to protect the PRAGMA temp_store_directory and
    PRAGMA data_store_directory statements, even though they are
    decremented and documented as not being threadsafe.</changelog>
  <changelog author="max@suse.com" date="1670932800">- bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch:
  relying on --safe for execution of an untrusted CLI script</changelog>
</package>
<package pkgid="cd05fee64c5264c263fae9a6f8595f96dec4ca572a23bb31988884d623e0f1f2" name="sqlite3-tcl" arch="x86_64">
  <version epoch="0" ver="3.39.3" rel="150000.3.20.1"/>
  <changelog author="astieger@suse.com" date="1522670400">- update to 3.23.0:
  * Add the sqlite3_serialize() and sqlite3_deserialize()
    interfaces when the SQLITE_ENABLE_DESERIALIZE compile-time
    option is used.
  * Recognize TRUE and FALSE as constants. (For compatibility, if
    there exist columns named "true" or "false", then the
    identifiers refer to the columns rather than Boolean constants.)
  * Support operators IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE.
  * Added the SQLITE_DBSTATUS_CACHE_SPILL option to
    sqlite3_db_status() for reporting the number of cache spills
    that have occurred.
  * The "alternate-form-2" flag ("!") on the built-in printf
    implementation now causes string substitutions to measure the
    width and precision in characters instead of bytes.
  * If the xColumn method in a virtual table implementation returns
    an error message using sqlite3_result_error() then give that
    error message preference over internally-generated messages.
  * Added the -A command-line option to the CLI to make it easier to
    manage SQLite Archive files.
  * Add support for INSERT OR REPLACE, INSERT OR IGNORE, and UPDATE
    OR REPLACE in the Zipfile virtual table.
  * Enhance the sqlite3changeset_apply() interface so that it is
    hardened against attacks from deliberately corrupted changeset
    objects.
  * Added the sqlite3_normalize() extension function.
  * Query optimizer enhancements
  * Various bug fixes
  * Fix various issues reported by fuzzers, including:
    + CVE-2018-8740: NULL pointer dereference on CREATE TABLE as
    (bsc#1085790)</changelog>
  <changelog author="astieger@suse.com" date="1523448000">- update to 3.23.1:
  * Fix two problems in the new LEFT JOIN strength reduction
    optimization
  * Fix misbehavior of the FTS5 xBestIndex method
  * Fix a harmless reference to an uninitialized virtual machine
    register
  * Fix the eval.c extension so that it works with PRAGMA
    empty_result_callbacks=ON
  * Fix the generate_series virtual table so that it correctly
    returns no rows if any of its constraints are NULL
  * Performance enhancements in the parser</changelog>
  <changelog author="max@suse.com" date="1552996800">- CVE-2018-20346, bsc#1119687: Upgrade to the most recent version
  to fix a remote code execution vulnerability in FTS3 (Magellan).
- Drop sqlite-fts5-link.patch and do it in the spec file instead.
- Version 3.27.2:
  * Add the VACUUM INTO command
  * Issue an SQLITE_WARNING message on the error log if a
    double-quoted string literal is used
  * Add the remove_diacritics=2 option to FTS3 and FTS5.
  * Add  the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3().
    Use that option to prevent circular references to shadow tables
    from causing resource leaks.
  * Enhancements to the sqlite3_deserialize() interface
  * Enhancements to the CLI, mostly to support testing and debugging
    of the SQLite library itself
  * Increased robustness against malicious SQL that is run against
    a maliciously corrupted database
- Version 3.26.0:
  * Optimization: When doing an UPDATE on a table with indexes on
    expressions, do not update the expression indexes if they do
    not refer to any of the columns of the table being updated.
  * Allow the xBestIndex() method of virtual table implementations
    to return SQLITE_CONSTRAINT to indicate that the proposed query
    plan is unusable and should not be given further consideration.
  * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the
    ability to create corrupt database files using ordinary SQL.
  * Added support for read-only shadow tables when the
    SQLITE_DBCONFIG_DEFENSIVE option is enabled.
  * Added the PRAGMA legacy_alter_table command, which if enabled
    causes the ALTER TABLE command to behave like older version of
    SQLite (prior to version 3.25.0) for compatibility.
  * Added PRAGMA table_xinfo that works just like PRAGMA table_info
    except that it also shows hidden columns in virtual tables.
  * Added the explain virtual table as a run-time loadable
    extension.
  * Add a limit counter to the query planner to prevent excessive
    sqlite3_prepare() times for certain pathological SQL inputs.
  * Added support for the sqlite3_normalized_sql() interface, when
    compiling with SQLITE_ENABLE_NORMALIZE.
  * Enhanced triggers so that they can use table-valued functions
    that exist in schemas other than the schema where the trigger
    is defined.
  * Improvements to the ".help" command in the CLI.
  * The SQLITE_HISTORY environment variable, if it exists,
    specifies the name of the command-line editing history file.
  * The --deserialize option associated with opening a new database
    in the CLI cause the database file to be read into memory and
    accessed using the sqlite3_deserialize() API. This simplifies
    running tests on a database without modifying the file on disk.
- Version 3.25.2:
  * Add the PRAGMA legacy_alter_table=ON command that causes the
    "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier
  * Fix issue with some expressions with windows functions in views
- Version 3.25.1:
  * Avoid false-positive error checks on ALTER TABLE
  * Further ORDER BY LIMIT optimization fixes for window functions
- Version 3.25.0:
  * Add support for window functions
  * Add support for renaming columns within a table
  * Query optimizer improvements
  * slightly better concurrency in multi-threaded environments
  * The ORDER BY LIMIT optimization might have caused an infinite
    loop in the byte code of the prepared statement under very
    obscure circumstances, due to a confluence of minor defects in
    the query optimizer
- Version 3.24.0:
  * Add support for PostgreSQL-style UPSERT
  * Add support for auxiliary columns in r-tree tables
  * Add C-language APIs for discovering SQL keywords used by SQLite
  * Add C-language APIs for dynamic strings based on sqlite3_str
  * Enhance ALTER TABLE so that it recognizes "true" and "false" as
    valid arguments to DEFAULT
  * Add the sorter-reference optimization as a compile-time option
  * Improve the format of the EXPLAIN QUERY PLAN raw output, so that
  it gives better information about the query plan and about the
    relationships between the various components of the plan
  * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the
    sqlite3_db_config() API.
  * Automatically intercept the raw EXPLAIN QUERY PLAN output an
    reformat it into an ASCII-art graph.
  * Lines that begin with "#" and that are not in the middle of an
    SQL statement are interpreted as comments
  * Add the --append option to the ".backup" command
  * Add the ".dbconfig" command
  * various performance improvements
  * various bug fixes</changelog>
  <changelog author="max@suse.com" date="1555502400">- Upgrade to 3.28.0:
  * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside
    a transaction could trigger a heap-based buffer over-read.
  * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a
    single transaction with an fts5 virtual table will lead to a
    NULL Pointer Dereference.
  * Enhanced window functions
  * Enhanced VACUUM INTO so that it works for read-only databases.
  * New query optimizations.
  * Added the sqlite3_value_frombind() API for determining if the
    argument to an SQL function is from a bound parameter.
  * Security and compatibilities enhancements to fts3_tokenizer().
  * Improved robustness against corrupt database files.</changelog>
  <changelog author="max@suse.com" date="1568116800">- bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch:
  Improper validation of qlite_stat1 sz field leads to division by
  zero.</changelog>
  <changelog author="max@suse.com" date="1625054400">- Sync version 3.36.0 from Factory to implement jsc#SLE-16032.
- Obsoletes sqlite3-CVE-2019-16168.patch.
- The following CVEs have been fixed in upstream releases up to
  this point, but were not mentioned in the change log so far:
  * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in
    multiSelectOrderBy due to mishandling of query-flattener
    optimization
  * bsc#1164719, CVE-2020-9327: NULL pointer dereference and
    segmentation fault because of generated column optimizations in
    isAuxiliaryVtabOperator
  * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds
    with WITH stack unwinding even after a parsing error
  * bsc#1160438, CVE-2019-19959: memory-management error via
    ext/misc/zipfile.c involving embedded '\0' input
  * bsc#1160309, CVE-2019-19923: improper handling  of  certain uses
    of SELECT DISTINCT in flattenSubquery may lead to null pointer
    dereference
  * bsc#1159850, CVE-2019-19924: improper error handling in
    sqlite3WindowRewrite()
  * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname
    during an update of a ZIP archive
  * bsc#1159715, CVE-2019-19926: improper handling  of certain
    errors during parsing  multiSelect in select.c
  * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c
    allows attackers to trigger an invalid pointer dereference
  * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE
    and CREATE VIEW statements, does not consider confusion with
    a shadow table name
  * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an
    integrity_check PRAGMA command in certain cases of generated
    columns
  * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger
    infinite recursion via certain types of self-referential views
    in conjunction with ALTER TABLE statements
  * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits
    from the colUsed bitmask in the case of a generated column,
    which allows attackers to cause a denial of service
  * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The
    function sqlite3Select in select.c allows a crash if a
    sub-select uses both DISTINCT and window functions, and also
    has certain ORDER BY usage
  * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator
    vulnerability
  * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of
    collation-sequence names
  * CVE-2020-13434 boo#1172115: integer overflow in
    sqlite3_str_vappendf
  * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow
  * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed
    to one of its shadow tables
  * CVE-2020-13632 boo#1172240: NULL pointer dereference via
    crafted matchinfo() query
  * CVE-2020-13435: Malicious SQL statements could have crashed the
    process that is running SQLite (boo#1172091)</changelog>
  <changelog author="max@suse.com" date="1638273600">- SQLite3 3.37.0:
  * STRICT tables provide a prescriptive style of data type
    management, for developers who prefer that kind of thing.
  * When adding columns that contain a CHECK constraint or a
    generated column containing a NOT NULL constraint, the
    ALTER TABLE ADD COLUMN now checks new constraints against
    preexisting rows in the database and will only proceed if no
    constraints are violated.
  * Added the PRAGMA table_list statement.
  * Add the .connection command, allowing the CLI to keep multiple
    database connections open at the same time.
  * Add the --safe command-line option that disables dot-commands
    and SQL statements that might cause side-effects that extend
    beyond the single database file named on the command-line.
  * CLI: Performance improvements when reading SQL statements that
    span many lines.
  * Added the sqlite3_autovacuum_pages() interface.
  * The sqlite3_deserialize() does not and has never worked
    for the TEMP database. That limitation is now noted in the
    documentation.
  * The query planner now omits ORDER BY clauses on subqueries and
    views if removing those clauses does not change the semantics
    of the query.
  * The generate_series table-valued function extension is modified
    so that the first parameter ("START") is now required. This is
    done as a way to demonstrate how to write table-valued
    functions with required parameters. The legacy behavior is
    available using the -DZERO_ARGUMENT_GENERATE_SERIES
    compile-time option.
  * Added new sqlite3_changes64() and sqlite3_total_changes64()
    interfaces.
  * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
  * Use less memory to hold the database schema.
  * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert
    extension when a column has no collating sequence.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641124800">- update to 3.37.1:
  * Fix a bug introduced by the UPSERT enhancements of version
    3.35.0 that can cause incorrect byte-code to be generated for
    some obscure but valid SQL, possibly resulting in a NULL-
    pointer dereference.
  * Fix an OOB read that can occur in FTS5 when reading corrupt
    database files.
  * Improved robustness of the --safe option in the CLI.
  * Other minor fixes to assert() statements and test cases.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641988800">- update to 3.37.2:
  * Fix a bug introduced in version 3.35.0 (2021-03-12) that can
    cause database corruption if a SAVEPOINT is rolled back while
    in PRAGMA temp_store=MEMORY mode, and other changes are made,
    and then the outer transaction commits
  * Fix a long-standing problem with ON DELETE CASCADE and ON
    UPDATE CASCADE in which a cache of the bytecode used to
    implement the cascading change was not being reset following a
    local DDL change</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1645876800">- update to 3.38.0
  * Add the -&gt; and -&gt;&gt; operators for easier processing of JSON
  * The JSON functions are now built-ins
  * Enhancements to date and time functions
  * Rename the printf() SQL function to format() for better
    compatibility, with alias for backwards compatibility.
  * Add the sqlite3_error_offset() interface for helping localize
    an SQL error to a specific character in the input SQL text
  * Enhance the interface to virtual tables
  * CLI columnar output modes are enhanced to correctly handle tabs
    and newlines embedded in text, and add options like "--wrap N",
    "--wordwrap on", and "--quote" to the columnar output modes.
  * Query planner enhancements using a Bloom filter to speed up
    large analytic queries, and a balanced merge tree to evaluate
    UNION or UNION ALL compound SELECT statements that have an
    ORDER BY clause.
  * The ALTER TABLE statement is changed to silently ignores
    entries in the sqlite_schema table that do not parse when
    PRAGMA writable_schema=ON</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1647172800">- update to 3.38.1:
  * Fix problems with the new Bloom filter optimization that might
    cause some obscure queries to get an incorrect answer.
  * Fix the localtime modifier of the date and time functions so
    that it preserves fractional seconds.
  * Fix the sqlite_offset SQL function so that it works correctly
    even in corner cases such as when the argument is a virtual
    column or the column of a view.
  * Fix row value IN operator constraints on virtual tables so that
    they work correctly even if the virtual table implementation
    relies on bytecode to filter rows that do not satisfy the
    constraint.
  * Other minor fixes to assert() statements, test cases, and
    documentation. See the source code timeline for details.
- add upstream patch to run atof1 tests only on x86_64
  sqlite-src-3380100-atof1.patch</changelog>
  <changelog author="max@suse.com" date="1647432000">- Remove obsolete configure flags
- Package the Tcl bindings here again so that we only ship one copy
  of SQLite (bsc#1195773).</changelog>
  <changelog author="max@suse.com" date="1648555200">- update to 3.38.2:
  * Fix a problem with the Bloom filter optimization that might
    cause an incorrect answer when doing a LEFT JOIN with a WHERE
    clause constraint that says that one of the columns on the
    right table of the LEFT JOIN is NULL.
  * Other minor patches.</changelog>
  <changelog author="info@paolostivanin.com" date="1651147200">- update to 3.38.3:
  * Fix a case of the query planner be overly aggressive with
    optimizing automatic-index and Bloom-filter construction,
    using inappropriate ON clause terms to restrict the size of the
    automatic-index or Bloom filter, and resulting in missing rows
    in the output.
  * Other minor patches. See the timeline for details.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652011200">- update to 3.38.5:
  * Fix a blunder in the CLI of the 3.38.4 release
- includes changes from 3.38.4:
  * fix a byte-code problem in the Bloom filter pull-down
    optimization added by release 3.38.0 in which an error in the
    byte code causes the byte code engine to enter an infinite loop
    when the pull-down optimization encounters a NULL key</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1656676800">- update to 3.39.0:
  * Add (long overdue) support for RIGHT and FULL OUTER JOIN
  * Add new binary comparison operators IS NOT DISTINCT FROM and
    IS DISTINCT FROM that are equivalent to IS and IS NOT,
    respective, for compatibility with PostgreSQL and SQL standards
  * Add a new return code (value "3") from the sqlite3_vtab_distinct()
    interface that indicates a query that has both DISTINCT and
    ORDER BY clauses
  * Added the sqlite3_db_name() interface
  * The unix os interface resolves all symbolic links in database
    filenames to create a canonical name for the database before
    the file is opened
  * Defer materializing views until the materialization is actually
    needed, thus avoiding unnecessary work if the materialization
    turns out to never be used
  * The HAVING clause of a SELECT statement is now allowed on any
    aggregate query, even queries that do not have a GROUP BY
    clause
  * Many microoptimizations collectively reduce CPU cycles by about
    2.3%.
- drop sqlite-src-3380100-atof1.patch, included upstream
- add sqlite-src-3390000-func7-pg-181.patch to skip float precision
  related test failures on 32 bit</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1657886400">- update to 3.39.1:
  * Fix an incorrect result from a query that uses a view that
    contains a compound SELECT in which only one arm contains a
    RIGHT JOIN and where the view is not the first FROM clause term
    of the query that contains the view
  * Fix a long-standing problem with ALTER TABLE RENAME that can
    only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set
    to a very small value.
  * Fix a long-standing problem in FTS3 that can only arise when
    compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time
    option.
  * Fix the initial-prefix optimization for the REGEXP extension so
    that it works correctly even if the prefix contains characters
    that require a 3-byte UTF8 encoding.
  * Enhance the sqlite_stmt virtual table so that it buffers all of
    its output.</changelog>
  <changelog author="max@suse.com" date="1658404800">- update to 3.39.2:
  * Fix a performance regression in the query planner associated
    with rearranging the order of FROM clause terms in the
    presences of a LEFT JOIN.
  * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and
    1345947, forum post 3607259d3c, and other minor problems
    discovered by internal testing. [boo#1201783]</changelog>
  <changelog author="max@suse.com" date="1662379200">- update to 3.39.3:
  * Use a statement journal on DML statement affecting two or more
    database rows if the statement makes use of a SQL functions
    that might abort.
  * Use a mutex to protect the PRAGMA temp_store_directory and
    PRAGMA data_store_directory statements, even though they are
    decremented and documented as not being threadsafe.</changelog>
  <changelog author="max@suse.com" date="1670932800">- bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch:
  relying on --safe for execution of an untrusted CLI script</changelog>
</package>
<package pkgid="d71ff8d7a1ec6921402b1571fbd635b522fb9150c4a548709bde0fb6fa1ffade" name="sudo" arch="aarch64">
  <version epoch="0" ver="1.9.9" rel="150400.4.12.1"/>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="dmueller@suse.com" date="1616241600">- update to 1.9.6p1
  * Fixed a regression introduced in sudo 1.9.6 that resulted in an
  error message instead of a usage message when sudo is run with
  no arguments.
  * Fixed a sudo_sendlog compilation problem with the AIX xlC compiler.
  * Fixed a regression introduced in sudo 1.9.4 where the
  - -disable-root-mailer configure option had no effect.
  * Added a --disable-leaks configure option that avoids some
  memory leaks on exit that would otherwise occur.  This is intended
  to be used with development tools that measure memory leaks.  It
  is not safe to use in production at this time.
  * Plugged some memory leaks identified by oss-fuzz and ASAN.
  * Fixed the handling of sudoOptions for an LDAP sudoRole that
  contains multiple sudoCommands.  Previously, some of the options
  would only be applied to the first sudoCommand.
  * Fixed a potential out of bounds read in the parsing of NOTBEFORE
  and NOTAFTER sudoers command options (and their LDAP equivalents).
  * The parser used for reading I/O log JSON files is now more
  resilient when processing invalid JSON.
  * Fixed typos that prevented "make uninstall" from working.
  * Fixed a regression introduced in sudo 1.9.4 where the last line
  in a sudoers file might not have a terminating NUL character
  added if no newline was present.
  * Integrated oss-fuzz and LLVM's libFuzzer with sudo.  The new
  - -enable-fuzzer configure option can be combined with the
  - -enable-sanitizer option to build sudo with fuzzing support.
  Multiple fuzz targets are available for fuzzing different parts
  of sudo.  Fuzzers are built and tested via "make fuzz" or as part
  of "make check" (even when sudo is not built with fuzzing support).
  Fuzzing support currently requires the LLVM clang compiler (not gcc).
  * Fixed the --enable-static-sudoers configure option.
  * Fixed a potential out of bounds read sudo when is run by a user
  with more groups than the value of "max_groups" in sudo.conf.
  * Added an "admin_flag" sudoers option to make the use of the
  ~/.sudo_as_admin_successful file configurable on systems where
  sudo is build with the --enable-admin-flag configure option.
  This mostly affects Ubuntu and its derivatives.
  * The "max_groups" setting in sudo.conf is now limited to 1024.
  This setting is obsolete and should no longer be needed.
  * Fixed a bug in the tilde expansion of "CHROOT=dir" and "CWD=dir"
  sudoers command options.  A path "~/foo" was expanded to
  "/home/userfoo" instead of "/home/user/foo".  This also affects
  the runchroot and runcwd Defaults settings.
  * Fixed a bug on systems without a native getdelim(3) function
  where very long lines could cause parsing of the sudoers file
  to end prematurely.
  * Fixed a potential integer overflow when converting the
  timestamp_timeout and passwd_timeout sudoers settings to a
  timespec struct.
  * The default for the "group_source" setting in sudo.conf is now
  "dynamic" on macOS.  Recent versions of macOS do not reliably
  return all of a user's non-local groups via getgroups(2), even
  when _DARWIN_UNLIMITED_GETGROUPS is defined.
  * Fixed a potential use-after-free in the PAM conversation function.
  * Fixed potential redefinition of sys/stat.h macros in sudo_compat.h.</changelog>
  <changelog author="kstreitova@suse.com" date="1620820800">- update to 1.9.7
  * The "fuzz" Makefile target now runs all the fuzzers for 8192
    passes (can be overridden via the FUZZ_RUNS variable).  This makes
    it easier to run the fuzzers in-tree.  To run a fuzzer indefinitely,
    set FUZZ_RUNS=-1, e.g. "make FUZZ_RUNS=-1 fuzz".
  * Fixed fuzzing on FreeBSD where the ld.lld linker returns an
    error by default when a symbol is multiply-defined.
  * Added support for determining local IPv6 addresses on systems
    that lack the getifaddrs() function.  This now works on AIX,
    HP-UX and Solaris (at least).  Bug #969.
  * Fixed a bug introduced in sudo 1.9.6 that caused "sudo -V" to
    report a usage error.  Also, when invoked as sudoedit, sudo now
    allows a more restricted set of options that matches the usage
    statement and documentation.  GitHub issue #95.
  * Fixed a crash in sudo_sendlog when the specified certificate
    or key does not exist or is invalid.  Bug #970
  * Fixed a compilation error when sudo is configured with the
  - -disable-log-client option.
  * Sudo's limited support for SUCCESS=return entries in nsswitch.conf
    is now documented.  Bug #971.
  * Sudo now requires autoconf 2.70 or higher to regenerate the
    configure script.  Bug #972.
  * sudo_logsrvd now has a relay mode which can be used to create
    a hierarchy of log servers.  By default, when a relay server is
    defined, messages from the client are forwarded immediately to
    the relay.  However, if the "store_first" setting is enabled,
    the log will be stored locally until the command completes and
    then relayed.  Bug #965.
  * Sudo now links with OpenSSL by default if it is available unless
    the --disable-openssl configure option is used or both the
  - -disable-log-client and --disable-log-server configure options
    are specified.
  * Fixed configure's Python version detection when the version minor
    number is more than a single digit, for example Python 3.10.
  * The sudo Python module tests now pass for Python 3.10.
  * Sudo will now avoid changing the datasize resource limit
    as long as the existing value is at least 1GB.  This works around
    a problem on 64-bit HP-UX where it is not possible to exactly
    restore the original datasize limit.  Bug #973.
  * Fixed a race condition that could result in a hang when sudo is
    executed by a process where the SIGCHLD handler is set to SIG_IGN.
    This fixes the bug described by GitHub PR #98.
  * Fixed an out-of-bounds read in sudoedit and visudo when the
    EDITOR, VISUAL or SUDO_EDITOR environment variables end in an
    unescaped backslash.  Also fixed the handling of quote characters
    that are escaped by a backslash.  GitHub issue #99.
  * Fixed a bug that prevented the "log_server_verify" sudoers option
    from taking effect.
  * The sudo_sendlog utility has a new -s option to cause it to stop
    sending I/O records after a user-specified elapsed time.  This
    can be used to test the I/O log restart functionality of sudo_logsrvd.
  * Fixed a crash introduced in sudo 1.9.4 in sudo_logsrvd when
    attempting to restart an interrupted I/O log transfer.
  * The TLS connection timeout in the sudoers log client was previously
    hard-coded to 10 seconds.  It now uses the value of log_server_timeout.
  * The configure script now outputs a summary of the user-configurable
    options at the end, separate from output of configure script tests.
    Bug #820.
  * Corrected the description of which groups may be specified via the
  - g option in the Runas_Spec section.  Bug #975.</changelog>
  <changelog author="yaroslav.kurlaev@gmail.com" date="1626091200">- Fix LC_TIME incorrectly named LC_ATIME</changelog>
  <changelog author="yaroslav.kurlaev@gmail.com" date="1626091201">- Fix commented out "Defaults env_keep" in sudo-sudoers.patch</changelog>
  <changelog author="peter@czanik.hu" date="1627646400">- update to 1.9.7p2
- enabled openssl support for secure central session
  recording collection (without it's clear text)
- fixed SLES12 build
  * When formatting JSON output, octal numbers are now stored as
  strings, not numbers.  The JSON spec does not actually support
  octal numbers with a '0' prefix.
  * Fixed a compilation issue on Solaris 9.
  * Sudo now can handle the getgroups() function returning a different
  number of groups for subsequent invocations.  GitHub PR #106.
  * When loading a Python plugin, python_plugin.so now verifies
  that the module loaded matches the one we tried to load.  This
  allows sudo to display a more useful error message when trying
  to load a plugin with a name that conflicts with a Python module
  installed in the system location.
  * Sudo no longer sets the the open files resource limit to "unlimited"
  while it runs.  This avoids a problem where sudo's closefrom()
  emulation would need to close a very large number of descriptors
  on systems without a way to determine which ones are actually open.
  * Sudo now includes a configure check for va_copy or __va_copy and
  only defines its own version if the configure test fails.
  * Fixed a bug in sudo's utmp file handling which prevented old
  entries from being reused.  As a result, the utmp (or utmpx)
  file was appended to unnecessarily.  GitHub PR #108.
  * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd
  from accepting TLS connections when OpenSSL is used.  Bug #988.
  * Fixed an SELinux sudoedit bug when the edited temporary file
  could not be opened.  The sesh helper would still be run even
  when there are no temporary files available to install.
  * Fixed a compilation problem on FreeBSD.
  * The sudo_noexec.so file is now built as a module on all systems
  other than macOS.  This makes it possible to use other libtool
  implementations such as slibtool.  On macOS shared libraries and
  modules are not interchangeable and the version of libtool shipped
  with sudo must be used.
  * Fixed a few bugs in the getgrouplist() emulation on Solaris when
  reading from the local group file.
  * Fixed a bug in sudo_logsrvd that prevented periodic relay server
  connection retries from occurring in "store_first" mode.
  * Disabled the nss_search()-based getgrouplist() emulation on HP-UX
  due to a crash when the group source is set to "compat" in
  /etc/nsswitch.conf.  This is probably due to a mismatch between
  include/compat/nss_dbdefs.h and what HP-UX uses internally.  On
  HP-UX we now just cycle through groups the slow way using
  getgrent().  Bug #978.</changelog>
  <changelog author="kstreitova@suse.com" date="1632312000">- update to 1.9.8p2
  * Fixed a potential out-of-bounds read with "sudo -i" when the
    target user's shell is bash.  This is a regression introduced
    in sudo 1.9.8.  Bug #998.
  * sudo_logsrvd now only sends a log ID for first command of a session.
    There is no need to send the log ID for each sub-command.
  * Fixed a few minor memory leaks in intercept mode.
  * Fixed a problem with sudo_logsrvd in relay mode if "store_first"
    was enabled when handling sub-commands.  A new zero-length journal
    file was created for each sub-command instead of simply using
    the existing journal file.
- update to 1.9.8p1
  * Fixed support for passing a prompt (sudo -p) or a login class
    (sudo -l) on the command line.  This is a regression introduced
    in sudo 1.9.8.  Bug #993.
  * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends.
    This is a regression introduced in sudo 1.9.8.  Bug #994.
  * Fixed a compilation error when the --enable-static-sudoers configure
    option was specified.  This is a regression introduced in sudo
    1.9.8 caused by a symbol clash with the intercept and log server
    protobuf functions.
  * It is now possible to transparently intercepting sub-commands
    executed by the original command run via sudo.  Intercept support
    is implemented using LD_PRELOAD (or the equivalent supported by
    the system) and so has some limitations.  The two main limitations
    are that only dynamic executables are supported and only the
    execl, execle, execlp, execv, execve, execvp, and execvpe library
    functions are currently intercepted. Its main use case is to
    support restricting privileged shells run via sudo.
    To support this, there is a new "intercept" Defaults setting and
    an INTERCEPT command tag that can be used in sudoers.  For example:
    Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh
    Defaults!SHELLS intercept
    would cause sudo to run the listed shells in intercept mode.
    This can also be set on a per-rule basis.  For example:
    Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh
    chuck ALL = INTERCEPT: SHELLS
    would only apply intercept mode to user "chuck" when running one
    of the listed shells.
    In intercept mode, sudo will not prompt for a password before
    running a sub-command and will not allow a set-user-ID or
    set-group-ID program to be run by default.  The new
    intercept_authenticate and intercept_allow_setid sudoers settings
    can be used to change this behavior.
  * The new "log_subcmds" sudoers setting can be used to log additional
    commands run in a privileged shell.  It uses the same mechanism as
    the intercept support described above and has the same limitations.
  * The new "log_exit_status" sudoers setting can be used to log
    the exit status commands run via sudo.  This is also a corresponding
    "log_exit" setting in the sudo_logsrvd.conf eventlog stanza.
  * Support for logging sudo_logsrvd errors via syslog or to a file.
    Previously, most sudo_logsrvd errors were only visible in the
    debug log.
  * Better diagnostics when there is a TLS certificate validation error.
  * Using the "+=" or "-=" operators in a Defaults setting that takes
    a string, not a list, now produces a warning from sudo and a
    syntax error from inside visudo.
  * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd
    had no effect when creating I/O log parent directories if the I/O log
    file name ended with the string "XXXXXX".
  * Fixed a bug in the sudoers custom prompt code where the size
    parameter that was passed to the strlcpy() function was incorrect.
    No overflow was possible since the correct amount of memory was
    already pre-allocated.
  * The mksigname and mksiglist helper programs are now built with
    the host compiler, not the target compiler, when cross-compiling.
    Bug #989.
  * Fixed compilation error when the --enable-static-sudoers configure
    option was specified.  This was due to a typo introduced in sudo
    1.9.7.  GitHub PR #113.
- pack /usr/libexec/sudo/sudo/sudo_intercept.so</changelog>
  <changelog author="sflees@suse.de" date="1643284800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch</changelog>
  <changelog author="simonf.lees@suse.com" date="1643716800">- Update to 1.9.9
  * Sudo can now be built with OpenSSL 3.0 without generating
    warnings about deprecated OpenSSL APIs.
  * A digest can now be specified along with the ALL command in
    the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for
    this in the sudoers file but did not include corresponding
    changes for the other back-ends.
  * visudo now only warns about an undefined alias or a cycle in
    an alias once for each alias.
  * The sudoRole cn was truncated by a single character in warning
    messages. GitHub issue #115.
  * The cvtsudoers utility has new --group-file and --passwd-file
    options to use a custom passwd or group file when the
  - -match-local option is also used.
  * The cvtsudoers utility can now filter or match based on a command.
  * The cvtsudoers utility can now produce output in csv
    (comma-separated value) format. This can be used to help generate
    entitlement reports.
  * Fixed a bug in sudo_logsrvd that could result in the connection
    being dropped for very long command lines.
  * Fixed a bug where sudo_logsrvd would not accept a restore point
    of zero.
  * Fixed a bug in visudo where the value of the editor setting was
    not used if it did not match the user?s EDITOR environment
    variable. This was only a problem if the env_editor setting was
    not enabled. Bug #1000.
  * Sudo now builds with the -fcf-protection compiler option and the
  - z now linker option if supported.
  * The output of sudoreplay -l now more closely matches the
    traditional sudo log format.
  * The sudo_sendlog utility will now use the full contents of the
    log.json file, if present. This makes it possible to send
    sudo-format I/O logs that use the newer log.json format to
    sudo_logsrvd without losing any information.
  * Fixed compilation of the arc4random_buf() replacement on systems
    with arc4random() but no arc4random_buf(). Bug #1008.
  * Sudo now uses its own getentropy() by default on Linux. The GNU
    libc version of getentropy() will fail on older kernels that
    don?t support the getrandom() system call.
  * It is now possible to build sudo with WolfSSL?s OpenSSL
    compatibility layer by using the --enable-wolfssl configure
    option.
  * Fixed a bug related to Daylight Saving Time when parsing
    timestamps in Generalized Time format. This affected the NOTBEFORE
    and NOTAFTER options in sudoers. Bug #1006.
  * Added the -O and -P options to visudo, which can be used to check
    or set the owner and permissions. This can be used in conjunction
    with the -c option to check that the sudoers file ownership and
    permissions are correct. Bug #1007.
  * It is now possible to set resource limits in the sudoers file
    itself. The special values default and ?user? refer to the
    default system limit and invoking user limit respectively. The
    core dump size limit is now set to 0 by default unless overridden
    by the sudoers file.
  * The cvtsudoers utility can now merge multiple sudoers sources into
    a single, combined sudoers file. If there are conflicting entries,
    cvtsudoers will attempt to resolve them but manual intervention
    may be required. The merging of sudoers rules is currently fairly
    simplistic but will be improved in a future release.
  * Sudo was parsing but not applying the ?deref? and ?tls_reqcert?
    ldap.conf settings. This meant the options were effectively ignored
    which broke dereferencing of aliases in LDAP. Bug #1013.
  * Clarified in the sudo man page that the security policy may
    override the user?s PATH environment variable. Bug #1014.
  * When sudo is run in non-interactive mode (with the -n option), it
    will now attempt PAM authentication and only exit with an error if
    user interaction is required. This allows PAM modules that don?t
    interact with the user to succeed. Previously, sudo would not
    attempt authentication if the -n option was specified. Bug #956
    and GitHub issue #83.
  * Fixed a regression introduced in version 1.9.1 when sudo is built
    with the --with-fqdn configure option. The local host name was
    being resolved before the sudoers file was processed, making it
    impossible to disable DNS lookups by negating the fqdn sudoers
    option. Bug #1016.
  * Added support for negated sudoUser attributes in the LDAP and SSSD
    sudoers back ends. A matching sudoUser that is negated will cause
    the sudoRole containing it to be ignored.
  * Fixed a bug where the stack resource limit could be set to a value
    smaller than that of the invoking user and not be reset before the
    command was run. Bug #1016.
- sudo no longer ships schema for LDAP.
- sudo-feature-negated-LDAP-users.patch dropped, included upstream
- refreshed sudo-sudoers.patch</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.9-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1662811200">- Modified sudo-sudoers.patch
  * bsc#1177578
  * Removed redundant and confusing 'secure_path' settings in
    sudo-sudoers file.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1669032000">- Added sudo-utf8-ldap-schema.patch
  * Change sudo-ldap schema from ASCII to UTF8.
  * Fixes bsc#1197998
  * Credit to William Brown &lt;william.brown@suse.com&gt;
  * https://github.com/sudo-project/sudo/pull/163</changelog>
  <changelog author="jsikes@suse.com" date="1673870400">- Added sudo-CVE-2023-22809.patch
  * CVE-2023-22809
  * bsc#1207082
  * Prevent '--' in the EDITOR environment variable which can allow
    users to edit sensitive files as root.</changelog>
</package>
<package pkgid="e889b90270073531904140d29728500709663e5284d450b364e69287abbc1793" name="sudo" arch="src">
  <version epoch="0" ver="1.9.9" rel="150400.4.12.1"/>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="dmueller@suse.com" date="1616241600">- update to 1.9.6p1
  * Fixed a regression introduced in sudo 1.9.6 that resulted in an
  error message instead of a usage message when sudo is run with
  no arguments.
  * Fixed a sudo_sendlog compilation problem with the AIX xlC compiler.
  * Fixed a regression introduced in sudo 1.9.4 where the
  - -disable-root-mailer configure option had no effect.
  * Added a --disable-leaks configure option that avoids some
  memory leaks on exit that would otherwise occur.  This is intended
  to be used with development tools that measure memory leaks.  It
  is not safe to use in production at this time.
  * Plugged some memory leaks identified by oss-fuzz and ASAN.
  * Fixed the handling of sudoOptions for an LDAP sudoRole that
  contains multiple sudoCommands.  Previously, some of the options
  would only be applied to the first sudoCommand.
  * Fixed a potential out of bounds read in the parsing of NOTBEFORE
  and NOTAFTER sudoers command options (and their LDAP equivalents).
  * The parser used for reading I/O log JSON files is now more
  resilient when processing invalid JSON.
  * Fixed typos that prevented "make uninstall" from working.
  * Fixed a regression introduced in sudo 1.9.4 where the last line
  in a sudoers file might not have a terminating NUL character
  added if no newline was present.
  * Integrated oss-fuzz and LLVM's libFuzzer with sudo.  The new
  - -enable-fuzzer configure option can be combined with the
  - -enable-sanitizer option to build sudo with fuzzing support.
  Multiple fuzz targets are available for fuzzing different parts
  of sudo.  Fuzzers are built and tested via "make fuzz" or as part
  of "make check" (even when sudo is not built with fuzzing support).
  Fuzzing support currently requires the LLVM clang compiler (not gcc).
  * Fixed the --enable-static-sudoers configure option.
  * Fixed a potential out of bounds read sudo when is run by a user
  with more groups than the value of "max_groups" in sudo.conf.
  * Added an "admin_flag" sudoers option to make the use of the
  ~/.sudo_as_admin_successful file configurable on systems where
  sudo is build with the --enable-admin-flag configure option.
  This mostly affects Ubuntu and its derivatives.
  * The "max_groups" setting in sudo.conf is now limited to 1024.
  This setting is obsolete and should no longer be needed.
  * Fixed a bug in the tilde expansion of "CHROOT=dir" and "CWD=dir"
  sudoers command options.  A path "~/foo" was expanded to
  "/home/userfoo" instead of "/home/user/foo".  This also affects
  the runchroot and runcwd Defaults settings.
  * Fixed a bug on systems without a native getdelim(3) function
  where very long lines could cause parsing of the sudoers file
  to end prematurely.
  * Fixed a potential integer overflow when converting the
  timestamp_timeout and passwd_timeout sudoers settings to a
  timespec struct.
  * The default for the "group_source" setting in sudo.conf is now
  "dynamic" on macOS.  Recent versions of macOS do not reliably
  return all of a user's non-local groups via getgroups(2), even
  when _DARWIN_UNLIMITED_GETGROUPS is defined.
  * Fixed a potential use-after-free in the PAM conversation function.
  * Fixed potential redefinition of sys/stat.h macros in sudo_compat.h.</changelog>
  <changelog author="kstreitova@suse.com" date="1620820800">- update to 1.9.7
  * The "fuzz" Makefile target now runs all the fuzzers for 8192
    passes (can be overridden via the FUZZ_RUNS variable).  This makes
    it easier to run the fuzzers in-tree.  To run a fuzzer indefinitely,
    set FUZZ_RUNS=-1, e.g. "make FUZZ_RUNS=-1 fuzz".
  * Fixed fuzzing on FreeBSD where the ld.lld linker returns an
    error by default when a symbol is multiply-defined.
  * Added support for determining local IPv6 addresses on systems
    that lack the getifaddrs() function.  This now works on AIX,
    HP-UX and Solaris (at least).  Bug #969.
  * Fixed a bug introduced in sudo 1.9.6 that caused "sudo -V" to
    report a usage error.  Also, when invoked as sudoedit, sudo now
    allows a more restricted set of options that matches the usage
    statement and documentation.  GitHub issue #95.
  * Fixed a crash in sudo_sendlog when the specified certificate
    or key does not exist or is invalid.  Bug #970
  * Fixed a compilation error when sudo is configured with the
  - -disable-log-client option.
  * Sudo's limited support for SUCCESS=return entries in nsswitch.conf
    is now documented.  Bug #971.
  * Sudo now requires autoconf 2.70 or higher to regenerate the
    configure script.  Bug #972.
  * sudo_logsrvd now has a relay mode which can be used to create
    a hierarchy of log servers.  By default, when a relay server is
    defined, messages from the client are forwarded immediately to
    the relay.  However, if the "store_first" setting is enabled,
    the log will be stored locally until the command completes and
    then relayed.  Bug #965.
  * Sudo now links with OpenSSL by default if it is available unless
    the --disable-openssl configure option is used or both the
  - -disable-log-client and --disable-log-server configure options
    are specified.
  * Fixed configure's Python version detection when the version minor
    number is more than a single digit, for example Python 3.10.
  * The sudo Python module tests now pass for Python 3.10.
  * Sudo will now avoid changing the datasize resource limit
    as long as the existing value is at least 1GB.  This works around
    a problem on 64-bit HP-UX where it is not possible to exactly
    restore the original datasize limit.  Bug #973.
  * Fixed a race condition that could result in a hang when sudo is
    executed by a process where the SIGCHLD handler is set to SIG_IGN.
    This fixes the bug described by GitHub PR #98.
  * Fixed an out-of-bounds read in sudoedit and visudo when the
    EDITOR, VISUAL or SUDO_EDITOR environment variables end in an
    unescaped backslash.  Also fixed the handling of quote characters
    that are escaped by a backslash.  GitHub issue #99.
  * Fixed a bug that prevented the "log_server_verify" sudoers option
    from taking effect.
  * The sudo_sendlog utility has a new -s option to cause it to stop
    sending I/O records after a user-specified elapsed time.  This
    can be used to test the I/O log restart functionality of sudo_logsrvd.
  * Fixed a crash introduced in sudo 1.9.4 in sudo_logsrvd when
    attempting to restart an interrupted I/O log transfer.
  * The TLS connection timeout in the sudoers log client was previously
    hard-coded to 10 seconds.  It now uses the value of log_server_timeout.
  * The configure script now outputs a summary of the user-configurable
    options at the end, separate from output of configure script tests.
    Bug #820.
  * Corrected the description of which groups may be specified via the
  - g option in the Runas_Spec section.  Bug #975.</changelog>
  <changelog author="yaroslav.kurlaev@gmail.com" date="1626091200">- Fix LC_TIME incorrectly named LC_ATIME</changelog>
  <changelog author="yaroslav.kurlaev@gmail.com" date="1626091201">- Fix commented out "Defaults env_keep" in sudo-sudoers.patch</changelog>
  <changelog author="peter@czanik.hu" date="1627646400">- update to 1.9.7p2
- enabled openssl support for secure central session
  recording collection (without it's clear text)
- fixed SLES12 build
  * When formatting JSON output, octal numbers are now stored as
  strings, not numbers.  The JSON spec does not actually support
  octal numbers with a '0' prefix.
  * Fixed a compilation issue on Solaris 9.
  * Sudo now can handle the getgroups() function returning a different
  number of groups for subsequent invocations.  GitHub PR #106.
  * When loading a Python plugin, python_plugin.so now verifies
  that the module loaded matches the one we tried to load.  This
  allows sudo to display a more useful error message when trying
  to load a plugin with a name that conflicts with a Python module
  installed in the system location.
  * Sudo no longer sets the the open files resource limit to "unlimited"
  while it runs.  This avoids a problem where sudo's closefrom()
  emulation would need to close a very large number of descriptors
  on systems without a way to determine which ones are actually open.
  * Sudo now includes a configure check for va_copy or __va_copy and
  only defines its own version if the configure test fails.
  * Fixed a bug in sudo's utmp file handling which prevented old
  entries from being reused.  As a result, the utmp (or utmpx)
  file was appended to unnecessarily.  GitHub PR #108.
  * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd
  from accepting TLS connections when OpenSSL is used.  Bug #988.
  * Fixed an SELinux sudoedit bug when the edited temporary file
  could not be opened.  The sesh helper would still be run even
  when there are no temporary files available to install.
  * Fixed a compilation problem on FreeBSD.
  * The sudo_noexec.so file is now built as a module on all systems
  other than macOS.  This makes it possible to use other libtool
  implementations such as slibtool.  On macOS shared libraries and
  modules are not interchangeable and the version of libtool shipped
  with sudo must be used.
  * Fixed a few bugs in the getgrouplist() emulation on Solaris when
  reading from the local group file.
  * Fixed a bug in sudo_logsrvd that prevented periodic relay server
  connection retries from occurring in "store_first" mode.
  * Disabled the nss_search()-based getgrouplist() emulation on HP-UX
  due to a crash when the group source is set to "compat" in
  /etc/nsswitch.conf.  This is probably due to a mismatch between
  include/compat/nss_dbdefs.h and what HP-UX uses internally.  On
  HP-UX we now just cycle through groups the slow way using
  getgrent().  Bug #978.</changelog>
  <changelog author="kstreitova@suse.com" date="1632312000">- update to 1.9.8p2
  * Fixed a potential out-of-bounds read with "sudo -i" when the
    target user's shell is bash.  This is a regression introduced
    in sudo 1.9.8.  Bug #998.
  * sudo_logsrvd now only sends a log ID for first command of a session.
    There is no need to send the log ID for each sub-command.
  * Fixed a few minor memory leaks in intercept mode.
  * Fixed a problem with sudo_logsrvd in relay mode if "store_first"
    was enabled when handling sub-commands.  A new zero-length journal
    file was created for each sub-command instead of simply using
    the existing journal file.
- update to 1.9.8p1
  * Fixed support for passing a prompt (sudo -p) or a login class
    (sudo -l) on the command line.  This is a regression introduced
    in sudo 1.9.8.  Bug #993.
  * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends.
    This is a regression introduced in sudo 1.9.8.  Bug #994.
  * Fixed a compilation error when the --enable-static-sudoers configure
    option was specified.  This is a regression introduced in sudo
    1.9.8 caused by a symbol clash with the intercept and log server
    protobuf functions.
  * It is now possible to transparently intercepting sub-commands
    executed by the original command run via sudo.  Intercept support
    is implemented using LD_PRELOAD (or the equivalent supported by
    the system) and so has some limitations.  The two main limitations
    are that only dynamic executables are supported and only the
    execl, execle, execlp, execv, execve, execvp, and execvpe library
    functions are currently intercepted. Its main use case is to
    support restricting privileged shells run via sudo.
    To support this, there is a new "intercept" Defaults setting and
    an INTERCEPT command tag that can be used in sudoers.  For example:
    Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh
    Defaults!SHELLS intercept
    would cause sudo to run the listed shells in intercept mode.
    This can also be set on a per-rule basis.  For example:
    Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh
    chuck ALL = INTERCEPT: SHELLS
    would only apply intercept mode to user "chuck" when running one
    of the listed shells.
    In intercept mode, sudo will not prompt for a password before
    running a sub-command and will not allow a set-user-ID or
    set-group-ID program to be run by default.  The new
    intercept_authenticate and intercept_allow_setid sudoers settings
    can be used to change this behavior.
  * The new "log_subcmds" sudoers setting can be used to log additional
    commands run in a privileged shell.  It uses the same mechanism as
    the intercept support described above and has the same limitations.
  * The new "log_exit_status" sudoers setting can be used to log
    the exit status commands run via sudo.  This is also a corresponding
    "log_exit" setting in the sudo_logsrvd.conf eventlog stanza.
  * Support for logging sudo_logsrvd errors via syslog or to a file.
    Previously, most sudo_logsrvd errors were only visible in the
    debug log.
  * Better diagnostics when there is a TLS certificate validation error.
  * Using the "+=" or "-=" operators in a Defaults setting that takes
    a string, not a list, now produces a warning from sudo and a
    syntax error from inside visudo.
  * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd
    had no effect when creating I/O log parent directories if the I/O log
    file name ended with the string "XXXXXX".
  * Fixed a bug in the sudoers custom prompt code where the size
    parameter that was passed to the strlcpy() function was incorrect.
    No overflow was possible since the correct amount of memory was
    already pre-allocated.
  * The mksigname and mksiglist helper programs are now built with
    the host compiler, not the target compiler, when cross-compiling.
    Bug #989.
  * Fixed compilation error when the --enable-static-sudoers configure
    option was specified.  This was due to a typo introduced in sudo
    1.9.7.  GitHub PR #113.
- pack /usr/libexec/sudo/sudo/sudo_intercept.so</changelog>
  <changelog author="sflees@suse.de" date="1643284800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch</changelog>
  <changelog author="simonf.lees@suse.com" date="1643716800">- Update to 1.9.9
  * Sudo can now be built with OpenSSL 3.0 without generating
    warnings about deprecated OpenSSL APIs.
  * A digest can now be specified along with the ALL command in
    the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for
    this in the sudoers file but did not include corresponding
    changes for the other back-ends.
  * visudo now only warns about an undefined alias or a cycle in
    an alias once for each alias.
  * The sudoRole cn was truncated by a single character in warning
    messages. GitHub issue #115.
  * The cvtsudoers utility has new --group-file and --passwd-file
    options to use a custom passwd or group file when the
  - -match-local option is also used.
  * The cvtsudoers utility can now filter or match based on a command.
  * The cvtsudoers utility can now produce output in csv
    (comma-separated value) format. This can be used to help generate
    entitlement reports.
  * Fixed a bug in sudo_logsrvd that could result in the connection
    being dropped for very long command lines.
  * Fixed a bug where sudo_logsrvd would not accept a restore point
    of zero.
  * Fixed a bug in visudo where the value of the editor setting was
    not used if it did not match the user?s EDITOR environment
    variable. This was only a problem if the env_editor setting was
    not enabled. Bug #1000.
  * Sudo now builds with the -fcf-protection compiler option and the
  - z now linker option if supported.
  * The output of sudoreplay -l now more closely matches the
    traditional sudo log format.
  * The sudo_sendlog utility will now use the full contents of the
    log.json file, if present. This makes it possible to send
    sudo-format I/O logs that use the newer log.json format to
    sudo_logsrvd without losing any information.
  * Fixed compilation of the arc4random_buf() replacement on systems
    with arc4random() but no arc4random_buf(). Bug #1008.
  * Sudo now uses its own getentropy() by default on Linux. The GNU
    libc version of getentropy() will fail on older kernels that
    don?t support the getrandom() system call.
  * It is now possible to build sudo with WolfSSL?s OpenSSL
    compatibility layer by using the --enable-wolfssl configure
    option.
  * Fixed a bug related to Daylight Saving Time when parsing
    timestamps in Generalized Time format. This affected the NOTBEFORE
    and NOTAFTER options in sudoers. Bug #1006.
  * Added the -O and -P options to visudo, which can be used to check
    or set the owner and permissions. This can be used in conjunction
    with the -c option to check that the sudoers file ownership and
    permissions are correct. Bug #1007.
  * It is now possible to set resource limits in the sudoers file
    itself. The special values default and ?user? refer to the
    default system limit and invoking user limit respectively. The
    core dump size limit is now set to 0 by default unless overridden
    by the sudoers file.
  * The cvtsudoers utility can now merge multiple sudoers sources into
    a single, combined sudoers file. If there are conflicting entries,
    cvtsudoers will attempt to resolve them but manual intervention
    may be required. The merging of sudoers rules is currently fairly
    simplistic but will be improved in a future release.
  * Sudo was parsing but not applying the ?deref? and ?tls_reqcert?
    ldap.conf settings. This meant the options were effectively ignored
    which broke dereferencing of aliases in LDAP. Bug #1013.
  * Clarified in the sudo man page that the security policy may
    override the user?s PATH environment variable. Bug #1014.
  * When sudo is run in non-interactive mode (with the -n option), it
    will now attempt PAM authentication and only exit with an error if
    user interaction is required. This allows PAM modules that don?t
    interact with the user to succeed. Previously, sudo would not
    attempt authentication if the -n option was specified. Bug #956
    and GitHub issue #83.
  * Fixed a regression introduced in version 1.9.1 when sudo is built
    with the --with-fqdn configure option. The local host name was
    being resolved before the sudoers file was processed, making it
    impossible to disable DNS lookups by negating the fqdn sudoers
    option. Bug #1016.
  * Added support for negated sudoUser attributes in the LDAP and SSSD
    sudoers back ends. A matching sudoUser that is negated will cause
    the sudoRole containing it to be ignored.
  * Fixed a bug where the stack resource limit could be set to a value
    smaller than that of the invoking user and not be reset before the
    command was run. Bug #1016.
- sudo no longer ships schema for LDAP.
- sudo-feature-negated-LDAP-users.patch dropped, included upstream
- refreshed sudo-sudoers.patch</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.9-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1662811200">- Modified sudo-sudoers.patch
  * bsc#1177578
  * Removed redundant and confusing 'secure_path' settings in
    sudo-sudoers file.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1669032000">- Added sudo-utf8-ldap-schema.patch
  * Change sudo-ldap schema from ASCII to UTF8.
  * Fixes bsc#1197998
  * Credit to William Brown &lt;william.brown@suse.com&gt;
  * https://github.com/sudo-project/sudo/pull/163</changelog>
  <changelog author="jsikes@suse.com" date="1673870400">- Added sudo-CVE-2023-22809.patch
  * CVE-2023-22809
  * bsc#1207082
  * Prevent '--' in the EDITOR environment variable which can allow
    users to edit sensitive files as root.</changelog>
</package>
<package pkgid="fbfc52db895bc8e04fcb4ed2ecac67d0f1a5cec1d5b4c852b4d20f2c45dcd6b9" name="sudo" arch="x86_64">
  <version epoch="0" ver="1.9.9" rel="150400.4.12.1"/>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="dmueller@suse.com" date="1616241600">- update to 1.9.6p1
  * Fixed a regression introduced in sudo 1.9.6 that resulted in an
  error message instead of a usage message when sudo is run with
  no arguments.
  * Fixed a sudo_sendlog compilation problem with the AIX xlC compiler.
  * Fixed a regression introduced in sudo 1.9.4 where the
  - -disable-root-mailer configure option had no effect.
  * Added a --disable-leaks configure option that avoids some
  memory leaks on exit that would otherwise occur.  This is intended
  to be used with development tools that measure memory leaks.  It
  is not safe to use in production at this time.
  * Plugged some memory leaks identified by oss-fuzz and ASAN.
  * Fixed the handling of sudoOptions for an LDAP sudoRole that
  contains multiple sudoCommands.  Previously, some of the options
  would only be applied to the first sudoCommand.
  * Fixed a potential out of bounds read in the parsing of NOTBEFORE
  and NOTAFTER sudoers command options (and their LDAP equivalents).
  * The parser used for reading I/O log JSON files is now more
  resilient when processing invalid JSON.
  * Fixed typos that prevented "make uninstall" from working.
  * Fixed a regression introduced in sudo 1.9.4 where the last line
  in a sudoers file might not have a terminating NUL character
  added if no newline was present.
  * Integrated oss-fuzz and LLVM's libFuzzer with sudo.  The new
  - -enable-fuzzer configure option can be combined with the
  - -enable-sanitizer option to build sudo with fuzzing support.
  Multiple fuzz targets are available for fuzzing different parts
  of sudo.  Fuzzers are built and tested via "make fuzz" or as part
  of "make check" (even when sudo is not built with fuzzing support).
  Fuzzing support currently requires the LLVM clang compiler (not gcc).
  * Fixed the --enable-static-sudoers configure option.
  * Fixed a potential out of bounds read sudo when is run by a user
  with more groups than the value of "max_groups" in sudo.conf.
  * Added an "admin_flag" sudoers option to make the use of the
  ~/.sudo_as_admin_successful file configurable on systems where
  sudo is build with the --enable-admin-flag configure option.
  This mostly affects Ubuntu and its derivatives.
  * The "max_groups" setting in sudo.conf is now limited to 1024.
  This setting is obsolete and should no longer be needed.
  * Fixed a bug in the tilde expansion of "CHROOT=dir" and "CWD=dir"
  sudoers command options.  A path "~/foo" was expanded to
  "/home/userfoo" instead of "/home/user/foo".  This also affects
  the runchroot and runcwd Defaults settings.
  * Fixed a bug on systems without a native getdelim(3) function
  where very long lines could cause parsing of the sudoers file
  to end prematurely.
  * Fixed a potential integer overflow when converting the
  timestamp_timeout and passwd_timeout sudoers settings to a
  timespec struct.
  * The default for the "group_source" setting in sudo.conf is now
  "dynamic" on macOS.  Recent versions of macOS do not reliably
  return all of a user's non-local groups via getgroups(2), even
  when _DARWIN_UNLIMITED_GETGROUPS is defined.
  * Fixed a potential use-after-free in the PAM conversation function.
  * Fixed potential redefinition of sys/stat.h macros in sudo_compat.h.</changelog>
  <changelog author="kstreitova@suse.com" date="1620820800">- update to 1.9.7
  * The "fuzz" Makefile target now runs all the fuzzers for 8192
    passes (can be overridden via the FUZZ_RUNS variable).  This makes
    it easier to run the fuzzers in-tree.  To run a fuzzer indefinitely,
    set FUZZ_RUNS=-1, e.g. "make FUZZ_RUNS=-1 fuzz".
  * Fixed fuzzing on FreeBSD where the ld.lld linker returns an
    error by default when a symbol is multiply-defined.
  * Added support for determining local IPv6 addresses on systems
    that lack the getifaddrs() function.  This now works on AIX,
    HP-UX and Solaris (at least).  Bug #969.
  * Fixed a bug introduced in sudo 1.9.6 that caused "sudo -V" to
    report a usage error.  Also, when invoked as sudoedit, sudo now
    allows a more restricted set of options that matches the usage
    statement and documentation.  GitHub issue #95.
  * Fixed a crash in sudo_sendlog when the specified certificate
    or key does not exist or is invalid.  Bug #970
  * Fixed a compilation error when sudo is configured with the
  - -disable-log-client option.
  * Sudo's limited support for SUCCESS=return entries in nsswitch.conf
    is now documented.  Bug #971.
  * Sudo now requires autoconf 2.70 or higher to regenerate the
    configure script.  Bug #972.
  * sudo_logsrvd now has a relay mode which can be used to create
    a hierarchy of log servers.  By default, when a relay server is
    defined, messages from the client are forwarded immediately to
    the relay.  However, if the "store_first" setting is enabled,
    the log will be stored locally until the command completes and
    then relayed.  Bug #965.
  * Sudo now links with OpenSSL by default if it is available unless
    the --disable-openssl configure option is used or both the
  - -disable-log-client and --disable-log-server configure options
    are specified.
  * Fixed configure's Python version detection when the version minor
    number is more than a single digit, for example Python 3.10.
  * The sudo Python module tests now pass for Python 3.10.
  * Sudo will now avoid changing the datasize resource limit
    as long as the existing value is at least 1GB.  This works around
    a problem on 64-bit HP-UX where it is not possible to exactly
    restore the original datasize limit.  Bug #973.
  * Fixed a race condition that could result in a hang when sudo is
    executed by a process where the SIGCHLD handler is set to SIG_IGN.
    This fixes the bug described by GitHub PR #98.
  * Fixed an out-of-bounds read in sudoedit and visudo when the
    EDITOR, VISUAL or SUDO_EDITOR environment variables end in an
    unescaped backslash.  Also fixed the handling of quote characters
    that are escaped by a backslash.  GitHub issue #99.
  * Fixed a bug that prevented the "log_server_verify" sudoers option
    from taking effect.
  * The sudo_sendlog utility has a new -s option to cause it to stop
    sending I/O records after a user-specified elapsed time.  This
    can be used to test the I/O log restart functionality of sudo_logsrvd.
  * Fixed a crash introduced in sudo 1.9.4 in sudo_logsrvd when
    attempting to restart an interrupted I/O log transfer.
  * The TLS connection timeout in the sudoers log client was previously
    hard-coded to 10 seconds.  It now uses the value of log_server_timeout.
  * The configure script now outputs a summary of the user-configurable
    options at the end, separate from output of configure script tests.
    Bug #820.
  * Corrected the description of which groups may be specified via the
  - g option in the Runas_Spec section.  Bug #975.</changelog>
  <changelog author="yaroslav.kurlaev@gmail.com" date="1626091200">- Fix LC_TIME incorrectly named LC_ATIME</changelog>
  <changelog author="yaroslav.kurlaev@gmail.com" date="1626091201">- Fix commented out "Defaults env_keep" in sudo-sudoers.patch</changelog>
  <changelog author="peter@czanik.hu" date="1627646400">- update to 1.9.7p2
- enabled openssl support for secure central session
  recording collection (without it's clear text)
- fixed SLES12 build
  * When formatting JSON output, octal numbers are now stored as
  strings, not numbers.  The JSON spec does not actually support
  octal numbers with a '0' prefix.
  * Fixed a compilation issue on Solaris 9.
  * Sudo now can handle the getgroups() function returning a different
  number of groups for subsequent invocations.  GitHub PR #106.
  * When loading a Python plugin, python_plugin.so now verifies
  that the module loaded matches the one we tried to load.  This
  allows sudo to display a more useful error message when trying
  to load a plugin with a name that conflicts with a Python module
  installed in the system location.
  * Sudo no longer sets the the open files resource limit to "unlimited"
  while it runs.  This avoids a problem where sudo's closefrom()
  emulation would need to close a very large number of descriptors
  on systems without a way to determine which ones are actually open.
  * Sudo now includes a configure check for va_copy or __va_copy and
  only defines its own version if the configure test fails.
  * Fixed a bug in sudo's utmp file handling which prevented old
  entries from being reused.  As a result, the utmp (or utmpx)
  file was appended to unnecessarily.  GitHub PR #108.
  * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd
  from accepting TLS connections when OpenSSL is used.  Bug #988.
  * Fixed an SELinux sudoedit bug when the edited temporary file
  could not be opened.  The sesh helper would still be run even
  when there are no temporary files available to install.
  * Fixed a compilation problem on FreeBSD.
  * The sudo_noexec.so file is now built as a module on all systems
  other than macOS.  This makes it possible to use other libtool
  implementations such as slibtool.  On macOS shared libraries and
  modules are not interchangeable and the version of libtool shipped
  with sudo must be used.
  * Fixed a few bugs in the getgrouplist() emulation on Solaris when
  reading from the local group file.
  * Fixed a bug in sudo_logsrvd that prevented periodic relay server
  connection retries from occurring in "store_first" mode.
  * Disabled the nss_search()-based getgrouplist() emulation on HP-UX
  due to a crash when the group source is set to "compat" in
  /etc/nsswitch.conf.  This is probably due to a mismatch between
  include/compat/nss_dbdefs.h and what HP-UX uses internally.  On
  HP-UX we now just cycle through groups the slow way using
  getgrent().  Bug #978.</changelog>
  <changelog author="kstreitova@suse.com" date="1632312000">- update to 1.9.8p2
  * Fixed a potential out-of-bounds read with "sudo -i" when the
    target user's shell is bash.  This is a regression introduced
    in sudo 1.9.8.  Bug #998.
  * sudo_logsrvd now only sends a log ID for first command of a session.
    There is no need to send the log ID for each sub-command.
  * Fixed a few minor memory leaks in intercept mode.
  * Fixed a problem with sudo_logsrvd in relay mode if "store_first"
    was enabled when handling sub-commands.  A new zero-length journal
    file was created for each sub-command instead of simply using
    the existing journal file.
- update to 1.9.8p1
  * Fixed support for passing a prompt (sudo -p) or a login class
    (sudo -l) on the command line.  This is a regression introduced
    in sudo 1.9.8.  Bug #993.
  * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends.
    This is a regression introduced in sudo 1.9.8.  Bug #994.
  * Fixed a compilation error when the --enable-static-sudoers configure
    option was specified.  This is a regression introduced in sudo
    1.9.8 caused by a symbol clash with the intercept and log server
    protobuf functions.
  * It is now possible to transparently intercepting sub-commands
    executed by the original command run via sudo.  Intercept support
    is implemented using LD_PRELOAD (or the equivalent supported by
    the system) and so has some limitations.  The two main limitations
    are that only dynamic executables are supported and only the
    execl, execle, execlp, execv, execve, execvp, and execvpe library
    functions are currently intercepted. Its main use case is to
    support restricting privileged shells run via sudo.
    To support this, there is a new "intercept" Defaults setting and
    an INTERCEPT command tag that can be used in sudoers.  For example:
    Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh
    Defaults!SHELLS intercept
    would cause sudo to run the listed shells in intercept mode.
    This can also be set on a per-rule basis.  For example:
    Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh
    chuck ALL = INTERCEPT: SHELLS
    would only apply intercept mode to user "chuck" when running one
    of the listed shells.
    In intercept mode, sudo will not prompt for a password before
    running a sub-command and will not allow a set-user-ID or
    set-group-ID program to be run by default.  The new
    intercept_authenticate and intercept_allow_setid sudoers settings
    can be used to change this behavior.
  * The new "log_subcmds" sudoers setting can be used to log additional
    commands run in a privileged shell.  It uses the same mechanism as
    the intercept support described above and has the same limitations.
  * The new "log_exit_status" sudoers setting can be used to log
    the exit status commands run via sudo.  This is also a corresponding
    "log_exit" setting in the sudo_logsrvd.conf eventlog stanza.
  * Support for logging sudo_logsrvd errors via syslog or to a file.
    Previously, most sudo_logsrvd errors were only visible in the
    debug log.
  * Better diagnostics when there is a TLS certificate validation error.
  * Using the "+=" or "-=" operators in a Defaults setting that takes
    a string, not a list, now produces a warning from sudo and a
    syntax error from inside visudo.
  * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd
    had no effect when creating I/O log parent directories if the I/O log
    file name ended with the string "XXXXXX".
  * Fixed a bug in the sudoers custom prompt code where the size
    parameter that was passed to the strlcpy() function was incorrect.
    No overflow was possible since the correct amount of memory was
    already pre-allocated.
  * The mksigname and mksiglist helper programs are now built with
    the host compiler, not the target compiler, when cross-compiling.
    Bug #989.
  * Fixed compilation error when the --enable-static-sudoers configure
    option was specified.  This was due to a typo introduced in sudo
    1.9.7.  GitHub PR #113.
- pack /usr/libexec/sudo/sudo/sudo_intercept.so</changelog>
  <changelog author="sflees@suse.de" date="1643284800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch</changelog>
  <changelog author="simonf.lees@suse.com" date="1643716800">- Update to 1.9.9
  * Sudo can now be built with OpenSSL 3.0 without generating
    warnings about deprecated OpenSSL APIs.
  * A digest can now be specified along with the ALL command in
    the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for
    this in the sudoers file but did not include corresponding
    changes for the other back-ends.
  * visudo now only warns about an undefined alias or a cycle in
    an alias once for each alias.
  * The sudoRole cn was truncated by a single character in warning
    messages. GitHub issue #115.
  * The cvtsudoers utility has new --group-file and --passwd-file
    options to use a custom passwd or group file when the
  - -match-local option is also used.
  * The cvtsudoers utility can now filter or match based on a command.
  * The cvtsudoers utility can now produce output in csv
    (comma-separated value) format. This can be used to help generate
    entitlement reports.
  * Fixed a bug in sudo_logsrvd that could result in the connection
    being dropped for very long command lines.
  * Fixed a bug where sudo_logsrvd would not accept a restore point
    of zero.
  * Fixed a bug in visudo where the value of the editor setting was
    not used if it did not match the user?s EDITOR environment
    variable. This was only a problem if the env_editor setting was
    not enabled. Bug #1000.
  * Sudo now builds with the -fcf-protection compiler option and the
  - z now linker option if supported.
  * The output of sudoreplay -l now more closely matches the
    traditional sudo log format.
  * The sudo_sendlog utility will now use the full contents of the
    log.json file, if present. This makes it possible to send
    sudo-format I/O logs that use the newer log.json format to
    sudo_logsrvd without losing any information.
  * Fixed compilation of the arc4random_buf() replacement on systems
    with arc4random() but no arc4random_buf(). Bug #1008.
  * Sudo now uses its own getentropy() by default on Linux. The GNU
    libc version of getentropy() will fail on older kernels that
    don?t support the getrandom() system call.
  * It is now possible to build sudo with WolfSSL?s OpenSSL
    compatibility layer by using the --enable-wolfssl configure
    option.
  * Fixed a bug related to Daylight Saving Time when parsing
    timestamps in Generalized Time format. This affected the NOTBEFORE
    and NOTAFTER options in sudoers. Bug #1006.
  * Added the -O and -P options to visudo, which can be used to check
    or set the owner and permissions. This can be used in conjunction
    with the -c option to check that the sudoers file ownership and
    permissions are correct. Bug #1007.
  * It is now possible to set resource limits in the sudoers file
    itself. The special values default and ?user? refer to the
    default system limit and invoking user limit respectively. The
    core dump size limit is now set to 0 by default unless overridden
    by the sudoers file.
  * The cvtsudoers utility can now merge multiple sudoers sources into
    a single, combined sudoers file. If there are conflicting entries,
    cvtsudoers will attempt to resolve them but manual intervention
    may be required. The merging of sudoers rules is currently fairly
    simplistic but will be improved in a future release.
  * Sudo was parsing but not applying the ?deref? and ?tls_reqcert?
    ldap.conf settings. This meant the options were effectively ignored
    which broke dereferencing of aliases in LDAP. Bug #1013.
  * Clarified in the sudo man page that the security policy may
    override the user?s PATH environment variable. Bug #1014.
  * When sudo is run in non-interactive mode (with the -n option), it
    will now attempt PAM authentication and only exit with an error if
    user interaction is required. This allows PAM modules that don?t
    interact with the user to succeed. Previously, sudo would not
    attempt authentication if the -n option was specified. Bug #956
    and GitHub issue #83.
  * Fixed a regression introduced in version 1.9.1 when sudo is built
    with the --with-fqdn configure option. The local host name was
    being resolved before the sudoers file was processed, making it
    impossible to disable DNS lookups by negating the fqdn sudoers
    option. Bug #1016.
  * Added support for negated sudoUser attributes in the LDAP and SSSD
    sudoers back ends. A matching sudoUser that is negated will cause
    the sudoRole containing it to be ignored.
  * Fixed a bug where the stack resource limit could be set to a value
    smaller than that of the invoking user and not be reset before the
    command was run. Bug #1016.
- sudo no longer ships schema for LDAP.
- sudo-feature-negated-LDAP-users.patch dropped, included upstream
- refreshed sudo-sudoers.patch</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.9-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1662811200">- Modified sudo-sudoers.patch
  * bsc#1177578
  * Removed redundant and confusing 'secure_path' settings in
    sudo-sudoers file.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1669032000">- Added sudo-utf8-ldap-schema.patch
  * Change sudo-ldap schema from ASCII to UTF8.
  * Fixes bsc#1197998
  * Credit to William Brown &lt;william.brown@suse.com&gt;
  * https://github.com/sudo-project/sudo/pull/163</changelog>
  <changelog author="jsikes@suse.com" date="1673870400">- Added sudo-CVE-2023-22809.patch
  * CVE-2023-22809
  * bsc#1207082
  * Prevent '--' in the EDITOR environment variable which can allow
    users to edit sensitive files as root.</changelog>
</package>
<package pkgid="3d855585931006e45a5c3259ca6b2aaf1672cad74a2c1f8af3294d99d9ee078f" name="sudo" arch="aarch64">
  <version epoch="0" ver="1.9.9" rel="150400.4.9.1"/>
  <changelog author="olaf@aepfle.de" date="1598356800">- This rpm packages decides about the permissions of /etc/sudoers.d</changelog>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="dmueller@suse.com" date="1616241600">- update to 1.9.6p1
  * Fixed a regression introduced in sudo 1.9.6 that resulted in an
  error message instead of a usage message when sudo is run with
  no arguments.
  * Fixed a sudo_sendlog compilation problem with the AIX xlC compiler.
  * Fixed a regression introduced in sudo 1.9.4 where the
  - -disable-root-mailer configure option had no effect.
  * Added a --disable-leaks configure option that avoids some
  memory leaks on exit that would otherwise occur.  This is intended
  to be used with development tools that measure memory leaks.  It
  is not safe to use in production at this time.
  * Plugged some memory leaks identified by oss-fuzz and ASAN.
  * Fixed the handling of sudoOptions for an LDAP sudoRole that
  contains multiple sudoCommands.  Previously, some of the options
  would only be applied to the first sudoCommand.
  * Fixed a potential out of bounds read in the parsing of NOTBEFORE
  and NOTAFTER sudoers command options (and their LDAP equivalents).
  * The parser used for reading I/O log JSON files is now more
  resilient when processing invalid JSON.
  * Fixed typos that prevented "make uninstall" from working.
  * Fixed a regression introduced in sudo 1.9.4 where the last line
  in a sudoers file might not have a terminating NUL character
  added if no newline was present.
  * Integrated oss-fuzz and LLVM's libFuzzer with sudo.  The new
  - -enable-fuzzer configure option can be combined with the
  - -enable-sanitizer option to build sudo with fuzzing support.
  Multiple fuzz targets are available for fuzzing different parts
  of sudo.  Fuzzers are built and tested via "make fuzz" or as part
  of "make check" (even when sudo is not built with fuzzing support).
  Fuzzing support currently requires the LLVM clang compiler (not gcc).
  * Fixed the --enable-static-sudoers configure option.
  * Fixed a potential out of bounds read sudo when is run by a user
  with more groups than the value of "max_groups" in sudo.conf.
  * Added an "admin_flag" sudoers option to make the use of the
  ~/.sudo_as_admin_successful file configurable on systems where
  sudo is build with the --enable-admin-flag configure option.
  This mostly affects Ubuntu and its derivatives.
  * The "max_groups" setting in sudo.conf is now limited to 1024.
  This setting is obsolete and should no longer be needed.
  * Fixed a bug in the tilde expansion of "CHROOT=dir" and "CWD=dir"
  sudoers command options.  A path "~/foo" was expanded to
  "/home/userfoo" instead of "/home/user/foo".  This also affects
  the runchroot and runcwd Defaults settings.
  * Fixed a bug on systems without a native getdelim(3) function
  where very long lines could cause parsing of the sudoers file
  to end prematurely.
  * Fixed a potential integer overflow when converting the
  timestamp_timeout and passwd_timeout sudoers settings to a
  timespec struct.
  * The default for the "group_source" setting in sudo.conf is now
  "dynamic" on macOS.  Recent versions of macOS do not reliably
  return all of a user's non-local groups via getgroups(2), even
  when _DARWIN_UNLIMITED_GETGROUPS is defined.
  * Fixed a potential use-after-free in the PAM conversation function.
  * Fixed potential redefinition of sys/stat.h macros in sudo_compat.h.</changelog>
  <changelog author="kstreitova@suse.com" date="1620820800">- update to 1.9.7
  * The "fuzz" Makefile target now runs all the fuzzers for 8192
    passes (can be overridden via the FUZZ_RUNS variable).  This makes
    it easier to run the fuzzers in-tree.  To run a fuzzer indefinitely,
    set FUZZ_RUNS=-1, e.g. "make FUZZ_RUNS=-1 fuzz".
  * Fixed fuzzing on FreeBSD where the ld.lld linker returns an
    error by default when a symbol is multiply-defined.
  * Added support for determining local IPv6 addresses on systems
    that lack the getifaddrs() function.  This now works on AIX,
    HP-UX and Solaris (at least).  Bug #969.
  * Fixed a bug introduced in sudo 1.9.6 that caused "sudo -V" to
    report a usage error.  Also, when invoked as sudoedit, sudo now
    allows a more restricted set of options that matches the usage
    statement and documentation.  GitHub issue #95.
  * Fixed a crash in sudo_sendlog when the specified certificate
    or key does not exist or is invalid.  Bug #970
  * Fixed a compilation error when sudo is configured with the
  - -disable-log-client option.
  * Sudo's limited support for SUCCESS=return entries in nsswitch.conf
    is now documented.  Bug #971.
  * Sudo now requires autoconf 2.70 or higher to regenerate the
    configure script.  Bug #972.
  * sudo_logsrvd now has a relay mode which can be used to create
    a hierarchy of log servers.  By default, when a relay server is
    defined, messages from the client are forwarded immediately to
    the relay.  However, if the "store_first" setting is enabled,
    the log will be stored locally until the command completes and
    then relayed.  Bug #965.
  * Sudo now links with OpenSSL by default if it is available unless
    the --disable-openssl configure option is used or both the
  - -disable-log-client and --disable-log-server configure options
    are specified.
  * Fixed configure's Python version detection when the version minor
    number is more than a single digit, for example Python 3.10.
  * The sudo Python module tests now pass for Python 3.10.
  * Sudo will now avoid changing the datasize resource limit
    as long as the existing value is at least 1GB.  This works around
    a problem on 64-bit HP-UX where it is not possible to exactly
    restore the original datasize limit.  Bug #973.
  * Fixed a race condition that could result in a hang when sudo is
    executed by a process where the SIGCHLD handler is set to SIG_IGN.
    This fixes the bug described by GitHub PR #98.
  * Fixed an out-of-bounds read in sudoedit and visudo when the
    EDITOR, VISUAL or SUDO_EDITOR environment variables end in an
    unescaped backslash.  Also fixed the handling of quote characters
    that are escaped by a backslash.  GitHub issue #99.
  * Fixed a bug that prevented the "log_server_verify" sudoers option
    from taking effect.
  * The sudo_sendlog utility has a new -s option to cause it to stop
    sending I/O records after a user-specified elapsed time.  This
    can be used to test the I/O log restart functionality of sudo_logsrvd.
  * Fixed a crash introduced in sudo 1.9.4 in sudo_logsrvd when
    attempting to restart an interrupted I/O log transfer.
  * The TLS connection timeout in the sudoers log client was previously
    hard-coded to 10 seconds.  It now uses the value of log_server_timeout.
  * The configure script now outputs a summary of the user-configurable
    options at the end, separate from output of configure script tests.
    Bug #820.
  * Corrected the description of which groups may be specified via the
  - g option in the Runas_Spec section.  Bug #975.</changelog>
  <changelog author="yaroslav.kurlaev@gmail.com" date="1626091200">- Fix LC_TIME incorrectly named LC_ATIME</changelog>
  <changelog author="yaroslav.kurlaev@gmail.com" date="1626091201">- Fix commented out "Defaults env_keep" in sudo-sudoers.patch</changelog>
  <changelog author="peter@czanik.hu" date="1627646400">- update to 1.9.7p2
- enabled openssl support for secure central session
  recording collection (without it's clear text)
- fixed SLES12 build
  * When formatting JSON output, octal numbers are now stored as
  strings, not numbers.  The JSON spec does not actually support
  octal numbers with a '0' prefix.
  * Fixed a compilation issue on Solaris 9.
  * Sudo now can handle the getgroups() function returning a different
  number of groups for subsequent invocations.  GitHub PR #106.
  * When loading a Python plugin, python_plugin.so now verifies
  that the module loaded matches the one we tried to load.  This
  allows sudo to display a more useful error message when trying
  to load a plugin with a name that conflicts with a Python module
  installed in the system location.
  * Sudo no longer sets the the open files resource limit to "unlimited"
  while it runs.  This avoids a problem where sudo's closefrom()
  emulation would need to close a very large number of descriptors
  on systems without a way to determine which ones are actually open.
  * Sudo now includes a configure check for va_copy or __va_copy and
  only defines its own version if the configure test fails.
  * Fixed a bug in sudo's utmp file handling which prevented old
  entries from being reused.  As a result, the utmp (or utmpx)
  file was appended to unnecessarily.  GitHub PR #108.
  * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd
  from accepting TLS connections when OpenSSL is used.  Bug #988.
  * Fixed an SELinux sudoedit bug when the edited temporary file
  could not be opened.  The sesh helper would still be run even
  when there are no temporary files available to install.
  * Fixed a compilation problem on FreeBSD.
  * The sudo_noexec.so file is now built as a module on all systems
  other than macOS.  This makes it possible to use other libtool
  implementations such as slibtool.  On macOS shared libraries and
  modules are not interchangeable and the version of libtool shipped
  with sudo must be used.
  * Fixed a few bugs in the getgrouplist() emulation on Solaris when
  reading from the local group file.
  * Fixed a bug in sudo_logsrvd that prevented periodic relay server
  connection retries from occurring in "store_first" mode.
  * Disabled the nss_search()-based getgrouplist() emulation on HP-UX
  due to a crash when the group source is set to "compat" in
  /etc/nsswitch.conf.  This is probably due to a mismatch between
  include/compat/nss_dbdefs.h and what HP-UX uses internally.  On
  HP-UX we now just cycle through groups the slow way using
  getgrent().  Bug #978.</changelog>
  <changelog author="kstreitova@suse.com" date="1632312000">- update to 1.9.8p2
  * Fixed a potential out-of-bounds read with "sudo -i" when the
    target user's shell is bash.  This is a regression introduced
    in sudo 1.9.8.  Bug #998.
  * sudo_logsrvd now only sends a log ID for first command of a session.
    There is no need to send the log ID for each sub-command.
  * Fixed a few minor memory leaks in intercept mode.
  * Fixed a problem with sudo_logsrvd in relay mode if "store_first"
    was enabled when handling sub-commands.  A new zero-length journal
    file was created for each sub-command instead of simply using
    the existing journal file.
- update to 1.9.8p1
  * Fixed support for passing a prompt (sudo -p) or a login class
    (sudo -l) on the command line.  This is a regression introduced
    in sudo 1.9.8.  Bug #993.
  * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends.
    This is a regression introduced in sudo 1.9.8.  Bug #994.
  * Fixed a compilation error when the --enable-static-sudoers configure
    option was specified.  This is a regression introduced in sudo
    1.9.8 caused by a symbol clash with the intercept and log server
    protobuf functions.
  * It is now possible to transparently intercepting sub-commands
    executed by the original command run via sudo.  Intercept support
    is implemented using LD_PRELOAD (or the equivalent supported by
    the system) and so has some limitations.  The two main limitations
    are that only dynamic executables are supported and only the
    execl, execle, execlp, execv, execve, execvp, and execvpe library
    functions are currently intercepted. Its main use case is to
    support restricting privileged shells run via sudo.
    To support this, there is a new "intercept" Defaults setting and
    an INTERCEPT command tag that can be used in sudoers.  For example:
    Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh
    Defaults!SHELLS intercept
    would cause sudo to run the listed shells in intercept mode.
    This can also be set on a per-rule basis.  For example:
    Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh
    chuck ALL = INTERCEPT: SHELLS
    would only apply intercept mode to user "chuck" when running one
    of the listed shells.
    In intercept mode, sudo will not prompt for a password before
    running a sub-command and will not allow a set-user-ID or
    set-group-ID program to be run by default.  The new
    intercept_authenticate and intercept_allow_setid sudoers settings
    can be used to change this behavior.
  * The new "log_subcmds" sudoers setting can be used to log additional
    commands run in a privileged shell.  It uses the same mechanism as
    the intercept support described above and has the same limitations.
  * The new "log_exit_status" sudoers setting can be used to log
    the exit status commands run via sudo.  This is also a corresponding
    "log_exit" setting in the sudo_logsrvd.conf eventlog stanza.
  * Support for logging sudo_logsrvd errors via syslog or to a file.
    Previously, most sudo_logsrvd errors were only visible in the
    debug log.
  * Better diagnostics when there is a TLS certificate validation error.
  * Using the "+=" or "-=" operators in a Defaults setting that takes
    a string, not a list, now produces a warning from sudo and a
    syntax error from inside visudo.
  * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd
    had no effect when creating I/O log parent directories if the I/O log
    file name ended with the string "XXXXXX".
  * Fixed a bug in the sudoers custom prompt code where the size
    parameter that was passed to the strlcpy() function was incorrect.
    No overflow was possible since the correct amount of memory was
    already pre-allocated.
  * The mksigname and mksiglist helper programs are now built with
    the host compiler, not the target compiler, when cross-compiling.
    Bug #989.
  * Fixed compilation error when the --enable-static-sudoers configure
    option was specified.  This was due to a typo introduced in sudo
    1.9.7.  GitHub PR #113.
- pack /usr/libexec/sudo/sudo/sudo_intercept.so</changelog>
  <changelog author="sflees@suse.de" date="1643284800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch</changelog>
  <changelog author="simonf.lees@suse.com" date="1643716800">- Update to 1.9.9
  * Sudo can now be built with OpenSSL 3.0 without generating
    warnings about deprecated OpenSSL APIs.
  * A digest can now be specified along with the ALL command in
    the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for
    this in the sudoers file but did not include corresponding
    changes for the other back-ends.
  * visudo now only warns about an undefined alias or a cycle in
    an alias once for each alias.
  * The sudoRole cn was truncated by a single character in warning
    messages. GitHub issue #115.
  * The cvtsudoers utility has new --group-file and --passwd-file
    options to use a custom passwd or group file when the
  - -match-local option is also used.
  * The cvtsudoers utility can now filter or match based on a command.
  * The cvtsudoers utility can now produce output in csv
    (comma-separated value) format. This can be used to help generate
    entitlement reports.
  * Fixed a bug in sudo_logsrvd that could result in the connection
    being dropped for very long command lines.
  * Fixed a bug where sudo_logsrvd would not accept a restore point
    of zero.
  * Fixed a bug in visudo where the value of the editor setting was
    not used if it did not match the user?s EDITOR environment
    variable. This was only a problem if the env_editor setting was
    not enabled. Bug #1000.
  * Sudo now builds with the -fcf-protection compiler option and the
  - z now linker option if supported.
  * The output of sudoreplay -l now more closely matches the
    traditional sudo log format.
  * The sudo_sendlog utility will now use the full contents of the
    log.json file, if present. This makes it possible to send
    sudo-format I/O logs that use the newer log.json format to
    sudo_logsrvd without losing any information.
  * Fixed compilation of the arc4random_buf() replacement on systems
    with arc4random() but no arc4random_buf(). Bug #1008.
  * Sudo now uses its own getentropy() by default on Linux. The GNU
    libc version of getentropy() will fail on older kernels that
    don?t support the getrandom() system call.
  * It is now possible to build sudo with WolfSSL?s OpenSSL
    compatibility layer by using the --enable-wolfssl configure
    option.
  * Fixed a bug related to Daylight Saving Time when parsing
    timestamps in Generalized Time format. This affected the NOTBEFORE
    and NOTAFTER options in sudoers. Bug #1006.
  * Added the -O and -P options to visudo, which can be used to check
    or set the owner and permissions. This can be used in conjunction
    with the -c option to check that the sudoers file ownership and
    permissions are correct. Bug #1007.
  * It is now possible to set resource limits in the sudoers file
    itself. The special values default and ?user? refer to the
    default system limit and invoking user limit respectively. The
    core dump size limit is now set to 0 by default unless overridden
    by the sudoers file.
  * The cvtsudoers utility can now merge multiple sudoers sources into
    a single, combined sudoers file. If there are conflicting entries,
    cvtsudoers will attempt to resolve them but manual intervention
    may be required. The merging of sudoers rules is currently fairly
    simplistic but will be improved in a future release.
  * Sudo was parsing but not applying the ?deref? and ?tls_reqcert?
    ldap.conf settings. This meant the options were effectively ignored
    which broke dereferencing of aliases in LDAP. Bug #1013.
  * Clarified in the sudo man page that the security policy may
    override the user?s PATH environment variable. Bug #1014.
  * When sudo is run in non-interactive mode (with the -n option), it
    will now attempt PAM authentication and only exit with an error if
    user interaction is required. This allows PAM modules that don?t
    interact with the user to succeed. Previously, sudo would not
    attempt authentication if the -n option was specified. Bug #956
    and GitHub issue #83.
  * Fixed a regression introduced in version 1.9.1 when sudo is built
    with the --with-fqdn configure option. The local host name was
    being resolved before the sudoers file was processed, making it
    impossible to disable DNS lookups by negating the fqdn sudoers
    option. Bug #1016.
  * Added support for negated sudoUser attributes in the LDAP and SSSD
    sudoers back ends. A matching sudoUser that is negated will cause
    the sudoRole containing it to be ignored.
  * Fixed a bug where the stack resource limit could be set to a value
    smaller than that of the invoking user and not be reset before the
    command was run. Bug #1016.
- sudo no longer ships schema for LDAP.
- sudo-feature-negated-LDAP-users.patch dropped, included upstream
- refreshed sudo-sudoers.patch</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.9-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1662811200">- Modified sudo-sudoers.patch
  * bsc#1177578
  * Removed redundant and confusing 'secure_path' settings in
    sudo-sudoers file.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1669032000">- Added sudo-utf8-ldap-schema.patch
  * Change sudo-ldap schema from ASCII to UTF8.
  * Fixes bsc#1197998
  * Credit to William Brown &lt;william.brown@suse.com&gt;
  * https://github.com/sudo-project/sudo/pull/163</changelog>
</package>
<package pkgid="21610068f3675f2f3ff907ac6c528911f38eb3ac1d32b295e8892997b42945e8" name="sudo" arch="src">
  <version epoch="0" ver="1.9.9" rel="150400.4.9.1"/>
  <changelog author="olaf@aepfle.de" date="1598356800">- This rpm packages decides about the permissions of /etc/sudoers.d</changelog>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="dmueller@suse.com" date="1616241600">- update to 1.9.6p1
  * Fixed a regression introduced in sudo 1.9.6 that resulted in an
  error message instead of a usage message when sudo is run with
  no arguments.
  * Fixed a sudo_sendlog compilation problem with the AIX xlC compiler.
  * Fixed a regression introduced in sudo 1.9.4 where the
  - -disable-root-mailer configure option had no effect.
  * Added a --disable-leaks configure option that avoids some
  memory leaks on exit that would otherwise occur.  This is intended
  to be used with development tools that measure memory leaks.  It
  is not safe to use in production at this time.
  * Plugged some memory leaks identified by oss-fuzz and ASAN.
  * Fixed the handling of sudoOptions for an LDAP sudoRole that
  contains multiple sudoCommands.  Previously, some of the options
  would only be applied to the first sudoCommand.
  * Fixed a potential out of bounds read in the parsing of NOTBEFORE
  and NOTAFTER sudoers command options (and their LDAP equivalents).
  * The parser used for reading I/O log JSON files is now more
  resilient when processing invalid JSON.
  * Fixed typos that prevented "make uninstall" from working.
  * Fixed a regression introduced in sudo 1.9.4 where the last line
  in a sudoers file might not have a terminating NUL character
  added if no newline was present.
  * Integrated oss-fuzz and LLVM's libFuzzer with sudo.  The new
  - -enable-fuzzer configure option can be combined with the
  - -enable-sanitizer option to build sudo with fuzzing support.
  Multiple fuzz targets are available for fuzzing different parts
  of sudo.  Fuzzers are built and tested via "make fuzz" or as part
  of "make check" (even when sudo is not built with fuzzing support).
  Fuzzing support currently requires the LLVM clang compiler (not gcc).
  * Fixed the --enable-static-sudoers configure option.
  * Fixed a potential out of bounds read sudo when is run by a user
  with more groups than the value of "max_groups" in sudo.conf.
  * Added an "admin_flag" sudoers option to make the use of the
  ~/.sudo_as_admin_successful file configurable on systems where
  sudo is build with the --enable-admin-flag configure option.
  This mostly affects Ubuntu and its derivatives.
  * The "max_groups" setting in sudo.conf is now limited to 1024.
  This setting is obsolete and should no longer be needed.
  * Fixed a bug in the tilde expansion of "CHROOT=dir" and "CWD=dir"
  sudoers command options.  A path "~/foo" was expanded to
  "/home/userfoo" instead of "/home/user/foo".  This also affects
  the runchroot and runcwd Defaults settings.
  * Fixed a bug on systems without a native getdelim(3) function
  where very long lines could cause parsing of the sudoers file
  to end prematurely.
  * Fixed a potential integer overflow when converting the
  timestamp_timeout and passwd_timeout sudoers settings to a
  timespec struct.
  * The default for the "group_source" setting in sudo.conf is now
  "dynamic" on macOS.  Recent versions of macOS do not reliably
  return all of a user's non-local groups via getgroups(2), even
  when _DARWIN_UNLIMITED_GETGROUPS is defined.
  * Fixed a potential use-after-free in the PAM conversation function.
  * Fixed potential redefinition of sys/stat.h macros in sudo_compat.h.</changelog>
  <changelog author="kstreitova@suse.com" date="1620820800">- update to 1.9.7
  * The "fuzz" Makefile target now runs all the fuzzers for 8192
    passes (can be overridden via the FUZZ_RUNS variable).  This makes
    it easier to run the fuzzers in-tree.  To run a fuzzer indefinitely,
    set FUZZ_RUNS=-1, e.g. "make FUZZ_RUNS=-1 fuzz".
  * Fixed fuzzing on FreeBSD where the ld.lld linker returns an
    error by default when a symbol is multiply-defined.
  * Added support for determining local IPv6 addresses on systems
    that lack the getifaddrs() function.  This now works on AIX,
    HP-UX and Solaris (at least).  Bug #969.
  * Fixed a bug introduced in sudo 1.9.6 that caused "sudo -V" to
    report a usage error.  Also, when invoked as sudoedit, sudo now
    allows a more restricted set of options that matches the usage
    statement and documentation.  GitHub issue #95.
  * Fixed a crash in sudo_sendlog when the specified certificate
    or key does not exist or is invalid.  Bug #970
  * Fixed a compilation error when sudo is configured with the
  - -disable-log-client option.
  * Sudo's limited support for SUCCESS=return entries in nsswitch.conf
    is now documented.  Bug #971.
  * Sudo now requires autoconf 2.70 or higher to regenerate the
    configure script.  Bug #972.
  * sudo_logsrvd now has a relay mode which can be used to create
    a hierarchy of log servers.  By default, when a relay server is
    defined, messages from the client are forwarded immediately to
    the relay.  However, if the "store_first" setting is enabled,
    the log will be stored locally until the command completes and
    then relayed.  Bug #965.
  * Sudo now links with OpenSSL by default if it is available unless
    the --disable-openssl configure option is used or both the
  - -disable-log-client and --disable-log-server configure options
    are specified.
  * Fixed configure's Python version detection when the version minor
    number is more than a single digit, for example Python 3.10.
  * The sudo Python module tests now pass for Python 3.10.
  * Sudo will now avoid changing the datasize resource limit
    as long as the existing value is at least 1GB.  This works around
    a problem on 64-bit HP-UX where it is not possible to exactly
    restore the original datasize limit.  Bug #973.
  * Fixed a race condition that could result in a hang when sudo is
    executed by a process where the SIGCHLD handler is set to SIG_IGN.
    This fixes the bug described by GitHub PR #98.
  * Fixed an out-of-bounds read in sudoedit and visudo when the
    EDITOR, VISUAL or SUDO_EDITOR environment variables end in an
    unescaped backslash.  Also fixed the handling of quote characters
    that are escaped by a backslash.  GitHub issue #99.
  * Fixed a bug that prevented the "log_server_verify" sudoers option
    from taking effect.
  * The sudo_sendlog utility has a new -s option to cause it to stop
    sending I/O records after a user-specified elapsed time.  This
    can be used to test the I/O log restart functionality of sudo_logsrvd.
  * Fixed a crash introduced in sudo 1.9.4 in sudo_logsrvd when
    attempting to restart an interrupted I/O log transfer.
  * The TLS connection timeout in the sudoers log client was previously
    hard-coded to 10 seconds.  It now uses the value of log_server_timeout.
  * The configure script now outputs a summary of the user-configurable
    options at the end, separate from output of configure script tests.
    Bug #820.
  * Corrected the description of which groups may be specified via the
  - g option in the Runas_Spec section.  Bug #975.</changelog>
  <changelog author="yaroslav.kurlaev@gmail.com" date="1626091200">- Fix LC_TIME incorrectly named LC_ATIME</changelog>
  <changelog author="yaroslav.kurlaev@gmail.com" date="1626091201">- Fix commented out "Defaults env_keep" in sudo-sudoers.patch</changelog>
  <changelog author="peter@czanik.hu" date="1627646400">- update to 1.9.7p2
- enabled openssl support for secure central session
  recording collection (without it's clear text)
- fixed SLES12 build
  * When formatting JSON output, octal numbers are now stored as
  strings, not numbers.  The JSON spec does not actually support
  octal numbers with a '0' prefix.
  * Fixed a compilation issue on Solaris 9.
  * Sudo now can handle the getgroups() function returning a different
  number of groups for subsequent invocations.  GitHub PR #106.
  * When loading a Python plugin, python_plugin.so now verifies
  that the module loaded matches the one we tried to load.  This
  allows sudo to display a more useful error message when trying
  to load a plugin with a name that conflicts with a Python module
  installed in the system location.
  * Sudo no longer sets the the open files resource limit to "unlimited"
  while it runs.  This avoids a problem where sudo's closefrom()
  emulation would need to close a very large number of descriptors
  on systems without a way to determine which ones are actually open.
  * Sudo now includes a configure check for va_copy or __va_copy and
  only defines its own version if the configure test fails.
  * Fixed a bug in sudo's utmp file handling which prevented old
  entries from being reused.  As a result, the utmp (or utmpx)
  file was appended to unnecessarily.  GitHub PR #108.
  * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd
  from accepting TLS connections when OpenSSL is used.  Bug #988.
  * Fixed an SELinux sudoedit bug when the edited temporary file
  could not be opened.  The sesh helper would still be run even
  when there are no temporary files available to install.
  * Fixed a compilation problem on FreeBSD.
  * The sudo_noexec.so file is now built as a module on all systems
  other than macOS.  This makes it possible to use other libtool
  implementations such as slibtool.  On macOS shared libraries and
  modules are not interchangeable and the version of libtool shipped
  with sudo must be used.
  * Fixed a few bugs in the getgrouplist() emulation on Solaris when
  reading from the local group file.
  * Fixed a bug in sudo_logsrvd that prevented periodic relay server
  connection retries from occurring in "store_first" mode.
  * Disabled the nss_search()-based getgrouplist() emulation on HP-UX
  due to a crash when the group source is set to "compat" in
  /etc/nsswitch.conf.  This is probably due to a mismatch between
  include/compat/nss_dbdefs.h and what HP-UX uses internally.  On
  HP-UX we now just cycle through groups the slow way using
  getgrent().  Bug #978.</changelog>
  <changelog author="kstreitova@suse.com" date="1632312000">- update to 1.9.8p2
  * Fixed a potential out-of-bounds read with "sudo -i" when the
    target user's shell is bash.  This is a regression introduced
    in sudo 1.9.8.  Bug #998.
  * sudo_logsrvd now only sends a log ID for first command of a session.
    There is no need to send the log ID for each sub-command.
  * Fixed a few minor memory leaks in intercept mode.
  * Fixed a problem with sudo_logsrvd in relay mode if "store_first"
    was enabled when handling sub-commands.  A new zero-length journal
    file was created for each sub-command instead of simply using
    the existing journal file.
- update to 1.9.8p1
  * Fixed support for passing a prompt (sudo -p) or a login class
    (sudo -l) on the command line.  This is a regression introduced
    in sudo 1.9.8.  Bug #993.
  * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends.
    This is a regression introduced in sudo 1.9.8.  Bug #994.
  * Fixed a compilation error when the --enable-static-sudoers configure
    option was specified.  This is a regression introduced in sudo
    1.9.8 caused by a symbol clash with the intercept and log server
    protobuf functions.
  * It is now possible to transparently intercepting sub-commands
    executed by the original command run via sudo.  Intercept support
    is implemented using LD_PRELOAD (or the equivalent supported by
    the system) and so has some limitations.  The two main limitations
    are that only dynamic executables are supported and only the
    execl, execle, execlp, execv, execve, execvp, and execvpe library
    functions are currently intercepted. Its main use case is to
    support restricting privileged shells run via sudo.
    To support this, there is a new "intercept" Defaults setting and
    an INTERCEPT command tag that can be used in sudoers.  For example:
    Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh
    Defaults!SHELLS intercept
    would cause sudo to run the listed shells in intercept mode.
    This can also be set on a per-rule basis.  For example:
    Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh
    chuck ALL = INTERCEPT: SHELLS
    would only apply intercept mode to user "chuck" when running one
    of the listed shells.
    In intercept mode, sudo will not prompt for a password before
    running a sub-command and will not allow a set-user-ID or
    set-group-ID program to be run by default.  The new
    intercept_authenticate and intercept_allow_setid sudoers settings
    can be used to change this behavior.
  * The new "log_subcmds" sudoers setting can be used to log additional
    commands run in a privileged shell.  It uses the same mechanism as
    the intercept support described above and has the same limitations.
  * The new "log_exit_status" sudoers setting can be used to log
    the exit status commands run via sudo.  This is also a corresponding
    "log_exit" setting in the sudo_logsrvd.conf eventlog stanza.
  * Support for logging sudo_logsrvd errors via syslog or to a file.
    Previously, most sudo_logsrvd errors were only visible in the
    debug log.
  * Better diagnostics when there is a TLS certificate validation error.
  * Using the "+=" or "-=" operators in a Defaults setting that takes
    a string, not a list, now produces a warning from sudo and a
    syntax error from inside visudo.
  * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd
    had no effect when creating I/O log parent directories if the I/O log
    file name ended with the string "XXXXXX".
  * Fixed a bug in the sudoers custom prompt code where the size
    parameter that was passed to the strlcpy() function was incorrect.
    No overflow was possible since the correct amount of memory was
    already pre-allocated.
  * The mksigname and mksiglist helper programs are now built with
    the host compiler, not the target compiler, when cross-compiling.
    Bug #989.
  * Fixed compilation error when the --enable-static-sudoers configure
    option was specified.  This was due to a typo introduced in sudo
    1.9.7.  GitHub PR #113.
- pack /usr/libexec/sudo/sudo/sudo_intercept.so</changelog>
  <changelog author="sflees@suse.de" date="1643284800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch</changelog>
  <changelog author="simonf.lees@suse.com" date="1643716800">- Update to 1.9.9
  * Sudo can now be built with OpenSSL 3.0 without generating
    warnings about deprecated OpenSSL APIs.
  * A digest can now be specified along with the ALL command in
    the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for
    this in the sudoers file but did not include corresponding
    changes for the other back-ends.
  * visudo now only warns about an undefined alias or a cycle in
    an alias once for each alias.
  * The sudoRole cn was truncated by a single character in warning
    messages. GitHub issue #115.
  * The cvtsudoers utility has new --group-file and --passwd-file
    options to use a custom passwd or group file when the
  - -match-local option is also used.
  * The cvtsudoers utility can now filter or match based on a command.
  * The cvtsudoers utility can now produce output in csv
    (comma-separated value) format. This can be used to help generate
    entitlement reports.
  * Fixed a bug in sudo_logsrvd that could result in the connection
    being dropped for very long command lines.
  * Fixed a bug where sudo_logsrvd would not accept a restore point
    of zero.
  * Fixed a bug in visudo where the value of the editor setting was
    not used if it did not match the user?s EDITOR environment
    variable. This was only a problem if the env_editor setting was
    not enabled. Bug #1000.
  * Sudo now builds with the -fcf-protection compiler option and the
  - z now linker option if supported.
  * The output of sudoreplay -l now more closely matches the
    traditional sudo log format.
  * The sudo_sendlog utility will now use the full contents of the
    log.json file, if present. This makes it possible to send
    sudo-format I/O logs that use the newer log.json format to
    sudo_logsrvd without losing any information.
  * Fixed compilation of the arc4random_buf() replacement on systems
    with arc4random() but no arc4random_buf(). Bug #1008.
  * Sudo now uses its own getentropy() by default on Linux. The GNU
    libc version of getentropy() will fail on older kernels that
    don?t support the getrandom() system call.
  * It is now possible to build sudo with WolfSSL?s OpenSSL
    compatibility layer by using the --enable-wolfssl configure
    option.
  * Fixed a bug related to Daylight Saving Time when parsing
    timestamps in Generalized Time format. This affected the NOTBEFORE
    and NOTAFTER options in sudoers. Bug #1006.
  * Added the -O and -P options to visudo, which can be used to check
    or set the owner and permissions. This can be used in conjunction
    with the -c option to check that the sudoers file ownership and
    permissions are correct. Bug #1007.
  * It is now possible to set resource limits in the sudoers file
    itself. The special values default and ?user? refer to the
    default system limit and invoking user limit respectively. The
    core dump size limit is now set to 0 by default unless overridden
    by the sudoers file.
  * The cvtsudoers utility can now merge multiple sudoers sources into
    a single, combined sudoers file. If there are conflicting entries,
    cvtsudoers will attempt to resolve them but manual intervention
    may be required. The merging of sudoers rules is currently fairly
    simplistic but will be improved in a future release.
  * Sudo was parsing but not applying the ?deref? and ?tls_reqcert?
    ldap.conf settings. This meant the options were effectively ignored
    which broke dereferencing of aliases in LDAP. Bug #1013.
  * Clarified in the sudo man page that the security policy may
    override the user?s PATH environment variable. Bug #1014.
  * When sudo is run in non-interactive mode (with the -n option), it
    will now attempt PAM authentication and only exit with an error if
    user interaction is required. This allows PAM modules that don?t
    interact with the user to succeed. Previously, sudo would not
    attempt authentication if the -n option was specified. Bug #956
    and GitHub issue #83.
  * Fixed a regression introduced in version 1.9.1 when sudo is built
    with the --with-fqdn configure option. The local host name was
    being resolved before the sudoers file was processed, making it
    impossible to disable DNS lookups by negating the fqdn sudoers
    option. Bug #1016.
  * Added support for negated sudoUser attributes in the LDAP and SSSD
    sudoers back ends. A matching sudoUser that is negated will cause
    the sudoRole containing it to be ignored.
  * Fixed a bug where the stack resource limit could be set to a value
    smaller than that of the invoking user and not be reset before the
    command was run. Bug #1016.
- sudo no longer ships schema for LDAP.
- sudo-feature-negated-LDAP-users.patch dropped, included upstream
- refreshed sudo-sudoers.patch</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.9-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1662811200">- Modified sudo-sudoers.patch
  * bsc#1177578
  * Removed redundant and confusing 'secure_path' settings in
    sudo-sudoers file.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1669032000">- Added sudo-utf8-ldap-schema.patch
  * Change sudo-ldap schema from ASCII to UTF8.
  * Fixes bsc#1197998
  * Credit to William Brown &lt;william.brown@suse.com&gt;
  * https://github.com/sudo-project/sudo/pull/163</changelog>
</package>
<package pkgid="de8ee5a674bc0f9164d2d1d8b8a6d4170fd57402d40f0a56c721261b91aa41dc" name="sudo" arch="x86_64">
  <version epoch="0" ver="1.9.9" rel="150400.4.9.1"/>
  <changelog author="olaf@aepfle.de" date="1598356800">- This rpm packages decides about the permissions of /etc/sudoers.d</changelog>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="dmueller@suse.com" date="1616241600">- update to 1.9.6p1
  * Fixed a regression introduced in sudo 1.9.6 that resulted in an
  error message instead of a usage message when sudo is run with
  no arguments.
  * Fixed a sudo_sendlog compilation problem with the AIX xlC compiler.
  * Fixed a regression introduced in sudo 1.9.4 where the
  - -disable-root-mailer configure option had no effect.
  * Added a --disable-leaks configure option that avoids some
  memory leaks on exit that would otherwise occur.  This is intended
  to be used with development tools that measure memory leaks.  It
  is not safe to use in production at this time.
  * Plugged some memory leaks identified by oss-fuzz and ASAN.
  * Fixed the handling of sudoOptions for an LDAP sudoRole that
  contains multiple sudoCommands.  Previously, some of the options
  would only be applied to the first sudoCommand.
  * Fixed a potential out of bounds read in the parsing of NOTBEFORE
  and NOTAFTER sudoers command options (and their LDAP equivalents).
  * The parser used for reading I/O log JSON files is now more
  resilient when processing invalid JSON.
  * Fixed typos that prevented "make uninstall" from working.
  * Fixed a regression introduced in sudo 1.9.4 where the last line
  in a sudoers file might not have a terminating NUL character
  added if no newline was present.
  * Integrated oss-fuzz and LLVM's libFuzzer with sudo.  The new
  - -enable-fuzzer configure option can be combined with the
  - -enable-sanitizer option to build sudo with fuzzing support.
  Multiple fuzz targets are available for fuzzing different parts
  of sudo.  Fuzzers are built and tested via "make fuzz" or as part
  of "make check" (even when sudo is not built with fuzzing support).
  Fuzzing support currently requires the LLVM clang compiler (not gcc).
  * Fixed the --enable-static-sudoers configure option.
  * Fixed a potential out of bounds read sudo when is run by a user
  with more groups than the value of "max_groups" in sudo.conf.
  * Added an "admin_flag" sudoers option to make the use of the
  ~/.sudo_as_admin_successful file configurable on systems where
  sudo is build with the --enable-admin-flag configure option.
  This mostly affects Ubuntu and its derivatives.
  * The "max_groups" setting in sudo.conf is now limited to 1024.
  This setting is obsolete and should no longer be needed.
  * Fixed a bug in the tilde expansion of "CHROOT=dir" and "CWD=dir"
  sudoers command options.  A path "~/foo" was expanded to
  "/home/userfoo" instead of "/home/user/foo".  This also affects
  the runchroot and runcwd Defaults settings.
  * Fixed a bug on systems without a native getdelim(3) function
  where very long lines could cause parsing of the sudoers file
  to end prematurely.
  * Fixed a potential integer overflow when converting the
  timestamp_timeout and passwd_timeout sudoers settings to a
  timespec struct.
  * The default for the "group_source" setting in sudo.conf is now
  "dynamic" on macOS.  Recent versions of macOS do not reliably
  return all of a user's non-local groups via getgroups(2), even
  when _DARWIN_UNLIMITED_GETGROUPS is defined.
  * Fixed a potential use-after-free in the PAM conversation function.
  * Fixed potential redefinition of sys/stat.h macros in sudo_compat.h.</changelog>
  <changelog author="kstreitova@suse.com" date="1620820800">- update to 1.9.7
  * The "fuzz" Makefile target now runs all the fuzzers for 8192
    passes (can be overridden via the FUZZ_RUNS variable).  This makes
    it easier to run the fuzzers in-tree.  To run a fuzzer indefinitely,
    set FUZZ_RUNS=-1, e.g. "make FUZZ_RUNS=-1 fuzz".
  * Fixed fuzzing on FreeBSD where the ld.lld linker returns an
    error by default when a symbol is multiply-defined.
  * Added support for determining local IPv6 addresses on systems
    that lack the getifaddrs() function.  This now works on AIX,
    HP-UX and Solaris (at least).  Bug #969.
  * Fixed a bug introduced in sudo 1.9.6 that caused "sudo -V" to
    report a usage error.  Also, when invoked as sudoedit, sudo now
    allows a more restricted set of options that matches the usage
    statement and documentation.  GitHub issue #95.
  * Fixed a crash in sudo_sendlog when the specified certificate
    or key does not exist or is invalid.  Bug #970
  * Fixed a compilation error when sudo is configured with the
  - -disable-log-client option.
  * Sudo's limited support for SUCCESS=return entries in nsswitch.conf
    is now documented.  Bug #971.
  * Sudo now requires autoconf 2.70 or higher to regenerate the
    configure script.  Bug #972.
  * sudo_logsrvd now has a relay mode which can be used to create
    a hierarchy of log servers.  By default, when a relay server is
    defined, messages from the client are forwarded immediately to
    the relay.  However, if the "store_first" setting is enabled,
    the log will be stored locally until the command completes and
    then relayed.  Bug #965.
  * Sudo now links with OpenSSL by default if it is available unless
    the --disable-openssl configure option is used or both the
  - -disable-log-client and --disable-log-server configure options
    are specified.
  * Fixed configure's Python version detection when the version minor
    number is more than a single digit, for example Python 3.10.
  * The sudo Python module tests now pass for Python 3.10.
  * Sudo will now avoid changing the datasize resource limit
    as long as the existing value is at least 1GB.  This works around
    a problem on 64-bit HP-UX where it is not possible to exactly
    restore the original datasize limit.  Bug #973.
  * Fixed a race condition that could result in a hang when sudo is
    executed by a process where the SIGCHLD handler is set to SIG_IGN.
    This fixes the bug described by GitHub PR #98.
  * Fixed an out-of-bounds read in sudoedit and visudo when the
    EDITOR, VISUAL or SUDO_EDITOR environment variables end in an
    unescaped backslash.  Also fixed the handling of quote characters
    that are escaped by a backslash.  GitHub issue #99.
  * Fixed a bug that prevented the "log_server_verify" sudoers option
    from taking effect.
  * The sudo_sendlog utility has a new -s option to cause it to stop
    sending I/O records after a user-specified elapsed time.  This
    can be used to test the I/O log restart functionality of sudo_logsrvd.
  * Fixed a crash introduced in sudo 1.9.4 in sudo_logsrvd when
    attempting to restart an interrupted I/O log transfer.
  * The TLS connection timeout in the sudoers log client was previously
    hard-coded to 10 seconds.  It now uses the value of log_server_timeout.
  * The configure script now outputs a summary of the user-configurable
    options at the end, separate from output of configure script tests.
    Bug #820.
  * Corrected the description of which groups may be specified via the
  - g option in the Runas_Spec section.  Bug #975.</changelog>
  <changelog author="yaroslav.kurlaev@gmail.com" date="1626091200">- Fix LC_TIME incorrectly named LC_ATIME</changelog>
  <changelog author="yaroslav.kurlaev@gmail.com" date="1626091201">- Fix commented out "Defaults env_keep" in sudo-sudoers.patch</changelog>
  <changelog author="peter@czanik.hu" date="1627646400">- update to 1.9.7p2
- enabled openssl support for secure central session
  recording collection (without it's clear text)
- fixed SLES12 build
  * When formatting JSON output, octal numbers are now stored as
  strings, not numbers.  The JSON spec does not actually support
  octal numbers with a '0' prefix.
  * Fixed a compilation issue on Solaris 9.
  * Sudo now can handle the getgroups() function returning a different
  number of groups for subsequent invocations.  GitHub PR #106.
  * When loading a Python plugin, python_plugin.so now verifies
  that the module loaded matches the one we tried to load.  This
  allows sudo to display a more useful error message when trying
  to load a plugin with a name that conflicts with a Python module
  installed in the system location.
  * Sudo no longer sets the the open files resource limit to "unlimited"
  while it runs.  This avoids a problem where sudo's closefrom()
  emulation would need to close a very large number of descriptors
  on systems without a way to determine which ones are actually open.
  * Sudo now includes a configure check for va_copy or __va_copy and
  only defines its own version if the configure test fails.
  * Fixed a bug in sudo's utmp file handling which prevented old
  entries from being reused.  As a result, the utmp (or utmpx)
  file was appended to unnecessarily.  GitHub PR #108.
  * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd
  from accepting TLS connections when OpenSSL is used.  Bug #988.
  * Fixed an SELinux sudoedit bug when the edited temporary file
  could not be opened.  The sesh helper would still be run even
  when there are no temporary files available to install.
  * Fixed a compilation problem on FreeBSD.
  * The sudo_noexec.so file is now built as a module on all systems
  other than macOS.  This makes it possible to use other libtool
  implementations such as slibtool.  On macOS shared libraries and
  modules are not interchangeable and the version of libtool shipped
  with sudo must be used.
  * Fixed a few bugs in the getgrouplist() emulation on Solaris when
  reading from the local group file.
  * Fixed a bug in sudo_logsrvd that prevented periodic relay server
  connection retries from occurring in "store_first" mode.
  * Disabled the nss_search()-based getgrouplist() emulation on HP-UX
  due to a crash when the group source is set to "compat" in
  /etc/nsswitch.conf.  This is probably due to a mismatch between
  include/compat/nss_dbdefs.h and what HP-UX uses internally.  On
  HP-UX we now just cycle through groups the slow way using
  getgrent().  Bug #978.</changelog>
  <changelog author="kstreitova@suse.com" date="1632312000">- update to 1.9.8p2
  * Fixed a potential out-of-bounds read with "sudo -i" when the
    target user's shell is bash.  This is a regression introduced
    in sudo 1.9.8.  Bug #998.
  * sudo_logsrvd now only sends a log ID for first command of a session.
    There is no need to send the log ID for each sub-command.
  * Fixed a few minor memory leaks in intercept mode.
  * Fixed a problem with sudo_logsrvd in relay mode if "store_first"
    was enabled when handling sub-commands.  A new zero-length journal
    file was created for each sub-command instead of simply using
    the existing journal file.
- update to 1.9.8p1
  * Fixed support for passing a prompt (sudo -p) or a login class
    (sudo -l) on the command line.  This is a regression introduced
    in sudo 1.9.8.  Bug #993.
  * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends.
    This is a regression introduced in sudo 1.9.8.  Bug #994.
  * Fixed a compilation error when the --enable-static-sudoers configure
    option was specified.  This is a regression introduced in sudo
    1.9.8 caused by a symbol clash with the intercept and log server
    protobuf functions.
  * It is now possible to transparently intercepting sub-commands
    executed by the original command run via sudo.  Intercept support
    is implemented using LD_PRELOAD (or the equivalent supported by
    the system) and so has some limitations.  The two main limitations
    are that only dynamic executables are supported and only the
    execl, execle, execlp, execv, execve, execvp, and execvpe library
    functions are currently intercepted. Its main use case is to
    support restricting privileged shells run via sudo.
    To support this, there is a new "intercept" Defaults setting and
    an INTERCEPT command tag that can be used in sudoers.  For example:
    Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh
    Defaults!SHELLS intercept
    would cause sudo to run the listed shells in intercept mode.
    This can also be set on a per-rule basis.  For example:
    Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh
    chuck ALL = INTERCEPT: SHELLS
    would only apply intercept mode to user "chuck" when running one
    of the listed shells.
    In intercept mode, sudo will not prompt for a password before
    running a sub-command and will not allow a set-user-ID or
    set-group-ID program to be run by default.  The new
    intercept_authenticate and intercept_allow_setid sudoers settings
    can be used to change this behavior.
  * The new "log_subcmds" sudoers setting can be used to log additional
    commands run in a privileged shell.  It uses the same mechanism as
    the intercept support described above and has the same limitations.
  * The new "log_exit_status" sudoers setting can be used to log
    the exit status commands run via sudo.  This is also a corresponding
    "log_exit" setting in the sudo_logsrvd.conf eventlog stanza.
  * Support for logging sudo_logsrvd errors via syslog or to a file.
    Previously, most sudo_logsrvd errors were only visible in the
    debug log.
  * Better diagnostics when there is a TLS certificate validation error.
  * Using the "+=" or "-=" operators in a Defaults setting that takes
    a string, not a list, now produces a warning from sudo and a
    syntax error from inside visudo.
  * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd
    had no effect when creating I/O log parent directories if the I/O log
    file name ended with the string "XXXXXX".
  * Fixed a bug in the sudoers custom prompt code where the size
    parameter that was passed to the strlcpy() function was incorrect.
    No overflow was possible since the correct amount of memory was
    already pre-allocated.
  * The mksigname and mksiglist helper programs are now built with
    the host compiler, not the target compiler, when cross-compiling.
    Bug #989.
  * Fixed compilation error when the --enable-static-sudoers configure
    option was specified.  This was due to a typo introduced in sudo
    1.9.7.  GitHub PR #113.
- pack /usr/libexec/sudo/sudo/sudo_intercept.so</changelog>
  <changelog author="sflees@suse.de" date="1643284800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch</changelog>
  <changelog author="simonf.lees@suse.com" date="1643716800">- Update to 1.9.9
  * Sudo can now be built with OpenSSL 3.0 without generating
    warnings about deprecated OpenSSL APIs.
  * A digest can now be specified along with the ALL command in
    the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for
    this in the sudoers file but did not include corresponding
    changes for the other back-ends.
  * visudo now only warns about an undefined alias or a cycle in
    an alias once for each alias.
  * The sudoRole cn was truncated by a single character in warning
    messages. GitHub issue #115.
  * The cvtsudoers utility has new --group-file and --passwd-file
    options to use a custom passwd or group file when the
  - -match-local option is also used.
  * The cvtsudoers utility can now filter or match based on a command.
  * The cvtsudoers utility can now produce output in csv
    (comma-separated value) format. This can be used to help generate
    entitlement reports.
  * Fixed a bug in sudo_logsrvd that could result in the connection
    being dropped for very long command lines.
  * Fixed a bug where sudo_logsrvd would not accept a restore point
    of zero.
  * Fixed a bug in visudo where the value of the editor setting was
    not used if it did not match the user?s EDITOR environment
    variable. This was only a problem if the env_editor setting was
    not enabled. Bug #1000.
  * Sudo now builds with the -fcf-protection compiler option and the
  - z now linker option if supported.
  * The output of sudoreplay -l now more closely matches the
    traditional sudo log format.
  * The sudo_sendlog utility will now use the full contents of the
    log.json file, if present. This makes it possible to send
    sudo-format I/O logs that use the newer log.json format to
    sudo_logsrvd without losing any information.
  * Fixed compilation of the arc4random_buf() replacement on systems
    with arc4random() but no arc4random_buf(). Bug #1008.
  * Sudo now uses its own getentropy() by default on Linux. The GNU
    libc version of getentropy() will fail on older kernels that
    don?t support the getrandom() system call.
  * It is now possible to build sudo with WolfSSL?s OpenSSL
    compatibility layer by using the --enable-wolfssl configure
    option.
  * Fixed a bug related to Daylight Saving Time when parsing
    timestamps in Generalized Time format. This affected the NOTBEFORE
    and NOTAFTER options in sudoers. Bug #1006.
  * Added the -O and -P options to visudo, which can be used to check
    or set the owner and permissions. This can be used in conjunction
    with the -c option to check that the sudoers file ownership and
    permissions are correct. Bug #1007.
  * It is now possible to set resource limits in the sudoers file
    itself. The special values default and ?user? refer to the
    default system limit and invoking user limit respectively. The
    core dump size limit is now set to 0 by default unless overridden
    by the sudoers file.
  * The cvtsudoers utility can now merge multiple sudoers sources into
    a single, combined sudoers file. If there are conflicting entries,
    cvtsudoers will attempt to resolve them but manual intervention
    may be required. The merging of sudoers rules is currently fairly
    simplistic but will be improved in a future release.
  * Sudo was parsing but not applying the ?deref? and ?tls_reqcert?
    ldap.conf settings. This meant the options were effectively ignored
    which broke dereferencing of aliases in LDAP. Bug #1013.
  * Clarified in the sudo man page that the security policy may
    override the user?s PATH environment variable. Bug #1014.
  * When sudo is run in non-interactive mode (with the -n option), it
    will now attempt PAM authentication and only exit with an error if
    user interaction is required. This allows PAM modules that don?t
    interact with the user to succeed. Previously, sudo would not
    attempt authentication if the -n option was specified. Bug #956
    and GitHub issue #83.
  * Fixed a regression introduced in version 1.9.1 when sudo is built
    with the --with-fqdn configure option. The local host name was
    being resolved before the sudoers file was processed, making it
    impossible to disable DNS lookups by negating the fqdn sudoers
    option. Bug #1016.
  * Added support for negated sudoUser attributes in the LDAP and SSSD
    sudoers back ends. A matching sudoUser that is negated will cause
    the sudoRole containing it to be ignored.
  * Fixed a bug where the stack resource limit could be set to a value
    smaller than that of the invoking user and not be reset before the
    command was run. Bug #1016.
- sudo no longer ships schema for LDAP.
- sudo-feature-negated-LDAP-users.patch dropped, included upstream
- refreshed sudo-sudoers.patch</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.9-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1662811200">- Modified sudo-sudoers.patch
  * bsc#1177578
  * Removed redundant and confusing 'secure_path' settings in
    sudo-sudoers file.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1669032000">- Added sudo-utf8-ldap-schema.patch
  * Change sudo-ldap schema from ASCII to UTF8.
  * Fixes bsc#1197998
  * Credit to William Brown &lt;william.brown@suse.com&gt;
  * https://github.com/sudo-project/sudo/pull/163</changelog>
</package>
<package pkgid="249c65ac47e9cc94148733e1c7d0058ddc4f2b2afdc114c8540365502a301b20" name="supportutils" arch="noarch">
  <version epoch="0" ver="3.1.21" rel="150300.7.35.15.1"/>
  <changelog author="jason.record@gmail.com" date="1616414400">- [powerpc] Collect dynamic_debug log files for ibmvNIC #98 (bsc#1183826)</changelog>
  <changelog author="jason.record@suse.com" date="1618488000">- Additions to version 3.1.15
  + Added drbd-overview to drbd.txt
  + Added list-timers to systemd.txt (bsc#1169348)
  + Including nfs4 in search (bsc#1184829)
- Minor: Fix a typo (executible -&gt; executable) #99
- Changed minor wording to loaded module</changelog>
  <changelog author="jason.record@suse.com" date="1618833600">- Additions to version 3.1.15
  + Checks package signatures in rpm.txt (bsc#1021918)
  + Optimize find (bsc#1184912)
- Using zypper --xmlout (bsc#1181351)
- Error fix for sysfs.txt (bsc#1089870)</changelog>
  <changelog author="jason.record@suse.com" date="1620820800">- getappcore checks for valid compression binary (bsc#1185991)
- getappcore does not trigger errors with help message (bsc#1185993)</changelog>
  <changelog author="jason.record@suse.com" date="1621857600">- analyzevmcore supports local directories (bsc#1186397)</changelog>
  <changelog author="jason.record@suse.com" date="1622116800">- Fixes to supportconfig
  + Exclude rhn.conf from etc.txt (bsc#1186347)</changelog>
  <changelog author="jason.record@suse.com" date="1623067200">- Changes to version 3.1.16
  + lsof options to improve performance (bsc#1186687)</changelog>
  <changelog author="jason.record@suse.com" date="1625572800">- Changes to version 3.1.17
  + Adding ethtool options g l m to network.txt (jsc#SLE-18240)</changelog>
  <changelog author="jason.record@suse.com" date="1629115200">- Changes to version 3.1.18
  + Added email.txt based on OPTION_EMAIL #108 (bsc#1189028)
  + Include 'multipath -t' output in mpio.txt #105
  + Improved lsblk readability with --ascsi #106
  + Removed duplicate commands in network.txt
  + Remove duplicate firewalld status output #109</changelog>
  <changelog author="jason.record@suse.com" date="1631102400">- Fixed cron package for RPM validation (bsc#1190315)
- Updated spec file with correct URL</changelog>
  <changelog author="jason.record@suse.com" date="1633348800">- Installing to /usr/sbin instead of /sbin (bsc#1191096)
- Added shared memory as a log directory for emergency use (bsc#1190943)</changelog>
  <changelog author="jason.record@suse.com" date="1634558400">- getappcore identifies compressed core files (bsc#1191794)</changelog>
  <changelog author="jason.record@suse.com" date="1637150400">- Merged Include udev rules in /lib/udev/rules.d/ #113
- Merged Move localmessage/warm logs out of messages.txt to new localwarn.txt #87</changelog>
  <changelog author="jason.record@suse.com" date="1639569600">- Changes to version 3.1.19
  + Removed chronyc DNS lookups with -n switch (bsc#1193732)</changelog>
  <changelog author="jason.record@suse.com" date="1641816000">- Changes to version 3.1.19
  + Made /proc directory and network names spaces configurable (bsc#1193868)</changelog>
  <changelog author="jason.record@suse.com" date="1646395200">- Changes to version 3.1.20
  + Added command blkid #114
  + Added s390x specific files and output #115
  + Fix for invalid argument during updates (bsc#1193204)
  + Optimized conf_files, conf_files_text and log_cmd functions #118
  + Fixed iscsi initiator name (bsc#1195797)
  + Added rpcinfo -p output #116
  + Included /etc/sssd/conf.d configuration files #100</changelog>
  <changelog author="jason.record@suse.com" date="1647345600">- Spec file adjusted for usr-merge</changelog>
  <changelog author="jason.record@suse.com" date="1654171200">- Added a listing to /dev/mapper/. #129</changelog>
  <changelog author="jason.record@suse.com" date="1666094400">- Changes to version 3.1.21
  + Added type output with df command in fs-diskio.txt (issue#141)
  + Gather all files in /etc/security/limits.d/ (issue#142)
  + Fixed KVM virtualization detection on bare metal (bsc#1184689)
  + Added logging using journalctl (bsc#1200330)
  + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818)
  + Added system logging configuration and checking in messages_config.txt (issue#103)
  + If rsyslog not installed collect more from journalctl (issue#120)
  + Added systemd-status.txt for the status of all service units (issue#125)
  + autofs includes files in (+dir:&lt;path&gt;) (issue#111)
  + Get current sar data before collecting files (bsc#1192648)
  + Collects everything in /etc/multipath/ (bsc#1192252)
  + Collects power management information in hardware.txt (bsc#1197428)
  + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337)
  + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269)
  + Update to nvme_info and block_info #133 (bsc#1202417)
  + Added IO scheduler (issue#136)
  + Added includedir directories from /etc/sudoers (bsc#1188086)</changelog>
  <changelog author="jason.record@suse.com" date="1666094401">- Added lifecycle information (issue#140)</changelog>
</package>
<package pkgid="ddeb2c4af38da54c6f3a098341a396fb842cb9a0e927f18e1976698cdbb667fc" name="supportutils" arch="src">
  <version epoch="0" ver="3.1.21" rel="150300.7.35.15.1"/>
  <changelog author="jason.record@gmail.com" date="1616414400">- [powerpc] Collect dynamic_debug log files for ibmvNIC #98 (bsc#1183826)</changelog>
  <changelog author="jason.record@suse.com" date="1618488000">- Additions to version 3.1.15
  + Added drbd-overview to drbd.txt
  + Added list-timers to systemd.txt (bsc#1169348)
  + Including nfs4 in search (bsc#1184829)
- Minor: Fix a typo (executible -&gt; executable) #99
- Changed minor wording to loaded module</changelog>
  <changelog author="jason.record@suse.com" date="1618833600">- Additions to version 3.1.15
  + Checks package signatures in rpm.txt (bsc#1021918)
  + Optimize find (bsc#1184912)
- Using zypper --xmlout (bsc#1181351)
- Error fix for sysfs.txt (bsc#1089870)</changelog>
  <changelog author="jason.record@suse.com" date="1620820800">- getappcore checks for valid compression binary (bsc#1185991)
- getappcore does not trigger errors with help message (bsc#1185993)</changelog>
  <changelog author="jason.record@suse.com" date="1621857600">- analyzevmcore supports local directories (bsc#1186397)</changelog>
  <changelog author="jason.record@suse.com" date="1622116800">- Fixes to supportconfig
  + Exclude rhn.conf from etc.txt (bsc#1186347)</changelog>
  <changelog author="jason.record@suse.com" date="1623067200">- Changes to version 3.1.16
  + lsof options to improve performance (bsc#1186687)</changelog>
  <changelog author="jason.record@suse.com" date="1625572800">- Changes to version 3.1.17
  + Adding ethtool options g l m to network.txt (jsc#SLE-18240)</changelog>
  <changelog author="jason.record@suse.com" date="1629115200">- Changes to version 3.1.18
  + Added email.txt based on OPTION_EMAIL #108 (bsc#1189028)
  + Include 'multipath -t' output in mpio.txt #105
  + Improved lsblk readability with --ascsi #106
  + Removed duplicate commands in network.txt
  + Remove duplicate firewalld status output #109</changelog>
  <changelog author="jason.record@suse.com" date="1631102400">- Fixed cron package for RPM validation (bsc#1190315)
- Updated spec file with correct URL</changelog>
  <changelog author="jason.record@suse.com" date="1633348800">- Installing to /usr/sbin instead of /sbin (bsc#1191096)
- Added shared memory as a log directory for emergency use (bsc#1190943)</changelog>
  <changelog author="jason.record@suse.com" date="1634558400">- getappcore identifies compressed core files (bsc#1191794)</changelog>
  <changelog author="jason.record@suse.com" date="1637150400">- Merged Include udev rules in /lib/udev/rules.d/ #113
- Merged Move localmessage/warm logs out of messages.txt to new localwarn.txt #87</changelog>
  <changelog author="jason.record@suse.com" date="1639569600">- Changes to version 3.1.19
  + Removed chronyc DNS lookups with -n switch (bsc#1193732)</changelog>
  <changelog author="jason.record@suse.com" date="1641816000">- Changes to version 3.1.19
  + Made /proc directory and network names spaces configurable (bsc#1193868)</changelog>
  <changelog author="jason.record@suse.com" date="1646395200">- Changes to version 3.1.20
  + Added command blkid #114
  + Added s390x specific files and output #115
  + Fix for invalid argument during updates (bsc#1193204)
  + Optimized conf_files, conf_files_text and log_cmd functions #118
  + Fixed iscsi initiator name (bsc#1195797)
  + Added rpcinfo -p output #116
  + Included /etc/sssd/conf.d configuration files #100</changelog>
  <changelog author="jason.record@suse.com" date="1647345600">- Spec file adjusted for usr-merge</changelog>
  <changelog author="jason.record@suse.com" date="1654171200">- Added a listing to /dev/mapper/. #129</changelog>
  <changelog author="jason.record@suse.com" date="1666094400">- Changes to version 3.1.21
  + Added type output with df command in fs-diskio.txt (issue#141)
  + Gather all files in /etc/security/limits.d/ (issue#142)
  + Fixed KVM virtualization detection on bare metal (bsc#1184689)
  + Added logging using journalctl (bsc#1200330)
  + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818)
  + Added system logging configuration and checking in messages_config.txt (issue#103)
  + If rsyslog not installed collect more from journalctl (issue#120)
  + Added systemd-status.txt for the status of all service units (issue#125)
  + autofs includes files in (+dir:&lt;path&gt;) (issue#111)
  + Get current sar data before collecting files (bsc#1192648)
  + Collects everything in /etc/multipath/ (bsc#1192252)
  + Collects power management information in hardware.txt (bsc#1197428)
  + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337)
  + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269)
  + Update to nvme_info and block_info #133 (bsc#1202417)
  + Added IO scheduler (issue#136)
  + Added includedir directories from /etc/sudoers (bsc#1188086)</changelog>
  <changelog author="jason.record@suse.com" date="1666094401">- Added lifecycle information (issue#140)</changelog>
</package>
<package pkgid="4b2eed06f29ad50f9b8c236675d5b6e9ee8ba37bd63afe88b2fc67545a156638" name="suse-build-key" arch="noarch">
  <version epoch="0" ver="12.0" rel="150000.8.31.1"/>
  <changelog author="ro@suse.de" date="1480420800">- use dumpsigs script from openSUSE to merge code</changelog>
  <changelog author="meissner@suse.com" date="1481112000">- extend the build@suse.de product key. (bsc#1014151)
  pub  2048R/39DB7C82 2013-01-31 [expires: 2020-12-06]
  uid                            SuSE Package Signing Key &lt;build@suse.de&gt;</changelog>
  <changelog author="meissner@suse.com" date="1522238400">- created a new security@suse.de communication key. (bsc#1082022)
- extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512)</changelog>
  <changelog author="meissner@suse.com" date="1542110400">- include ptf key in the key directory to avoid it being
  stripped via %doc stripping. (bsc#1044232)</changelog>
  <changelog author="meissner@suse.com" date="1583928000">- created a new security@suse.de communication key (bsc#1166334)</changelog>
  <changelog author="meissner@suse.com" date="1587643200">- add a /usr/share/container-keys/ directory for GPG based Container
  verification.
- Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1597320000">- actually the container key is different from the build signing
  key. (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1600689600">- suse build key extended (bsc#1176759)
  gpg-pubkey-39db7c82-5847eb1f.asc -&gt; gpg-pubkey-39db7c82-5f68629b.asc</changelog>
  <changelog author="meissner@suse.com" date="1645099200">- extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc
- added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494)
- extended expiry of SUSE SLES11 key (bsc#1194845)
- added SUSE Contaner signing key in PEM format for use e.g. by cosign.
- SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495)</changelog>
  <changelog author="meissner@suse.com" date="1648123200">- No longer install 1024bit keys by default. (bsc#1197293)
  - SLE11 key moved to documentation
  - old PTF (pre March 2022) moved to documentation only</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- still ship the old ptf key (was not added to documentation by mistake).
  (bsc#1198504)</changelog>
  <changelog author="meissner@suse.com" date="1666699200">- added /usr/share/pki/containers directory for container pem keys
  (cosign/sigstore style), put our PEM key there too (bsc#1204706)</changelog>
  <changelog author="meissner@suse.com" date="1675771200">- Establish multiple new 4096 RSA keys that we will switch
  to mid of 2023. (jsc#PED-2777)
  - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos).
  - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos).
  - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs.
  - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem:
    new RSA 4096 key for the SUSE registry registry.suse.com, installed as
    suse-container-key-2023.pem and suse-container-key-2023.asc
  - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem:
    New PTF container signing key for registry.suse.com/ptf/ space.</changelog>
</package>
<package pkgid="f3571753f1d9bd006508b6f50f5f2fb81ba95bbd93df9e6615e4bd8f1337a605" name="suse-build-key" arch="src">
  <version epoch="0" ver="12.0" rel="150000.8.31.1"/>
  <changelog author="ro@suse.de" date="1358164800">- added reserve key for SLES (fate#312896)
  50A3DD1C SuSE Package Signing Key (reserve key) &lt;build@suse.de&gt;
  valid until (2017-01-13)</changelog>
  <changelog author="ro@suse.de" date="1359633600">- added future signing key for SLES (fate#314767) (bnc#801055)
  using 2048 bit rsa key</changelog>
  <changelog author="meissner@suse.com" date="1389268800">- Merged over logic from openSUSE-build-key.
- Got rid of default importing into roots keyring.
- Removed some old keys.
- Clarify that security@suse.de is a email only key
- PTF key is supplied also as %doc, to not be default
  imported.
- Keys currently inside:
  - pub  2048R/39DB7C82 SuSE Package Signing Key &lt;build@suse.de&gt;
  - pub  2048R/50A3DD1C SuSE Package Signing Key (reserve key) &lt;build@suse.de&gt;
  - pub  1024D/B37B98A9 SUSE PTF Signing Key &lt;support@suse.com&gt;
  - pub  2048R/3D25D3D9 SuSE Security Team &lt;security@suse.de&gt;</changelog>
  <changelog author="meissner@suse.com" date="1389614400">- reverted to contain the fullkeyring build SLE12 Alpha.
- also list the old sle11 build@suse.de key temporary</changelog>
  <changelog author="meissner@suse.com" date="1392033600">- create suse-build-key.gpg during build.
- Remove old keys from keyring. (fate#314767)
  Keys currently inside the RPM trusted keyring:
  - pub  2048R/39DB7C82 SuSE Package Signing Key &lt;build@suse.de&gt;
  - pub  2048R/50A3DD1C SuSE Package Signing Key (reserve key) &lt;build@suse.de&gt;
- Various keys are moved to the documentation area
  (/usr/share/doc/packages/suse-build-key)
  - build-at-suse-sle11.asc: the old SUSE Linux Enterprise 11 key.
    if SUSE Linux Enterprise 11 packages need to be verified on
    a SUSE Linux Enterprise 12 system.
  - suse_ptf_key.asc: The suse ptf key. For verification of provided PTFs.
  - security_at_suse_de.asc: Use only for email encryption and
    verification purposes when contacting our security contact address
    security@suse.de</changelog>
  <changelog author="meissner@suse.com" date="1409313600">- Went to new method again.
  - suse-build-key.gpg blob dropped
  - ship seperate files</changelog>
  <changelog author="meissner@suse.com" date="1412251200">- renamed security_at_suse_de.asc to security_at_suse_de_old.asc
- security_at_suse_de.asc: new 4096 bit RSA key.
  pub  4096R/317CD502 2014-10-02 SUSE Security Team &lt;security@suse.de&gt;
  bnc#899509</changelog>
  <changelog author="ro@suse.de" date="1480420800">- use dumpsigs script from openSUSE to merge code</changelog>
  <changelog author="meissner@suse.com" date="1481112000">- extend the build@suse.de product key. (bsc#1014151)
  pub  2048R/39DB7C82 2013-01-31 [expires: 2020-12-06]
  uid                            SuSE Package Signing Key &lt;build@suse.de&gt;</changelog>
  <changelog author="meissner@suse.com" date="1522238400">- created a new security@suse.de communication key. (bsc#1082022)
- extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512)</changelog>
  <changelog author="meissner@suse.com" date="1542110400">- include ptf key in the key directory to avoid it being
  stripped via %doc stripping. (bsc#1044232)</changelog>
  <changelog author="meissner@suse.com" date="1583928000">- created a new security@suse.de communication key (bsc#1166334)</changelog>
  <changelog author="meissner@suse.com" date="1587643200">- add a /usr/share/container-keys/ directory for GPG based Container
  verification.
- Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1597320000">- actually the container key is different from the build signing
  key. (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1600689600">- suse build key extended (bsc#1176759)
  gpg-pubkey-39db7c82-5847eb1f.asc -&gt; gpg-pubkey-39db7c82-5f68629b.asc</changelog>
  <changelog author="meissner@suse.com" date="1645099200">- extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc
- added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494)
- extended expiry of SUSE SLES11 key (bsc#1194845)
- added SUSE Contaner signing key in PEM format for use e.g. by cosign.
- SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495)</changelog>
  <changelog author="meissner@suse.com" date="1648123200">- No longer install 1024bit keys by default. (bsc#1197293)
  - SLE11 key moved to documentation
  - old PTF (pre March 2022) moved to documentation only</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- still ship the old ptf key (was not added to documentation by mistake).
  (bsc#1198504)</changelog>
  <changelog author="meissner@suse.com" date="1666699200">- added /usr/share/pki/containers directory for container pem keys
  (cosign/sigstore style), put our PEM key there too (bsc#1204706)</changelog>
  <changelog author="meissner@suse.com" date="1675771200">- Establish multiple new 4096 RSA keys that we will switch
  to mid of 2023. (jsc#PED-2777)
  - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos).
  - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos).
  - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs.
  - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem:
    new RSA 4096 key for the SUSE registry registry.suse.com, installed as
    suse-container-key-2023.pem and suse-container-key-2023.asc
  - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem:
    New PTF container signing key for registry.suse.com/ptf/ space.</changelog>
</package>
<package pkgid="ca8834f774ea6162050a57e734d4f284da2630abf3f6a781f65fb391331f1d4b" name="suse-module-tools" arch="aarch64">
  <version epoch="0" ver="15.4.15" rel="150400.3.5.1"/>
  <changelog author="mwilck@suse.com" date="1598356800">- Update to version 15.3.4:
  * spec: rework dependencies</changelog>
  <changelog author="mwilck@suse.com" date="1604318400">- Update to version 15.3.5:
  * Skip coldplug for memory devices on ppc64le, using generator</changelog>
  <changelog author="mwilck@suse.com" date="1605873600">- Add bugref for bsc#1174287 and bsc#1172745
  * The workaround for these was in 15.3.5 already.</changelog>
  <changelog author="mwilck@suse.com" date="1619092800">- Update to version 15.3.6:
  * dm-crypt requires essiv in SLE15 SP3 (boo#1183063 bsc#1184134 ltc#192244).</changelog>
  <changelog author="mwilck@suse.com" date="1623931200">- Update to version 15.3.7:
  * Fix treatment of compressed modules (bsc#1187093)</changelog>
  <changelog author="mwilck@suse.com" date="1625572800">- Update to version 15.3.8:
  * modprobe.d: Remove dma=none setting for parport_pc
    (bsc#1177695)</changelog>
  <changelog author="mwilck@suse.com" date="1628856000">- Update to version 15.4.2
- Move config files to /lib/modprobe.d and /lib/depmod.d
  (jsc#SLE-20639)
  * "modprobe $FS" for a blacklisted file system now offers to
    unblacklist the module permanently
  * disabled automatic un-blacklisting of filesystem modules loaded
    at installation time
- Replace mkinitrd with dracut everywhere (jsc#SLE-20348)
- Add faster substitute for lsinitrd to speed up weak-modules2
  (jsc#SLE-9078)
- Enable f2fs
- Add a "Supplements" dependency on dkms to the "legacy" submodule
  (dkms needs "weak-modules")
- modprobe.d cleanups and fixes:
  * Unify ppc64 and ppc64le
  * Delete files for obsolete architectures
  * Remove obsolete SUSE_INITRD statements (bsc#1161343)
  * Remove dma=none setting for parport_pc (bsc#1177695)
- Add README.md</changelog>
  <changelog author="mwilck@suse.com" date="1629374400">- Update to version 15.4.3:
  * fix problem that initrd may not be rebuilt after installing
    kernel-$flavor-extra (bsc#1189441)</changelog>
  <changelog author="mwilck@suse.com" date="1633089600">- Update to version 15.4.4:
  * Import kernel scriptlets from kernel-source
    (bsc#1189841, bsc#1190598)
  * Provide "suse-kernel-rpm-scriptlets"</changelog>
  <changelog author="mwilck@suse.com" date="1633348800">- Update to version 15.4.5:
  * inkmp-script(postun): don't pass  existing files to weak-modules2
    (boo#1191200)
  * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
    (boo#1191260)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 15.4.6:
  * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
  * cert-script: Deal with existing $cert.delete file (bsc#1191804).
  * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
  * cert-script: Only print mokutil output in verbose mode.</changelog>
  <changelog author="mwilck@suse.com" date="1634904001">- Update to version 15.4.7:
  * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)"</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Update to version 15.4.8:
  * Same as Factory version 16.0.14
  * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE).
    Both packages are now both obsoleted by suse-module-tools.
    (jsc#SLE-21032)
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="mwilck@suse.com" date="1639396800">- Update to version 15.4.9:
  * same as Factory version 16.0.16
  * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059)
  - Rather than shipping two large files with modprobe.d options
    (00-system.conf and 50-blacklist.conf), ship multiple small
    per-module files. This makes it easier for users to override
    distribution defaults.
  * blacklist isst_if_mbox_msr (bsc#1187196)
  * boot-sysctl: make sure file exists (fix for containers)
  * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718)</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">- Update to version 15.4.10:
  * same as Factory version 16.0.17
  * 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)
  * install some modprobe.d files only for relevant architectures
    (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974)</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 15.4.11:
  * cdrom: Disable autoclose by default (boo#1165047).
  * Make regenerate-initrd-posttrans compatible with Dracut's
    UEFI mode (unified kernel image)</changelog>
  <changelog author="mwilck@suse.com" date="1643371200">- Update to version 15.4.12:
  * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
  * rpm-script: force-copy kernel to /boot (boo#1194501)</changelog>
  <changelog author="mwilck@suse.com" date="1667563200">- Update to version 15.4.13:
  * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 15.4.14:
  * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032001">- Update to version 15.4.15: Backport bug fixes from factory
  * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
  * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
  * driver-check.sh: avoid false positive error messages (boo#1200107)</changelog>
</package>
<package pkgid="c291fc1c3d04d2548d7d572afb73d35a769533092a7f0537c674fa23530db33b" name="suse-module-tools" arch="src">
  <version epoch="0" ver="15.4.15" rel="150400.3.5.1"/>
  <changelog author="mwilck@suse.com" date="1598356800">- Update to version 15.3.4:
  * spec: rework dependencies</changelog>
  <changelog author="mwilck@suse.com" date="1604318400">- Update to version 15.3.5:
  * Skip coldplug for memory devices on ppc64le, using generator</changelog>
  <changelog author="mwilck@suse.com" date="1605873600">- Add bugref for bsc#1174287 and bsc#1172745
  * The workaround for these was in 15.3.5 already.</changelog>
  <changelog author="mwilck@suse.com" date="1619092800">- Update to version 15.3.6:
  * dm-crypt requires essiv in SLE15 SP3 (boo#1183063 bsc#1184134 ltc#192244).</changelog>
  <changelog author="mwilck@suse.com" date="1623931200">- Update to version 15.3.7:
  * Fix treatment of compressed modules (bsc#1187093)</changelog>
  <changelog author="mwilck@suse.com" date="1625572800">- Update to version 15.3.8:
  * modprobe.d: Remove dma=none setting for parport_pc
    (bsc#1177695)</changelog>
  <changelog author="mwilck@suse.com" date="1628856000">- Update to version 15.4.2
- Move config files to /lib/modprobe.d and /lib/depmod.d
  (jsc#SLE-20639)
  * "modprobe $FS" for a blacklisted file system now offers to
    unblacklist the module permanently
  * disabled automatic un-blacklisting of filesystem modules loaded
    at installation time
- Replace mkinitrd with dracut everywhere (jsc#SLE-20348)
- Add faster substitute for lsinitrd to speed up weak-modules2
  (jsc#SLE-9078)
- Enable f2fs
- Add a "Supplements" dependency on dkms to the "legacy" submodule
  (dkms needs "weak-modules")
- modprobe.d cleanups and fixes:
  * Unify ppc64 and ppc64le
  * Delete files for obsolete architectures
  * Remove obsolete SUSE_INITRD statements (bsc#1161343)
  * Remove dma=none setting for parport_pc (bsc#1177695)
- Add README.md</changelog>
  <changelog author="mwilck@suse.com" date="1629374400">- Update to version 15.4.3:
  * fix problem that initrd may not be rebuilt after installing
    kernel-$flavor-extra (bsc#1189441)</changelog>
  <changelog author="mwilck@suse.com" date="1633089600">- Update to version 15.4.4:
  * Import kernel scriptlets from kernel-source
    (bsc#1189841, bsc#1190598)
  * Provide "suse-kernel-rpm-scriptlets"</changelog>
  <changelog author="mwilck@suse.com" date="1633348800">- Update to version 15.4.5:
  * inkmp-script(postun): don't pass  existing files to weak-modules2
    (boo#1191200)
  * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
    (boo#1191260)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 15.4.6:
  * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
  * cert-script: Deal with existing $cert.delete file (bsc#1191804).
  * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
  * cert-script: Only print mokutil output in verbose mode.</changelog>
  <changelog author="mwilck@suse.com" date="1634904001">- Update to version 15.4.7:
  * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)"</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Update to version 15.4.8:
  * Same as Factory version 16.0.14
  * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE).
    Both packages are now both obsoleted by suse-module-tools.
    (jsc#SLE-21032)
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="mwilck@suse.com" date="1639396800">- Update to version 15.4.9:
  * same as Factory version 16.0.16
  * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059)
  - Rather than shipping two large files with modprobe.d options
    (00-system.conf and 50-blacklist.conf), ship multiple small
    per-module files. This makes it easier for users to override
    distribution defaults.
  * blacklist isst_if_mbox_msr (bsc#1187196)
  * boot-sysctl: make sure file exists (fix for containers)
  * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718)</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">- Update to version 15.4.10:
  * same as Factory version 16.0.17
  * 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)
  * install some modprobe.d files only for relevant architectures
    (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974)</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 15.4.11:
  * cdrom: Disable autoclose by default (boo#1165047).
  * Make regenerate-initrd-posttrans compatible with Dracut's
    UEFI mode (unified kernel image)</changelog>
  <changelog author="mwilck@suse.com" date="1643371200">- Update to version 15.4.12:
  * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
  * rpm-script: force-copy kernel to /boot (boo#1194501)</changelog>
  <changelog author="mwilck@suse.com" date="1667563200">- Update to version 15.4.13:
  * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 15.4.14:
  * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032001">- Update to version 15.4.15: Backport bug fixes from factory
  * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
  * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
  * driver-check.sh: avoid false positive error messages (boo#1200107)</changelog>
</package>
<package pkgid="5a2e3b03eaaa712f16cff0a5980a1c4d88d3b16ec1e80b3d474ae018f7e3a583" name="suse-module-tools" arch="x86_64">
  <version epoch="0" ver="15.4.15" rel="150400.3.5.1"/>
  <changelog author="mwilck@suse.com" date="1598356800">- Update to version 15.3.4:
  * spec: rework dependencies</changelog>
  <changelog author="mwilck@suse.com" date="1604318400">- Update to version 15.3.5:
  * Skip coldplug for memory devices on ppc64le, using generator</changelog>
  <changelog author="mwilck@suse.com" date="1605873600">- Add bugref for bsc#1174287 and bsc#1172745
  * The workaround for these was in 15.3.5 already.</changelog>
  <changelog author="mwilck@suse.com" date="1619092800">- Update to version 15.3.6:
  * dm-crypt requires essiv in SLE15 SP3 (boo#1183063 bsc#1184134 ltc#192244).</changelog>
  <changelog author="mwilck@suse.com" date="1623931200">- Update to version 15.3.7:
  * Fix treatment of compressed modules (bsc#1187093)</changelog>
  <changelog author="mwilck@suse.com" date="1625572800">- Update to version 15.3.8:
  * modprobe.d: Remove dma=none setting for parport_pc
    (bsc#1177695)</changelog>
  <changelog author="mwilck@suse.com" date="1628856000">- Update to version 15.4.2
- Move config files to /lib/modprobe.d and /lib/depmod.d
  (jsc#SLE-20639)
  * "modprobe $FS" for a blacklisted file system now offers to
    unblacklist the module permanently
  * disabled automatic un-blacklisting of filesystem modules loaded
    at installation time
- Replace mkinitrd with dracut everywhere (jsc#SLE-20348)
- Add faster substitute for lsinitrd to speed up weak-modules2
  (jsc#SLE-9078)
- Enable f2fs
- Add a "Supplements" dependency on dkms to the "legacy" submodule
  (dkms needs "weak-modules")
- modprobe.d cleanups and fixes:
  * Unify ppc64 and ppc64le
  * Delete files for obsolete architectures
  * Remove obsolete SUSE_INITRD statements (bsc#1161343)
  * Remove dma=none setting for parport_pc (bsc#1177695)
- Add README.md</changelog>
  <changelog author="mwilck@suse.com" date="1629374400">- Update to version 15.4.3:
  * fix problem that initrd may not be rebuilt after installing
    kernel-$flavor-extra (bsc#1189441)</changelog>
  <changelog author="mwilck@suse.com" date="1633089600">- Update to version 15.4.4:
  * Import kernel scriptlets from kernel-source
    (bsc#1189841, bsc#1190598)
  * Provide "suse-kernel-rpm-scriptlets"</changelog>
  <changelog author="mwilck@suse.com" date="1633348800">- Update to version 15.4.5:
  * inkmp-script(postun): don't pass  existing files to weak-modules2
    (boo#1191200)
  * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
    (boo#1191260)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 15.4.6:
  * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
  * cert-script: Deal with existing $cert.delete file (bsc#1191804).
  * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
  * cert-script: Only print mokutil output in verbose mode.</changelog>
  <changelog author="mwilck@suse.com" date="1634904001">- Update to version 15.4.7:
  * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)"</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Update to version 15.4.8:
  * Same as Factory version 16.0.14
  * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE).
    Both packages are now both obsoleted by suse-module-tools.
    (jsc#SLE-21032)
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="mwilck@suse.com" date="1639396800">- Update to version 15.4.9:
  * same as Factory version 16.0.16
  * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059)
  - Rather than shipping two large files with modprobe.d options
    (00-system.conf and 50-blacklist.conf), ship multiple small
    per-module files. This makes it easier for users to override
    distribution defaults.
  * blacklist isst_if_mbox_msr (bsc#1187196)
  * boot-sysctl: make sure file exists (fix for containers)
  * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718)</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">- Update to version 15.4.10:
  * same as Factory version 16.0.17
  * 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)
  * install some modprobe.d files only for relevant architectures
    (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974)</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 15.4.11:
  * cdrom: Disable autoclose by default (boo#1165047).
  * Make regenerate-initrd-posttrans compatible with Dracut's
    UEFI mode (unified kernel image)</changelog>
  <changelog author="mwilck@suse.com" date="1643371200">- Update to version 15.4.12:
  * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
  * rpm-script: force-copy kernel to /boot (boo#1194501)</changelog>
  <changelog author="mwilck@suse.com" date="1667563200">- Update to version 15.4.13:
  * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 15.4.14:
  * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032001">- Update to version 15.4.15: Backport bug fixes from factory
  * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
  * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
  * driver-check.sh: avoid false positive error messages (boo#1200107)</changelog>
</package>
<package pkgid="1a38f599c73b7a2329afa63954b349a78860751f62174349850061ebdf2fd5f8" name="suse-module-tools" arch="aarch64">
  <version epoch="0" ver="15.4.16" rel="150400.3.8.1"/>
  <changelog author="mwilck@suse.com" date="1604318400">- Update to version 15.3.5:
  * Skip coldplug for memory devices on ppc64le, using generator</changelog>
  <changelog author="mwilck@suse.com" date="1605873600">- Add bugref for bsc#1174287 and bsc#1172745
  * The workaround for these was in 15.3.5 already.</changelog>
  <changelog author="mwilck@suse.com" date="1619092800">- Update to version 15.3.6:
  * dm-crypt requires essiv in SLE15 SP3 (boo#1183063 bsc#1184134 ltc#192244).</changelog>
  <changelog author="mwilck@suse.com" date="1623931200">- Update to version 15.3.7:
  * Fix treatment of compressed modules (bsc#1187093)</changelog>
  <changelog author="mwilck@suse.com" date="1625572800">- Update to version 15.3.8:
  * modprobe.d: Remove dma=none setting for parport_pc
    (bsc#1177695)</changelog>
  <changelog author="mwilck@suse.com" date="1628856000">- Update to version 15.4.2
- Move config files to /lib/modprobe.d and /lib/depmod.d
  (jsc#SLE-20639)
  * "modprobe $FS" for a blacklisted file system now offers to
    unblacklist the module permanently
  * disabled automatic un-blacklisting of filesystem modules loaded
    at installation time
- Replace mkinitrd with dracut everywhere (jsc#SLE-20348)
- Add faster substitute for lsinitrd to speed up weak-modules2
  (jsc#SLE-9078)
- Enable f2fs
- Add a "Supplements" dependency on dkms to the "legacy" submodule
  (dkms needs "weak-modules")
- modprobe.d cleanups and fixes:
  * Unify ppc64 and ppc64le
  * Delete files for obsolete architectures
  * Remove obsolete SUSE_INITRD statements (bsc#1161343)
  * Remove dma=none setting for parport_pc (bsc#1177695)
- Add README.md</changelog>
  <changelog author="mwilck@suse.com" date="1629374400">- Update to version 15.4.3:
  * fix problem that initrd may not be rebuilt after installing
    kernel-$flavor-extra (bsc#1189441)</changelog>
  <changelog author="mwilck@suse.com" date="1633089600">- Update to version 15.4.4:
  * Import kernel scriptlets from kernel-source
    (bsc#1189841, bsc#1190598)
  * Provide "suse-kernel-rpm-scriptlets"</changelog>
  <changelog author="mwilck@suse.com" date="1633348800">- Update to version 15.4.5:
  * inkmp-script(postun): don't pass  existing files to weak-modules2
    (boo#1191200)
  * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
    (boo#1191260)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 15.4.6:
  * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
  * cert-script: Deal with existing $cert.delete file (bsc#1191804).
  * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
  * cert-script: Only print mokutil output in verbose mode.</changelog>
  <changelog author="mwilck@suse.com" date="1634904001">- Update to version 15.4.7:
  * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)"</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Update to version 15.4.8:
  * Same as Factory version 16.0.14
  * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE).
    Both packages are now both obsoleted by suse-module-tools.
    (jsc#SLE-21032)
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="mwilck@suse.com" date="1639396800">- Update to version 15.4.9:
  * same as Factory version 16.0.16
  * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059)
  - Rather than shipping two large files with modprobe.d options
    (00-system.conf and 50-blacklist.conf), ship multiple small
    per-module files. This makes it easier for users to override
    distribution defaults.
  * blacklist isst_if_mbox_msr (bsc#1187196)
  * boot-sysctl: make sure file exists (fix for containers)
  * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718)</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">- Update to version 15.4.10:
  * same as Factory version 16.0.17
  * 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)
  * install some modprobe.d files only for relevant architectures
    (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974)</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 15.4.11:
  * cdrom: Disable autoclose by default (boo#1165047).
  * Make regenerate-initrd-posttrans compatible with Dracut's
    UEFI mode (unified kernel image)</changelog>
  <changelog author="mwilck@suse.com" date="1643371200">- Update to version 15.4.12:
  * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
  * rpm-script: force-copy kernel to /boot (boo#1194501)</changelog>
  <changelog author="mwilck@suse.com" date="1667563200">- Update to version 15.4.13:
  * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 15.4.14:
  * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032001">- Update to version 15.4.15: Backport bug fixes from factory
  * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
  * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
  * driver-check.sh: avoid false positive error messages (boo#1200107)</changelog>
  <changelog author="mwilck@suse.com" date="1675339200">- Update to version 15.4.16:
  * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853)</changelog>
</package>
<package pkgid="cdc634971d987f058fa496b42b8aad082d183220d800fbc174fbbac0fa810088" name="suse-module-tools" arch="src">
  <version epoch="0" ver="15.4.16" rel="150400.3.8.1"/>
  <changelog author="mwilck@suse.com" date="1604318400">- Update to version 15.3.5:
  * Skip coldplug for memory devices on ppc64le, using generator</changelog>
  <changelog author="mwilck@suse.com" date="1605873600">- Add bugref for bsc#1174287 and bsc#1172745
  * The workaround for these was in 15.3.5 already.</changelog>
  <changelog author="mwilck@suse.com" date="1619092800">- Update to version 15.3.6:
  * dm-crypt requires essiv in SLE15 SP3 (boo#1183063 bsc#1184134 ltc#192244).</changelog>
  <changelog author="mwilck@suse.com" date="1623931200">- Update to version 15.3.7:
  * Fix treatment of compressed modules (bsc#1187093)</changelog>
  <changelog author="mwilck@suse.com" date="1625572800">- Update to version 15.3.8:
  * modprobe.d: Remove dma=none setting for parport_pc
    (bsc#1177695)</changelog>
  <changelog author="mwilck@suse.com" date="1628856000">- Update to version 15.4.2
- Move config files to /lib/modprobe.d and /lib/depmod.d
  (jsc#SLE-20639)
  * "modprobe $FS" for a blacklisted file system now offers to
    unblacklist the module permanently
  * disabled automatic un-blacklisting of filesystem modules loaded
    at installation time
- Replace mkinitrd with dracut everywhere (jsc#SLE-20348)
- Add faster substitute for lsinitrd to speed up weak-modules2
  (jsc#SLE-9078)
- Enable f2fs
- Add a "Supplements" dependency on dkms to the "legacy" submodule
  (dkms needs "weak-modules")
- modprobe.d cleanups and fixes:
  * Unify ppc64 and ppc64le
  * Delete files for obsolete architectures
  * Remove obsolete SUSE_INITRD statements (bsc#1161343)
  * Remove dma=none setting for parport_pc (bsc#1177695)
- Add README.md</changelog>
  <changelog author="mwilck@suse.com" date="1629374400">- Update to version 15.4.3:
  * fix problem that initrd may not be rebuilt after installing
    kernel-$flavor-extra (bsc#1189441)</changelog>
  <changelog author="mwilck@suse.com" date="1633089600">- Update to version 15.4.4:
  * Import kernel scriptlets from kernel-source
    (bsc#1189841, bsc#1190598)
  * Provide "suse-kernel-rpm-scriptlets"</changelog>
  <changelog author="mwilck@suse.com" date="1633348800">- Update to version 15.4.5:
  * inkmp-script(postun): don't pass  existing files to weak-modules2
    (boo#1191200)
  * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
    (boo#1191260)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 15.4.6:
  * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
  * cert-script: Deal with existing $cert.delete file (bsc#1191804).
  * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
  * cert-script: Only print mokutil output in verbose mode.</changelog>
  <changelog author="mwilck@suse.com" date="1634904001">- Update to version 15.4.7:
  * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)"</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Update to version 15.4.8:
  * Same as Factory version 16.0.14
  * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE).
    Both packages are now both obsoleted by suse-module-tools.
    (jsc#SLE-21032)
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="mwilck@suse.com" date="1639396800">- Update to version 15.4.9:
  * same as Factory version 16.0.16
  * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059)
  - Rather than shipping two large files with modprobe.d options
    (00-system.conf and 50-blacklist.conf), ship multiple small
    per-module files. This makes it easier for users to override
    distribution defaults.
  * blacklist isst_if_mbox_msr (bsc#1187196)
  * boot-sysctl: make sure file exists (fix for containers)
  * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718)</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">- Update to version 15.4.10:
  * same as Factory version 16.0.17
  * 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)
  * install some modprobe.d files only for relevant architectures
    (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974)</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 15.4.11:
  * cdrom: Disable autoclose by default (boo#1165047).
  * Make regenerate-initrd-posttrans compatible with Dracut's
    UEFI mode (unified kernel image)</changelog>
  <changelog author="mwilck@suse.com" date="1643371200">- Update to version 15.4.12:
  * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
  * rpm-script: force-copy kernel to /boot (boo#1194501)</changelog>
  <changelog author="mwilck@suse.com" date="1667563200">- Update to version 15.4.13:
  * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 15.4.14:
  * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032001">- Update to version 15.4.15: Backport bug fixes from factory
  * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
  * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
  * driver-check.sh: avoid false positive error messages (boo#1200107)</changelog>
  <changelog author="mwilck@suse.com" date="1675339200">- Update to version 15.4.16:
  * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853)</changelog>
</package>
<package pkgid="c622135eec3d3cc4f425f5a3cf8a19da003a4235a6a0cf497d509c9edf8494a2" name="suse-module-tools" arch="x86_64">
  <version epoch="0" ver="15.4.16" rel="150400.3.8.1"/>
  <changelog author="mwilck@suse.com" date="1604318400">- Update to version 15.3.5:
  * Skip coldplug for memory devices on ppc64le, using generator</changelog>
  <changelog author="mwilck@suse.com" date="1605873600">- Add bugref for bsc#1174287 and bsc#1172745
  * The workaround for these was in 15.3.5 already.</changelog>
  <changelog author="mwilck@suse.com" date="1619092800">- Update to version 15.3.6:
  * dm-crypt requires essiv in SLE15 SP3 (boo#1183063 bsc#1184134 ltc#192244).</changelog>
  <changelog author="mwilck@suse.com" date="1623931200">- Update to version 15.3.7:
  * Fix treatment of compressed modules (bsc#1187093)</changelog>
  <changelog author="mwilck@suse.com" date="1625572800">- Update to version 15.3.8:
  * modprobe.d: Remove dma=none setting for parport_pc
    (bsc#1177695)</changelog>
  <changelog author="mwilck@suse.com" date="1628856000">- Update to version 15.4.2
- Move config files to /lib/modprobe.d and /lib/depmod.d
  (jsc#SLE-20639)
  * "modprobe $FS" for a blacklisted file system now offers to
    unblacklist the module permanently
  * disabled automatic un-blacklisting of filesystem modules loaded
    at installation time
- Replace mkinitrd with dracut everywhere (jsc#SLE-20348)
- Add faster substitute for lsinitrd to speed up weak-modules2
  (jsc#SLE-9078)
- Enable f2fs
- Add a "Supplements" dependency on dkms to the "legacy" submodule
  (dkms needs "weak-modules")
- modprobe.d cleanups and fixes:
  * Unify ppc64 and ppc64le
  * Delete files for obsolete architectures
  * Remove obsolete SUSE_INITRD statements (bsc#1161343)
  * Remove dma=none setting for parport_pc (bsc#1177695)
- Add README.md</changelog>
  <changelog author="mwilck@suse.com" date="1629374400">- Update to version 15.4.3:
  * fix problem that initrd may not be rebuilt after installing
    kernel-$flavor-extra (bsc#1189441)</changelog>
  <changelog author="mwilck@suse.com" date="1633089600">- Update to version 15.4.4:
  * Import kernel scriptlets from kernel-source
    (bsc#1189841, bsc#1190598)
  * Provide "suse-kernel-rpm-scriptlets"</changelog>
  <changelog author="mwilck@suse.com" date="1633348800">- Update to version 15.4.5:
  * inkmp-script(postun): don't pass  existing files to weak-modules2
    (boo#1191200)
  * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
    (boo#1191260)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 15.4.6:
  * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
  * cert-script: Deal with existing $cert.delete file (bsc#1191804).
  * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
  * cert-script: Only print mokutil output in verbose mode.</changelog>
  <changelog author="mwilck@suse.com" date="1634904001">- Update to version 15.4.7:
  * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)"</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Update to version 15.4.8:
  * Same as Factory version 16.0.14
  * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE).
    Both packages are now both obsoleted by suse-module-tools.
    (jsc#SLE-21032)
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="mwilck@suse.com" date="1639396800">- Update to version 15.4.9:
  * same as Factory version 16.0.16
  * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059)
  - Rather than shipping two large files with modprobe.d options
    (00-system.conf and 50-blacklist.conf), ship multiple small
    per-module files. This makes it easier for users to override
    distribution defaults.
  * blacklist isst_if_mbox_msr (bsc#1187196)
  * boot-sysctl: make sure file exists (fix for containers)
  * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718)</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">- Update to version 15.4.10:
  * same as Factory version 16.0.17
  * 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)
  * install some modprobe.d files only for relevant architectures
    (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974)</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 15.4.11:
  * cdrom: Disable autoclose by default (boo#1165047).
  * Make regenerate-initrd-posttrans compatible with Dracut's
    UEFI mode (unified kernel image)</changelog>
  <changelog author="mwilck@suse.com" date="1643371200">- Update to version 15.4.12:
  * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
  * rpm-script: force-copy kernel to /boot (boo#1194501)</changelog>
  <changelog author="mwilck@suse.com" date="1667563200">- Update to version 15.4.13:
  * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 15.4.14:
  * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032001">- Update to version 15.4.15: Backport bug fixes from factory
  * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
  * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
  * driver-check.sh: avoid false positive error messages (boo#1200107)</changelog>
  <changelog author="mwilck@suse.com" date="1675339200">- Update to version 15.4.16:
  * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853)</changelog>
</package>
<package pkgid="cb120f2bf13479a8aebd76419e35424feacda197b5822a30276bade46bf6853e" name="suseconnect-ng" arch="aarch64">
  <version epoch="0" ver="1.0.0~git0.faee7c196dc1" rel="150400.3.7.3"/>
  <changelog author="jzerebecki@suse.com" date="1626696000">- Update to version 0.0.1~git16.8a5d48c:
  * Add extensions hints for readonly root fs
  * Make the connect package an internal package
  * Document debug output destination difference
  * Add status value constants
  * Add rollback CLI option
  * Fix callHTTP() so connections are reused
  * Fix list-extensions format
  * Fix error from zypper refresh</changelog>
  <changelog author="jzerebecki@suse.com" date="1626955200">- Update to version 0.0.1~git33.b531281:
  * Run integration tests
  * Try to use localized error from server response
  * Write usage help to stdout like the Ruby version
  * Simplify list-extensions template
  * Fix call to create UUID on s390
  * Provides and Obsoletes SUSEConnect
  * Add extensions list tests
  * Fix calls to s390 read_values
  * Add build-s390 target to Makefile
  * hwinfo: don't fail if dmidecode is missing</changelog>
  <changelog author="jzerebecki@suse.com" date="1627041600">- Update to version 0.0.2~git0.ebef3b7:
  * Add --version
  * Fix list-extensions printing "Not available" when using SCC
  * Change --deregister to --de-register</changelog>
  <changelog author="jzerebecki@suse.com" date="1627387200">- Update to version 0.0.3~git0.dacdd3b:
  * Add gofmt target to Makefile
  * Fix gofmt errors
  * Add Requires that weren't explicit (bsc#1188646)
  * Use custom UnmarshalJSON() for the Product struct</changelog>
  <changelog author="jzerebecki@suse.com" date="1630065600">- Update to version 0.0.3~git9.19e761b:
  * Add zypper-migration-plugin to package
  * Remove unused Error logger
  * Add missing doc strings to exported vars and funcs
  * Handle error after products sync api call
  * Make the CI check gofmt</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1638360000">- Update to version 0.0.4~git0.64b80e9:
  * Makefile: also run tests under ./suseconnect
  * Switch yast-test to upstream
  * Removed examples leftover from the POC phase
  * Add HA repo to get rubygem(ffi) before it's in the baseproduct
  * Add versions and lib deps
  * Post-review cleanup
  * Package libsuseconnect and shim
  * Align with yast-registration tests
  * Fix SSLCertificate mixins
  * Fix logger crash and restore mixin
  * Removed TODO item handled separately
  * Enable debug early
  * Add package search for YaST's "Online Search"
  * Clarify Repo fields
  * Export UpdateSystem()
  * Export SystemActivations()
  * Add migration functions
  * Fix handling of IsBase attribute
  * Add missing JSONError
  * Add list_installer_updates
  * Add "update certificates"
  * Add more specific errors
  * Improved SSL error handling
  * Init defaults for get_config()
  * Improved debug logging
  * Fix error scopes
  * Fix ApiError interface
  * Added DEFAULT_CREDENTIALS_DIR const
  * get proxy credentials from curlrc
  * Forward logs from Connect to YaST
  * Separate Info logger
  * Added more TODO items
  * Simplify Config object init
  * Map Repo and Config fields to JSON
  * Add remaining fields listed in addon.rb
  * Add product_type field to product
  * First working yast part
  * Add relative path support to credentials
  * Add steps to test from yast
  * Add yast create_credentials_file
  * Add CreateCredentials() method
  * Add yast credentials()
  * Add yast announce_system - WIP
  * Add MergeJSON method for Config
  * Add readme for YaST integration
  * Fix usage text
  * Add missing -g argument
  * Fix OBS CI, it now requires target
  * Add manpage placeholder
  * Simplify packageWanted()
  * Add sorting and grouping options
  * Add local repo search and duplicate removal
  * Add basic online package search
  * Update rpm spec for zypper-search-packages-plugin
  * Add CLI for zypper search-packages plugin
  * Optional base product in package search
  * Use DefaultTransport defaults + client timeout
  * Extract ReleaseType from zypper output
  * Print failed command on zypper error like the Ruby
  * Add package_search API wrapper
  * Allow de-register/de-activate a single product
  * Improve docstring for the Status struct
  * Always show subscription information if available
  * Refactor getStatuses() to ease testing
  * Add SUMA/Uyuni check
  * Fix status output order to follow zypper product xml
  * Change GetExtensionsList() to reduce calls
  * Add the subscription name to status output
  * allow --instance-data together with --regcode
  * Post-review cleanups
  * Add selfupdate functionality
  * Handle Leap -&gt; SLES migration scenario
  * Add offline migrations support
  * Change parse error string and add block comment
  * Add disabling of obsolete repos
  * Add zypper repos listing
  * Add interactive migration selection
  * Allow loading Config from any path
  * Remove dummy flag
  * Add snapper support
  * Add zypper backup/restore functions
  * Use connect.StringSet
  * Add --query option
  * Add product and break-my-system options
  * Add note on conflicting flags
  * Check for flag contradictions
  * Add echoing output of executed commands to console
  * Move product printing out of checkProducts()
  * Split --debug and --verbose
  * Add zypper dist-upgrade part
  * Split migration code
  * Extract migration sorting
  * Expose migration(Add|Remove)Service() functions
  * Trap SIGINT/SIGTERM
  * Add zypper.RefreshRepos()
  * Expose client.upgradeProduct()
  * Add --root parameter
  * Add --migration N parameter
  * Prepare available migrations
  * Add API call to get online migration paths
  * Add system products checking
  * Add quiet logger for easier --quiet handling
  * Add zypper migration plugin implementation.
  * Export toTriplet and installReleasePackage
  * Add basic string set implementation
  * Remove quiet param from execute() and zypperRun()
  * Simplify mocking of external commands</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1641556800">- Update to version 0.0.5~git0.bbb5544:
  * Switch from rubygem-ffi to fiddle
  * Cleanup services during migration (bsc#1161891)
  * Allow non-root users to see usage text
  * Add option to not fail dup as much
  * Move APIVersion declaration to file where it is used
  * Add flag to enable/disable hwinfo test
  * Add ARM cluster count to hwinfo and fix test
  * Simplify parsing JSON error response
  * Add --gpg-auto-import-keys for zypper ref
  * Rename main.go to logging.go
  * Fix typo
  * Remove init() from the connect package
  * Move CFG variable declaration to config.go
  * Move AppName const to the file where it is used
  * Use testing.Helper() in test helpers
  * Add ppc64le support
  * Disable UUID test
  * Add test tools to BuildRequires
  * Ignore UUID errors
  * Run basic hwinfo sanity test on build service
  * Update code comments to match shim behavior.
  * Remove dependency on systemd
  * Only run httputil DumpResponse when needed</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1643198400">- Update to version 0.0.6~git0.77933db:
  * Add man pages
  * Add note in DIFFERENCES.md about abbreviated flags
  * Add -l as an alias for --list-extensions
  * Add --clean as an alias for --cleanup (bsc#1195003)
  * Suppress expected error log message in TLS test
  * Add flag to import product repo keys (bsc#1174657)</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1646136000">- Update to version 0.0.6~git9.33e5847:
  * Delegate free() calls back to Go (bsc#1195729)
  * Pass "insecure" to zypper addservice
  * Workaround system cert reloading after import (bsc#1195220)
  * Extract setupHTTPClient for easier reuse
  * Exit with code 64 on connection refused like Ruby</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1648123200">- Update to version 0.0.7~git0.3ef988e:
  * Fix product tree traversal (bsc#1197398)
  * Revert "Remove self from LD_PRELOAD (bsc#1196326)"
  * Remove self from LD_PRELOAD (bsc#1196326)</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1649851200">- Update to version 0.0.8~git0.16545bf:
  * Allow reloading CA certs pool (bsc#1195220)</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1650456000">- Update to version 0.0.8~git2.368ea44:
  * go1.18 compatibility: BuildRequires:git</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1659700800">- Update to version 0.0.9~git5.75890b6:
  * Don't run keepalive on reboot
  * Use system-wide proxy settings (bsc#1200994)
  * Add customer information about keepalive calls
  * Add timer for SUSEConnect --keepalive (bsc#1196076)
  * Add --keepalive to manpage
  * Added support for the System-Token header
  * Add Keepalive command line option
  * Print nested zypper errors (bsc#1200803)
  * Fix migration json error with SMT (bsc#1198625)
  * Add option to run local scc tests
  * Switch to jenkins-hosted credentials
  * Fix "VCS stamping" problem
  * Add missing import
  * Remove redundant code + add comment</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1661947200">- Update to version 0.0.9~git8.f9adb71:
  * Use standard buildconditionals
  * Strip the binaries (saves ~ 30%)</changelog>
  <changelog author="msabate@suse.com" date="1662984000">- Update to version 0.0.9~git10.de887da7231f:
  * Respect the PROXY_ENABLED environment variable</changelog>
  <changelog author="jtomasiak@suse.com" date="1663243200">- Update to version 0.0.10~git0.5f84106:
  * Fix System-Token support in ruby binding (bsc#1203341)
  * Added the PACKAGE.md file</changelog>
  <changelog author="jtomasiak@suse.com" date="1665144000">- Update to version 0.0.10~git2.ee561b8:
  * Drop .git from tar</changelog>
  <changelog author="msabate@suse.com" date="1666958400">- Update to version 1.0.0~git0.60e48564a714 (bsc#1204821):
  * packaging: obsolete suseconnect &lt; 1.0.0
  * packaging: don't end the summary with a dot</changelog>
  <changelog author="msabate@suse.com" date="1667908800">- Update to version v1.0~git0.32cac3fb5047:
  * packaging: 1.0.0 -&gt; 1.0</changelog>
  <changelog author="msabate@suse.com" date="1667908801">- Update to version 1.0.0~git0.faee7c196dc1:
  * Revert "packaging: 1.0.0 -&gt; 1.0"</changelog>
</package>
<package pkgid="a823f75a4d5959877772e6f14ee7a8a418e11f0359c550fcc072c88070507c90" name="suseconnect-ng" arch="src">
  <version epoch="0" ver="1.0.0~git0.faee7c196dc1" rel="150400.3.7.3"/>
  <changelog author="jzerebecki@suse.com" date="1626696000">- Update to version 0.0.1~git16.8a5d48c:
  * Add extensions hints for readonly root fs
  * Make the connect package an internal package
  * Document debug output destination difference
  * Add status value constants
  * Add rollback CLI option
  * Fix callHTTP() so connections are reused
  * Fix list-extensions format
  * Fix error from zypper refresh</changelog>
  <changelog author="jzerebecki@suse.com" date="1626955200">- Update to version 0.0.1~git33.b531281:
  * Run integration tests
  * Try to use localized error from server response
  * Write usage help to stdout like the Ruby version
  * Simplify list-extensions template
  * Fix call to create UUID on s390
  * Provides and Obsoletes SUSEConnect
  * Add extensions list tests
  * Fix calls to s390 read_values
  * Add build-s390 target to Makefile
  * hwinfo: don't fail if dmidecode is missing</changelog>
  <changelog author="jzerebecki@suse.com" date="1627041600">- Update to version 0.0.2~git0.ebef3b7:
  * Add --version
  * Fix list-extensions printing "Not available" when using SCC
  * Change --deregister to --de-register</changelog>
  <changelog author="jzerebecki@suse.com" date="1627387200">- Update to version 0.0.3~git0.dacdd3b:
  * Add gofmt target to Makefile
  * Fix gofmt errors
  * Add Requires that weren't explicit (bsc#1188646)
  * Use custom UnmarshalJSON() for the Product struct</changelog>
  <changelog author="jzerebecki@suse.com" date="1630065600">- Update to version 0.0.3~git9.19e761b:
  * Add zypper-migration-plugin to package
  * Remove unused Error logger
  * Add missing doc strings to exported vars and funcs
  * Handle error after products sync api call
  * Make the CI check gofmt</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1638360000">- Update to version 0.0.4~git0.64b80e9:
  * Makefile: also run tests under ./suseconnect
  * Switch yast-test to upstream
  * Removed examples leftover from the POC phase
  * Add HA repo to get rubygem(ffi) before it's in the baseproduct
  * Add versions and lib deps
  * Post-review cleanup
  * Package libsuseconnect and shim
  * Align with yast-registration tests
  * Fix SSLCertificate mixins
  * Fix logger crash and restore mixin
  * Removed TODO item handled separately
  * Enable debug early
  * Add package search for YaST's "Online Search"
  * Clarify Repo fields
  * Export UpdateSystem()
  * Export SystemActivations()
  * Add migration functions
  * Fix handling of IsBase attribute
  * Add missing JSONError
  * Add list_installer_updates
  * Add "update certificates"
  * Add more specific errors
  * Improved SSL error handling
  * Init defaults for get_config()
  * Improved debug logging
  * Fix error scopes
  * Fix ApiError interface
  * Added DEFAULT_CREDENTIALS_DIR const
  * get proxy credentials from curlrc
  * Forward logs from Connect to YaST
  * Separate Info logger
  * Added more TODO items
  * Simplify Config object init
  * Map Repo and Config fields to JSON
  * Add remaining fields listed in addon.rb
  * Add product_type field to product
  * First working yast part
  * Add relative path support to credentials
  * Add steps to test from yast
  * Add yast create_credentials_file
  * Add CreateCredentials() method
  * Add yast credentials()
  * Add yast announce_system - WIP
  * Add MergeJSON method for Config
  * Add readme for YaST integration
  * Fix usage text
  * Add missing -g argument
  * Fix OBS CI, it now requires target
  * Add manpage placeholder
  * Simplify packageWanted()
  * Add sorting and grouping options
  * Add local repo search and duplicate removal
  * Add basic online package search
  * Update rpm spec for zypper-search-packages-plugin
  * Add CLI for zypper search-packages plugin
  * Optional base product in package search
  * Use DefaultTransport defaults + client timeout
  * Extract ReleaseType from zypper output
  * Print failed command on zypper error like the Ruby
  * Add package_search API wrapper
  * Allow de-register/de-activate a single product
  * Improve docstring for the Status struct
  * Always show subscription information if available
  * Refactor getStatuses() to ease testing
  * Add SUMA/Uyuni check
  * Fix status output order to follow zypper product xml
  * Change GetExtensionsList() to reduce calls
  * Add the subscription name to status output
  * allow --instance-data together with --regcode
  * Post-review cleanups
  * Add selfupdate functionality
  * Handle Leap -&gt; SLES migration scenario
  * Add offline migrations support
  * Change parse error string and add block comment
  * Add disabling of obsolete repos
  * Add zypper repos listing
  * Add interactive migration selection
  * Allow loading Config from any path
  * Remove dummy flag
  * Add snapper support
  * Add zypper backup/restore functions
  * Use connect.StringSet
  * Add --query option
  * Add product and break-my-system options
  * Add note on conflicting flags
  * Check for flag contradictions
  * Add echoing output of executed commands to console
  * Move product printing out of checkProducts()
  * Split --debug and --verbose
  * Add zypper dist-upgrade part
  * Split migration code
  * Extract migration sorting
  * Expose migration(Add|Remove)Service() functions
  * Trap SIGINT/SIGTERM
  * Add zypper.RefreshRepos()
  * Expose client.upgradeProduct()
  * Add --root parameter
  * Add --migration N parameter
  * Prepare available migrations
  * Add API call to get online migration paths
  * Add system products checking
  * Add quiet logger for easier --quiet handling
  * Add zypper migration plugin implementation.
  * Export toTriplet and installReleasePackage
  * Add basic string set implementation
  * Remove quiet param from execute() and zypperRun()
  * Simplify mocking of external commands</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1641556800">- Update to version 0.0.5~git0.bbb5544:
  * Switch from rubygem-ffi to fiddle
  * Cleanup services during migration (bsc#1161891)
  * Allow non-root users to see usage text
  * Add option to not fail dup as much
  * Move APIVersion declaration to file where it is used
  * Add flag to enable/disable hwinfo test
  * Add ARM cluster count to hwinfo and fix test
  * Simplify parsing JSON error response
  * Add --gpg-auto-import-keys for zypper ref
  * Rename main.go to logging.go
  * Fix typo
  * Remove init() from the connect package
  * Move CFG variable declaration to config.go
  * Move AppName const to the file where it is used
  * Use testing.Helper() in test helpers
  * Add ppc64le support
  * Disable UUID test
  * Add test tools to BuildRequires
  * Ignore UUID errors
  * Run basic hwinfo sanity test on build service
  * Update code comments to match shim behavior.
  * Remove dependency on systemd
  * Only run httputil DumpResponse when needed</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1643198400">- Update to version 0.0.6~git0.77933db:
  * Add man pages
  * Add note in DIFFERENCES.md about abbreviated flags
  * Add -l as an alias for --list-extensions
  * Add --clean as an alias for --cleanup (bsc#1195003)
  * Suppress expected error log message in TLS test
  * Add flag to import product repo keys (bsc#1174657)</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1646136000">- Update to version 0.0.6~git9.33e5847:
  * Delegate free() calls back to Go (bsc#1195729)
  * Pass "insecure" to zypper addservice
  * Workaround system cert reloading after import (bsc#1195220)
  * Extract setupHTTPClient for easier reuse
  * Exit with code 64 on connection refused like Ruby</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1648123200">- Update to version 0.0.7~git0.3ef988e:
  * Fix product tree traversal (bsc#1197398)
  * Revert "Remove self from LD_PRELOAD (bsc#1196326)"
  * Remove self from LD_PRELOAD (bsc#1196326)</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1649851200">- Update to version 0.0.8~git0.16545bf:
  * Allow reloading CA certs pool (bsc#1195220)</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1650456000">- Update to version 0.0.8~git2.368ea44:
  * go1.18 compatibility: BuildRequires:git</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1659700800">- Update to version 0.0.9~git5.75890b6:
  * Don't run keepalive on reboot
  * Use system-wide proxy settings (bsc#1200994)
  * Add customer information about keepalive calls
  * Add timer for SUSEConnect --keepalive (bsc#1196076)
  * Add --keepalive to manpage
  * Added support for the System-Token header
  * Add Keepalive command line option
  * Print nested zypper errors (bsc#1200803)
  * Fix migration json error with SMT (bsc#1198625)
  * Add option to run local scc tests
  * Switch to jenkins-hosted credentials
  * Fix "VCS stamping" problem
  * Add missing import
  * Remove redundant code + add comment</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1661947200">- Update to version 0.0.9~git8.f9adb71:
  * Use standard buildconditionals
  * Strip the binaries (saves ~ 30%)</changelog>
  <changelog author="msabate@suse.com" date="1662984000">- Update to version 0.0.9~git10.de887da7231f:
  * Respect the PROXY_ENABLED environment variable</changelog>
  <changelog author="jtomasiak@suse.com" date="1663243200">- Update to version 0.0.10~git0.5f84106:
  * Fix System-Token support in ruby binding (bsc#1203341)
  * Added the PACKAGE.md file</changelog>
  <changelog author="jtomasiak@suse.com" date="1665144000">- Update to version 0.0.10~git2.ee561b8:
  * Drop .git from tar</changelog>
  <changelog author="msabate@suse.com" date="1666958400">- Update to version 1.0.0~git0.60e48564a714 (bsc#1204821):
  * packaging: obsolete suseconnect &lt; 1.0.0
  * packaging: don't end the summary with a dot</changelog>
  <changelog author="msabate@suse.com" date="1667908800">- Update to version v1.0~git0.32cac3fb5047:
  * packaging: 1.0.0 -&gt; 1.0</changelog>
  <changelog author="msabate@suse.com" date="1667908801">- Update to version 1.0.0~git0.faee7c196dc1:
  * Revert "packaging: 1.0.0 -&gt; 1.0"</changelog>
</package>
<package pkgid="c812f540d5e60a88d0ba6c6cb13e620bec7b61413e23d9098e4a4d5b3d6fc452" name="suseconnect-ng" arch="x86_64">
  <version epoch="0" ver="1.0.0~git0.faee7c196dc1" rel="150400.3.7.3"/>
  <changelog author="jzerebecki@suse.com" date="1626696000">- Update to version 0.0.1~git16.8a5d48c:
  * Add extensions hints for readonly root fs
  * Make the connect package an internal package
  * Document debug output destination difference
  * Add status value constants
  * Add rollback CLI option
  * Fix callHTTP() so connections are reused
  * Fix list-extensions format
  * Fix error from zypper refresh</changelog>
  <changelog author="jzerebecki@suse.com" date="1626955200">- Update to version 0.0.1~git33.b531281:
  * Run integration tests
  * Try to use localized error from server response
  * Write usage help to stdout like the Ruby version
  * Simplify list-extensions template
  * Fix call to create UUID on s390
  * Provides and Obsoletes SUSEConnect
  * Add extensions list tests
  * Fix calls to s390 read_values
  * Add build-s390 target to Makefile
  * hwinfo: don't fail if dmidecode is missing</changelog>
  <changelog author="jzerebecki@suse.com" date="1627041600">- Update to version 0.0.2~git0.ebef3b7:
  * Add --version
  * Fix list-extensions printing "Not available" when using SCC
  * Change --deregister to --de-register</changelog>
  <changelog author="jzerebecki@suse.com" date="1627387200">- Update to version 0.0.3~git0.dacdd3b:
  * Add gofmt target to Makefile
  * Fix gofmt errors
  * Add Requires that weren't explicit (bsc#1188646)
  * Use custom UnmarshalJSON() for the Product struct</changelog>
  <changelog author="jzerebecki@suse.com" date="1630065600">- Update to version 0.0.3~git9.19e761b:
  * Add zypper-migration-plugin to package
  * Remove unused Error logger
  * Add missing doc strings to exported vars and funcs
  * Handle error after products sync api call
  * Make the CI check gofmt</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1638360000">- Update to version 0.0.4~git0.64b80e9:
  * Makefile: also run tests under ./suseconnect
  * Switch yast-test to upstream
  * Removed examples leftover from the POC phase
  * Add HA repo to get rubygem(ffi) before it's in the baseproduct
  * Add versions and lib deps
  * Post-review cleanup
  * Package libsuseconnect and shim
  * Align with yast-registration tests
  * Fix SSLCertificate mixins
  * Fix logger crash and restore mixin
  * Removed TODO item handled separately
  * Enable debug early
  * Add package search for YaST's "Online Search"
  * Clarify Repo fields
  * Export UpdateSystem()
  * Export SystemActivations()
  * Add migration functions
  * Fix handling of IsBase attribute
  * Add missing JSONError
  * Add list_installer_updates
  * Add "update certificates"
  * Add more specific errors
  * Improved SSL error handling
  * Init defaults for get_config()
  * Improved debug logging
  * Fix error scopes
  * Fix ApiError interface
  * Added DEFAULT_CREDENTIALS_DIR const
  * get proxy credentials from curlrc
  * Forward logs from Connect to YaST
  * Separate Info logger
  * Added more TODO items
  * Simplify Config object init
  * Map Repo and Config fields to JSON
  * Add remaining fields listed in addon.rb
  * Add product_type field to product
  * First working yast part
  * Add relative path support to credentials
  * Add steps to test from yast
  * Add yast create_credentials_file
  * Add CreateCredentials() method
  * Add yast credentials()
  * Add yast announce_system - WIP
  * Add MergeJSON method for Config
  * Add readme for YaST integration
  * Fix usage text
  * Add missing -g argument
  * Fix OBS CI, it now requires target
  * Add manpage placeholder
  * Simplify packageWanted()
  * Add sorting and grouping options
  * Add local repo search and duplicate removal
  * Add basic online package search
  * Update rpm spec for zypper-search-packages-plugin
  * Add CLI for zypper search-packages plugin
  * Optional base product in package search
  * Use DefaultTransport defaults + client timeout
  * Extract ReleaseType from zypper output
  * Print failed command on zypper error like the Ruby
  * Add package_search API wrapper
  * Allow de-register/de-activate a single product
  * Improve docstring for the Status struct
  * Always show subscription information if available
  * Refactor getStatuses() to ease testing
  * Add SUMA/Uyuni check
  * Fix status output order to follow zypper product xml
  * Change GetExtensionsList() to reduce calls
  * Add the subscription name to status output
  * allow --instance-data together with --regcode
  * Post-review cleanups
  * Add selfupdate functionality
  * Handle Leap -&gt; SLES migration scenario
  * Add offline migrations support
  * Change parse error string and add block comment
  * Add disabling of obsolete repos
  * Add zypper repos listing
  * Add interactive migration selection
  * Allow loading Config from any path
  * Remove dummy flag
  * Add snapper support
  * Add zypper backup/restore functions
  * Use connect.StringSet
  * Add --query option
  * Add product and break-my-system options
  * Add note on conflicting flags
  * Check for flag contradictions
  * Add echoing output of executed commands to console
  * Move product printing out of checkProducts()
  * Split --debug and --verbose
  * Add zypper dist-upgrade part
  * Split migration code
  * Extract migration sorting
  * Expose migration(Add|Remove)Service() functions
  * Trap SIGINT/SIGTERM
  * Add zypper.RefreshRepos()
  * Expose client.upgradeProduct()
  * Add --root parameter
  * Add --migration N parameter
  * Prepare available migrations
  * Add API call to get online migration paths
  * Add system products checking
  * Add quiet logger for easier --quiet handling
  * Add zypper migration plugin implementation.
  * Export toTriplet and installReleasePackage
  * Add basic string set implementation
  * Remove quiet param from execute() and zypperRun()
  * Simplify mocking of external commands</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1641556800">- Update to version 0.0.5~git0.bbb5544:
  * Switch from rubygem-ffi to fiddle
  * Cleanup services during migration (bsc#1161891)
  * Allow non-root users to see usage text
  * Add option to not fail dup as much
  * Move APIVersion declaration to file where it is used
  * Add flag to enable/disable hwinfo test
  * Add ARM cluster count to hwinfo and fix test
  * Simplify parsing JSON error response
  * Add --gpg-auto-import-keys for zypper ref
  * Rename main.go to logging.go
  * Fix typo
  * Remove init() from the connect package
  * Move CFG variable declaration to config.go
  * Move AppName const to the file where it is used
  * Use testing.Helper() in test helpers
  * Add ppc64le support
  * Disable UUID test
  * Add test tools to BuildRequires
  * Ignore UUID errors
  * Run basic hwinfo sanity test on build service
  * Update code comments to match shim behavior.
  * Remove dependency on systemd
  * Only run httputil DumpResponse when needed</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1643198400">- Update to version 0.0.6~git0.77933db:
  * Add man pages
  * Add note in DIFFERENCES.md about abbreviated flags
  * Add -l as an alias for --list-extensions
  * Add --clean as an alias for --cleanup (bsc#1195003)
  * Suppress expected error log message in TLS test
  * Add flag to import product repo keys (bsc#1174657)</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1646136000">- Update to version 0.0.6~git9.33e5847:
  * Delegate free() calls back to Go (bsc#1195729)
  * Pass "insecure" to zypper addservice
  * Workaround system cert reloading after import (bsc#1195220)
  * Extract setupHTTPClient for easier reuse
  * Exit with code 64 on connection refused like Ruby</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1648123200">- Update to version 0.0.7~git0.3ef988e:
  * Fix product tree traversal (bsc#1197398)
  * Revert "Remove self from LD_PRELOAD (bsc#1196326)"
  * Remove self from LD_PRELOAD (bsc#1196326)</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1649851200">- Update to version 0.0.8~git0.16545bf:
  * Allow reloading CA certs pool (bsc#1195220)</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1650456000">- Update to version 0.0.8~git2.368ea44:
  * go1.18 compatibility: BuildRequires:git</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1659700800">- Update to version 0.0.9~git5.75890b6:
  * Don't run keepalive on reboot
  * Use system-wide proxy settings (bsc#1200994)
  * Add customer information about keepalive calls
  * Add timer for SUSEConnect --keepalive (bsc#1196076)
  * Add --keepalive to manpage
  * Added support for the System-Token header
  * Add Keepalive command line option
  * Print nested zypper errors (bsc#1200803)
  * Fix migration json error with SMT (bsc#1198625)
  * Add option to run local scc tests
  * Switch to jenkins-hosted credentials
  * Fix "VCS stamping" problem
  * Add missing import
  * Remove redundant code + add comment</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1661947200">- Update to version 0.0.9~git8.f9adb71:
  * Use standard buildconditionals
  * Strip the binaries (saves ~ 30%)</changelog>
  <changelog author="msabate@suse.com" date="1662984000">- Update to version 0.0.9~git10.de887da7231f:
  * Respect the PROXY_ENABLED environment variable</changelog>
  <changelog author="jtomasiak@suse.com" date="1663243200">- Update to version 0.0.10~git0.5f84106:
  * Fix System-Token support in ruby binding (bsc#1203341)
  * Added the PACKAGE.md file</changelog>
  <changelog author="jtomasiak@suse.com" date="1665144000">- Update to version 0.0.10~git2.ee561b8:
  * Drop .git from tar</changelog>
  <changelog author="msabate@suse.com" date="1666958400">- Update to version 1.0.0~git0.60e48564a714 (bsc#1204821):
  * packaging: obsolete suseconnect &lt; 1.0.0
  * packaging: don't end the summary with a dot</changelog>
  <changelog author="msabate@suse.com" date="1667908800">- Update to version v1.0~git0.32cac3fb5047:
  * packaging: 1.0.0 -&gt; 1.0</changelog>
  <changelog author="msabate@suse.com" date="1667908801">- Update to version 1.0.0~git0.faee7c196dc1:
  * Revert "packaging: 1.0.0 -&gt; 1.0"</changelog>
</package>
<package pkgid="f1f2f625ff94de2544854c090923d207fdc1bb82f0ab7d9b18b88aa620e684f1" name="system-group-audit" arch="aarch64">
  <version epoch="0" ver="3.0.6" rel="150400.4.6.1"/>
  <changelog author="tonyj@suse.com" date="1578916800">- Update to version 2.8.5:
  * Fix segfault on shutdown
  * Fix hang on startup (#1587995)
  * Add sleep to script to dump state so file is ready when needed
  * Add auparse_normalizer support for SOFTWARE_UPDATE event
  * Mark netlabel events as simple events so that get processed quicker
  * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
  * Add 30-ospp-v42.rules to meet new Common Criteria requirements
  * Update lookup tables for the 4.18 kernel
  * In aureport, fix segfault in file report
  * Add auparse_normalizer support for labeled networking events
  * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
  * Event aging is off by a second
  * In ausearch/auparse, correct event ordering to process oldest first
  * auparse_reset was not clearing everything it should
  * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
  * In ausearch/report, lightly parse selinux portion of USER_AVC events
  * In ausearch/report, limit record size when malformed
  * In auditd, fix extract_type function for network originating events
  * In auditd, calculate right size and location for network originating events
  * Treat all network originating events as VER2 so dispatcher doesn't format it
  * In audisp-remote do an initial connection attempt (#1625156)
  * In auditd, allow expression of space left as a percentage (#1650670)
  * On PPC64LE systems, only allow 64 bit rules (#1462178)
  * Make some parts of auditd state report optional based on config
  * Fix ausearch when checkpointing a single file (Burn Alting)
  * Fix scripting in 31-privileged.rules wrt filecap (#1662516)
  * In ausearch, do not checkpt if stdin is input source
  * In libev, remove __cold__ attribute for functions to allow proper hardening
  * Add tests to configure.ac for openldap support
  * Make systemd support files use /run rather than /var/run (Christian Hesse)
  * Fix minor memory leak in auditd kerberos credentials code
  * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
  * In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Fix build errors when using gcc-10 no-common default (bsc#1160384)
  New patch: audit-fno-common.patch
- Refresh audit-allow-manual-stop.patch</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="abergmann@suse.com" date="1606910400">- Enable Aarch64 processor support. (bsc#1179515 bsc#1179806)</changelog>
  <changelog author="ematsumiya@suse.com" date="1611835200">- Create new "audit" group for read access to logs (bsc#1178154)
  * add change-default-log_group.patch
  * update audit-secondary.spec</changelog>
  <changelog author="dimstar@opensuse.org" date="1612180800">- Do not explicitly provide group(audit) in system-users-audit:
  this is automatically handled by rpm/providers.</changelog>
  <changelog author="ematsumiya@suse.com" date="1623672000">- Adjust audit.spec and audit-secondary.spec to support new version
- Include fix for libev
  * add libev-werror.patch
- Update to version 3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations
- In auditd, do not allow spaces in the hostname name format
- Big documentation cleanup (MIZUTA Takeshi)
- Update syscall table to the 5.12 kernel
- Update the auparse normalizer for new event types
- Fix compiler warnings in ids subsystem
- Block a couple signals from flush &amp; reconfigure threads
- In auditd, don't wait on flush thread when exiting
- Output error message if the path of input files are too long ausearch/report
  Included fixes from 3.0.1
- Update syscall table to the 5.11 kernel
- Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
- Only enable periodic timers when listening on the network
- Upgrade libev to 4.33
- Add auparse_new_buffer function to auparse library
- Use the select libev backend unless aggregating events
- Add sudoers to some base audit rules
- Update the auparse normalizer for some new syscalls and event types
  Included fixes from 3.0
- Generate checkpoint file even when no results are returned (Burn Alting)
- Fix log file creation when file logging is disabled entirely (Vlad Glagolev)
- Convert auparse_test to run with python3 (Tomá? Chvátal)
- Drop support for prelude
- Adjust backlog_wait_time in rules to the kernel default (#1482848)
- Remove ids key syntax checking of rules in auditctl
- Use SIGCONT to dump auditd internal state (#1504251)
- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903)
- Fix parsing of uid &amp; success for ausearch
- Add support for not equal operator in audit by executable (Ondrej Mosnacek)
- Hide lru symbols in auparse
- Add systemd process protections
- Fix aureport summary time range reporting
- Allow unlimited retries on startup for remote logging
- Add queue_depth to remote logging stats and increase default queue_depth size
- Fix segfault on shutdown
- Merge auditd and audispd code
- Close on execute init_pipe fd (#1587995)
- Breakout audisp syslog plugin to be standalone program
- Create a common internal library to reduce code
- Move all audispd config files under /etc/audit/
- Move audispd.conf settings into auditd.conf
- Add queue depth statistics to internal state dump report
- Add network statistics to internal state dump report
- SIGUSR now also restarts queue processing if its suspended
- Update lookup tables for the 4.18 kernel
- Add auparse_normalizer support for SOFTWARE_UPDATE event
- Add 30-ospp-v42.rules to meet new Common Criteria requirements
- Deprecate enable_krb and replace with transport config opt for remote logging
- Mark netlabel events as simple events so that get processed quicker
- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
- In aureport, fix segfault in file report
- Add auparse_normalizer support for labeled networking events
- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
- In ausearch/auparse, event aging is off by a second
- In ausearch/auparse, correct event ordering to process oldest first
- Migrate auparse python test to python3
- auparse_reset was not clearing everything it should
- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
- In ausearch/report, lightly parse selinux portion of USER_AVC events
- Add bpf syscall command argument interpretation to auparse
- In ausearch/report, limit record size when malformed
- Port af_unix plugin to libev
- In auditd, fix extract_type function for network originating events
- In auditd, calculate right size and location for network originating events
- Make legacy script wait for auditd to terminate (#1643567)
- Treat all network originating events as VER2 so dispatcher doesn't format it
- If an event has a node name make it VER2 so dispatcher doesnt format it
- In audisp-remote do an initial connection attempt (#1625156)
- In auditd, allow expression of space left as a percentage (#1650670)
- On PPC64LE systems, only allow 64 bit rules (#1462178)
- Make some parts of auditd state report optional based on config
- Update to libev-4.25
- Fix ausearch when checkpointing a single file (Burn Alting)
- Fix scripting in 31-privileged.rules wrt filecap (#1662516)
- In ausearch, do not checkpt if stdin is input source
- In libev, remove __cold__ attribute for functions to allow proper hardening
- Add tests to configure.ac for openldap support
- Make systemd support files use /run rather than /var/run (Christian Hesse)
- Fix minor memory leak in auditd kerberos credentials code
- Allow exclude and user filter by executable name (Ondrej Mosnacek)
- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
- In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Add substitue functions for strndupa &amp; rawmemchr
- Fix memleak in auparse caused by corrected event ordering
- Fix legacy reload script to reload audit rules when daemon is reloaded
- Support for unescaping in trusted messages (Dmitry Voronin)
- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
- In aureport, fix segfault for malformed USER_CMD events
- Add exe field to audit_log_user_command in libaudit
- In auditctl support filter on socket address families (Richard Guy Briggs)
- Deprecate support for Alpha &amp; IA64 processors
- If space_left_action is rotate, allow it every time (#1718444)
- In auparse, drop standalone EOE events
- Add milliseconds column for ausearch extra time csv format
- Fix aureport first event reporting when no start given
- In audisp-remote, add new config item for startup connection errors
- Remove dependency on chkconfig
- Install rules to /usr/share/audit/sample-rules/
- Split up ospp rules to make SCAP scanning easier (#1746018)
- In audisp-syslog, support interpreting records (#1497279)
- Audit USER events now sends msg as name value pair
- Add support for AUDIT_BPF event
- Auditd should not process AUDIT_REPLACE events
- Update syscall tables to the 5.5 kernel
- Improve personality interpretation by using PERS_MASK
- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup
- Change auparse python bindings to shared object (Issue #121)
- Add error messages for watch permissions
- If audit rules file doesn't exist log error message instead of info message
- Revise error message for unmatched options in auditctl
- In audisp-remote, fixup remote endpoint disappearin in ascii format
- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander)
- In auditctl, add support for sending a signal to auditd
- Removes audit-fno-common.patch: fixed in upstream
- Removes audit-python3.patch: fixed in upstream</changelog>
  <changelog author="ematsumiya@suse.com" date="1627646400">- Update to version 3.0.3:
  * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined
  * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids
  * Change auparse_feed_has_data in auparse to include incomplete events
  * Auditd, stop linking against -lrt
  * Add ProtectHome and RestrictRealtime to auditd.service
  * In auditd, read up to 3 netlink packets in a row
  * In auditd, do not validate path to plugin unless active
  * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists
- use https source urls</changelog>
  <changelog author="meissner@suse.com" date="1629115200">- harden_auditd.service.patch: automatic hardening applied to systemd
  services</changelog>
  <changelog author="ematsumiya@suse.com" date="1631793600">- Change default log_format from ENRICHED to RAW (bsc#1190500):
  * add change-default-log_format.patch (SUSE-specific patch)
- Update to version 3.0.5:
  * In auditd, flush uid/gid caches when user/group added/deleted/modified
  * Fixed various issues when dealing with corrupted logs
  * In auditd, check if log_file is valid before closing handle
- Include fixed from 3.0.4:
  * Apply performance speedups to auparse library
  * Optimize rule loading in auditctl
  * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath
  * Update syscall table to the 5.14 kernel
  * Fixed various issues when dealing with corrupted logs</changelog>
  <changelog author="ematsumiya@suse.com" date="1632139200">- Fix hardened auditd.service (bsc#1181400)
  * add fix-hardened-service.patch
    Make /etc/audit read-write from the service.
    Remove PrivateDevices=true to expose /dev/* to auditd.service.
- Enable stop rules for audit.service (cf. bsc#1190227)
  * add enable-stop-rules.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1634126400">- Create separate service for augenrules (bsc#1191614, bsc#1181400)
  * add create-augenrules-service.patch
  Remove ReadWritePaths=/etc/audit from auditd.service, also removes
  augenrules call from ExecStartPost.
  Create augenrules.service with the ReadWritePaths directive above.
  This makes /etc/audit only accessible by augenrules.service and
  let auditd.service (and daemon) to be sandboxed again.
- Update audit-secondary.spec to accomodate the new service file.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634299200">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636286400">- Update to version 3.0.6:
  * fixes a segfault on some SELINUX_ERR records
  * makes IPX packet interpretation dependent on the ipx header
    file existing
  * adds b32/b64 support to ausyscall
  * adds support for armv8l
  * fixes auditctl list of syscalls on PPC
  * auditd.service now restarts auditd under some conditions</changelog>
  <changelog author="fvogt@suse.com" date="1638187200">- Use %autosetup
- Don't include sample rules as %doc, they're already installed
  as normal files
- Fix create-augenrules-service.patch:
  * auditd.service needs to require augenrules.service,
    not the other way around
- Fix documentation for enable-stop-rules.patch</changelog>
  <changelog author="dmueller@suse.com" date="1648036800">- add audit-userspace-517-compat.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1648209600">- Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645)
  * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
- Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517)
  * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Fix buildrequire for openldap2-devel - audit doesn't require the
  (outdated) C++ binding, but the C headers that happen to be pulled
  in by buildrequiring the C++ devel package</changelog>
  <changelog author="jengelh@inai.de" date="1649678400">- Drop buildrequire on C++ compiler.
- Modernize specfile constructs.</changelog>
  <changelog author="ali.abdallah@suse.com" date="1659441600">- Update audit-secondary.spec: create symbolic link from
  /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519).</changelog>
  <changelog author="lidong.zhong@suse.com" date="1667304000">- Fix rules not loaded when restarting auditd.service(bsc#1204844)</changelog>
</package>
<package pkgid="11c6553e44ec62e6a65ffd1a4936173d5fb6c668da0ceb53f359d07c0ae1592a" name="system-group-audit" arch="x86_64">
  <version epoch="0" ver="3.0.6" rel="150400.4.6.1"/>
  <changelog author="tonyj@suse.com" date="1578916800">- Update to version 2.8.5:
  * Fix segfault on shutdown
  * Fix hang on startup (#1587995)
  * Add sleep to script to dump state so file is ready when needed
  * Add auparse_normalizer support for SOFTWARE_UPDATE event
  * Mark netlabel events as simple events so that get processed quicker
  * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
  * Add 30-ospp-v42.rules to meet new Common Criteria requirements
  * Update lookup tables for the 4.18 kernel
  * In aureport, fix segfault in file report
  * Add auparse_normalizer support for labeled networking events
  * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
  * Event aging is off by a second
  * In ausearch/auparse, correct event ordering to process oldest first
  * auparse_reset was not clearing everything it should
  * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
  * In ausearch/report, lightly parse selinux portion of USER_AVC events
  * In ausearch/report, limit record size when malformed
  * In auditd, fix extract_type function for network originating events
  * In auditd, calculate right size and location for network originating events
  * Treat all network originating events as VER2 so dispatcher doesn't format it
  * In audisp-remote do an initial connection attempt (#1625156)
  * In auditd, allow expression of space left as a percentage (#1650670)
  * On PPC64LE systems, only allow 64 bit rules (#1462178)
  * Make some parts of auditd state report optional based on config
  * Fix ausearch when checkpointing a single file (Burn Alting)
  * Fix scripting in 31-privileged.rules wrt filecap (#1662516)
  * In ausearch, do not checkpt if stdin is input source
  * In libev, remove __cold__ attribute for functions to allow proper hardening
  * Add tests to configure.ac for openldap support
  * Make systemd support files use /run rather than /var/run (Christian Hesse)
  * Fix minor memory leak in auditd kerberos credentials code
  * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
  * In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Fix build errors when using gcc-10 no-common default (bsc#1160384)
  New patch: audit-fno-common.patch
- Refresh audit-allow-manual-stop.patch</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="abergmann@suse.com" date="1606910400">- Enable Aarch64 processor support. (bsc#1179515 bsc#1179806)</changelog>
  <changelog author="ematsumiya@suse.com" date="1611835200">- Create new "audit" group for read access to logs (bsc#1178154)
  * add change-default-log_group.patch
  * update audit-secondary.spec</changelog>
  <changelog author="dimstar@opensuse.org" date="1612180800">- Do not explicitly provide group(audit) in system-users-audit:
  this is automatically handled by rpm/providers.</changelog>
  <changelog author="ematsumiya@suse.com" date="1623672000">- Adjust audit.spec and audit-secondary.spec to support new version
- Include fix for libev
  * add libev-werror.patch
- Update to version 3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations
- In auditd, do not allow spaces in the hostname name format
- Big documentation cleanup (MIZUTA Takeshi)
- Update syscall table to the 5.12 kernel
- Update the auparse normalizer for new event types
- Fix compiler warnings in ids subsystem
- Block a couple signals from flush &amp; reconfigure threads
- In auditd, don't wait on flush thread when exiting
- Output error message if the path of input files are too long ausearch/report
  Included fixes from 3.0.1
- Update syscall table to the 5.11 kernel
- Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
- Only enable periodic timers when listening on the network
- Upgrade libev to 4.33
- Add auparse_new_buffer function to auparse library
- Use the select libev backend unless aggregating events
- Add sudoers to some base audit rules
- Update the auparse normalizer for some new syscalls and event types
  Included fixes from 3.0
- Generate checkpoint file even when no results are returned (Burn Alting)
- Fix log file creation when file logging is disabled entirely (Vlad Glagolev)
- Convert auparse_test to run with python3 (Tomá? Chvátal)
- Drop support for prelude
- Adjust backlog_wait_time in rules to the kernel default (#1482848)
- Remove ids key syntax checking of rules in auditctl
- Use SIGCONT to dump auditd internal state (#1504251)
- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903)
- Fix parsing of uid &amp; success for ausearch
- Add support for not equal operator in audit by executable (Ondrej Mosnacek)
- Hide lru symbols in auparse
- Add systemd process protections
- Fix aureport summary time range reporting
- Allow unlimited retries on startup for remote logging
- Add queue_depth to remote logging stats and increase default queue_depth size
- Fix segfault on shutdown
- Merge auditd and audispd code
- Close on execute init_pipe fd (#1587995)
- Breakout audisp syslog plugin to be standalone program
- Create a common internal library to reduce code
- Move all audispd config files under /etc/audit/
- Move audispd.conf settings into auditd.conf
- Add queue depth statistics to internal state dump report
- Add network statistics to internal state dump report
- SIGUSR now also restarts queue processing if its suspended
- Update lookup tables for the 4.18 kernel
- Add auparse_normalizer support for SOFTWARE_UPDATE event
- Add 30-ospp-v42.rules to meet new Common Criteria requirements
- Deprecate enable_krb and replace with transport config opt for remote logging
- Mark netlabel events as simple events so that get processed quicker
- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
- In aureport, fix segfault in file report
- Add auparse_normalizer support for labeled networking events
- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
- In ausearch/auparse, event aging is off by a second
- In ausearch/auparse, correct event ordering to process oldest first
- Migrate auparse python test to python3
- auparse_reset was not clearing everything it should
- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
- In ausearch/report, lightly parse selinux portion of USER_AVC events
- Add bpf syscall command argument interpretation to auparse
- In ausearch/report, limit record size when malformed
- Port af_unix plugin to libev
- In auditd, fix extract_type function for network originating events
- In auditd, calculate right size and location for network originating events
- Make legacy script wait for auditd to terminate (#1643567)
- Treat all network originating events as VER2 so dispatcher doesn't format it
- If an event has a node name make it VER2 so dispatcher doesnt format it
- In audisp-remote do an initial connection attempt (#1625156)
- In auditd, allow expression of space left as a percentage (#1650670)
- On PPC64LE systems, only allow 64 bit rules (#1462178)
- Make some parts of auditd state report optional based on config
- Update to libev-4.25
- Fix ausearch when checkpointing a single file (Burn Alting)
- Fix scripting in 31-privileged.rules wrt filecap (#1662516)
- In ausearch, do not checkpt if stdin is input source
- In libev, remove __cold__ attribute for functions to allow proper hardening
- Add tests to configure.ac for openldap support
- Make systemd support files use /run rather than /var/run (Christian Hesse)
- Fix minor memory leak in auditd kerberos credentials code
- Allow exclude and user filter by executable name (Ondrej Mosnacek)
- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
- In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Add substitue functions for strndupa &amp; rawmemchr
- Fix memleak in auparse caused by corrected event ordering
- Fix legacy reload script to reload audit rules when daemon is reloaded
- Support for unescaping in trusted messages (Dmitry Voronin)
- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
- In aureport, fix segfault for malformed USER_CMD events
- Add exe field to audit_log_user_command in libaudit
- In auditctl support filter on socket address families (Richard Guy Briggs)
- Deprecate support for Alpha &amp; IA64 processors
- If space_left_action is rotate, allow it every time (#1718444)
- In auparse, drop standalone EOE events
- Add milliseconds column for ausearch extra time csv format
- Fix aureport first event reporting when no start given
- In audisp-remote, add new config item for startup connection errors
- Remove dependency on chkconfig
- Install rules to /usr/share/audit/sample-rules/
- Split up ospp rules to make SCAP scanning easier (#1746018)
- In audisp-syslog, support interpreting records (#1497279)
- Audit USER events now sends msg as name value pair
- Add support for AUDIT_BPF event
- Auditd should not process AUDIT_REPLACE events
- Update syscall tables to the 5.5 kernel
- Improve personality interpretation by using PERS_MASK
- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup
- Change auparse python bindings to shared object (Issue #121)
- Add error messages for watch permissions
- If audit rules file doesn't exist log error message instead of info message
- Revise error message for unmatched options in auditctl
- In audisp-remote, fixup remote endpoint disappearin in ascii format
- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander)
- In auditctl, add support for sending a signal to auditd
- Removes audit-fno-common.patch: fixed in upstream
- Removes audit-python3.patch: fixed in upstream</changelog>
  <changelog author="ematsumiya@suse.com" date="1627646400">- Update to version 3.0.3:
  * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined
  * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids
  * Change auparse_feed_has_data in auparse to include incomplete events
  * Auditd, stop linking against -lrt
  * Add ProtectHome and RestrictRealtime to auditd.service
  * In auditd, read up to 3 netlink packets in a row
  * In auditd, do not validate path to plugin unless active
  * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists
- use https source urls</changelog>
  <changelog author="meissner@suse.com" date="1629115200">- harden_auditd.service.patch: automatic hardening applied to systemd
  services</changelog>
  <changelog author="ematsumiya@suse.com" date="1631793600">- Change default log_format from ENRICHED to RAW (bsc#1190500):
  * add change-default-log_format.patch (SUSE-specific patch)
- Update to version 3.0.5:
  * In auditd, flush uid/gid caches when user/group added/deleted/modified
  * Fixed various issues when dealing with corrupted logs
  * In auditd, check if log_file is valid before closing handle
- Include fixed from 3.0.4:
  * Apply performance speedups to auparse library
  * Optimize rule loading in auditctl
  * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath
  * Update syscall table to the 5.14 kernel
  * Fixed various issues when dealing with corrupted logs</changelog>
  <changelog author="ematsumiya@suse.com" date="1632139200">- Fix hardened auditd.service (bsc#1181400)
  * add fix-hardened-service.patch
    Make /etc/audit read-write from the service.
    Remove PrivateDevices=true to expose /dev/* to auditd.service.
- Enable stop rules for audit.service (cf. bsc#1190227)
  * add enable-stop-rules.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1634126400">- Create separate service for augenrules (bsc#1191614, bsc#1181400)
  * add create-augenrules-service.patch
  Remove ReadWritePaths=/etc/audit from auditd.service, also removes
  augenrules call from ExecStartPost.
  Create augenrules.service with the ReadWritePaths directive above.
  This makes /etc/audit only accessible by augenrules.service and
  let auditd.service (and daemon) to be sandboxed again.
- Update audit-secondary.spec to accomodate the new service file.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634299200">- Add CONFIG parameter to %sysusers_generate_pre</changelog>
  <changelog author="gmbr3@opensuse.org" date="1636286400">- Update to version 3.0.6:
  * fixes a segfault on some SELINUX_ERR records
  * makes IPX packet interpretation dependent on the ipx header
    file existing
  * adds b32/b64 support to ausyscall
  * adds support for armv8l
  * fixes auditctl list of syscalls on PPC
  * auditd.service now restarts auditd under some conditions</changelog>
  <changelog author="fvogt@suse.com" date="1638187200">- Use %autosetup
- Don't include sample rules as %doc, they're already installed
  as normal files
- Fix create-augenrules-service.patch:
  * auditd.service needs to require augenrules.service,
    not the other way around
- Fix documentation for enable-stop-rules.patch</changelog>
  <changelog author="dmueller@suse.com" date="1648036800">- add audit-userspace-517-compat.patch</changelog>
  <changelog author="ematsumiya@suse.com" date="1648209600">- Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645)
  * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
- Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517)
  * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="coolo@suse.com" date="1648296000">- Fix buildrequire for openldap2-devel - audit doesn't require the
  (outdated) C++ binding, but the C headers that happen to be pulled
  in by buildrequiring the C++ devel package</changelog>
  <changelog author="jengelh@inai.de" date="1649678400">- Drop buildrequire on C++ compiler.
- Modernize specfile constructs.</changelog>
  <changelog author="ali.abdallah@suse.com" date="1659441600">- Update audit-secondary.spec: create symbolic link from
  /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519).</changelog>
  <changelog author="lidong.zhong@suse.com" date="1667304000">- Fix rules not loaded when restarting auditd.service(bsc#1204844)</changelog>
</package>
<package pkgid="c5da37a3381f36428f6ff565a7b73e95fdf96b4e3dab52492f43b5a142316321" name="systemd" arch="aarch64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="fa043edd8ce029e162d68d2f6497ada95352024f158d05990ebbd3a67d0b472f" name="systemd" arch="src">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="f292e3f2d1c704b6066166b2d85ea7659953079660bb7b80c31b0cf08610c154" name="systemd" arch="x86_64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="230634c593fdb57a074702dcc7596f352eb180b496b2f2a7d511b5b9df76783c" name="systemd" arch="aarch64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="be34ab7e06d7b9e96cf5aa59f1bfe6736048b7e54dfb8fc6a9aa10e693727bab" name="systemd" arch="src">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="d9f89a5f169cc763e2d753b80611a43ecbe3fe8bf110479427567c7b36ab53e4" name="systemd" arch="x86_64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="afedfb263407ef5b1118fa5f094e5f8167c65670996b0378ef7db3a0a97b4bdd" name="systemd" arch="aarch64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="06cd4e77945aaf0dc4ee6b43e40a330d4f1cd934f9cca501ecfface05b8f825e" name="systemd" arch="src">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="24ccadc3f60c8e3b967f122f2b9565aa6c3cc20f807dabbfc8671950f6cfa28c" name="systemd" arch="x86_64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="0a28a1e917e56d8baa9d7512b070dfd0ef51647aa77074fd8898cf2a98a9f82f" name="systemd-container" arch="aarch64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="d5b02bbb00a02c43712d3c534309d4fa0ce3a7c2bf51e87fc3532f3183c2bad2" name="systemd-container" arch="x86_64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="67f2fd52de9507ee57d1f69e2d50d5b5004bbe3f6f4455afc34d0c0f606f6aea" name="systemd-container" arch="aarch64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="0663c4f59c2ea6fcac5d3a343dbab1f1b9e00fc7bc4bda4dde2ed28317ca82c0" name="systemd-container" arch="x86_64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="85f5a6b3ab6bb40745f31cd59bf4c6298e5beed8b5e6d5e55b3189eaa8d6cea5" name="systemd-container" arch="aarch64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="22f11821e4d488d8ca385ecf8757df0b7176402089dfa0d2efabf0070aa7c81f" name="systemd-container" arch="x86_64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="e9efb0ba2030d297fb5b53e31cc03a7077c6e2e3630002334c4e382511e48a82" name="systemd-journal-remote" arch="aarch64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="df676f3ecffc71b5ff9dafa5ad566606572b6967c5e75a09744e217961756b7c" name="systemd-journal-remote" arch="x86_64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="8c0adc2bd2183e9123179e83435c9ecb31643a175d5357d674fdf38d4a29c17f" name="systemd-journal-remote" arch="aarch64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="480d1e3767a573d45c98d8d882d6c2bd60f0dc5e2376c6d3c2bd8c6147ed3d43" name="systemd-journal-remote" arch="x86_64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="a699a995b05303b21acdbd20bf10c43e9a0d47889ff0e7aabd322ef309236185" name="systemd-journal-remote" arch="aarch64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="dc83800e22ef55e7c483bb506b8d0b93abf4122060bf26237d1911d31f243c85" name="systemd-journal-remote" arch="x86_64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="cfbb23938df548676db633fc633de56b8c1c1ceb5c282106d8f69f5dd75b3a9d" name="systemd-sysvinit" arch="aarch64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="8fcaa9c60d9fa85bf6be5e3de74b92fde143c3231db608325ad7ca9136d6103b" name="systemd-sysvinit" arch="x86_64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="52d7142a7d7682b00dfaed06a160d7f409d97fbff1c8f73b149c8456b0789e0b" name="systemd-sysvinit" arch="aarch64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="196a9083e5c3884d865712cd651276e5be2e2a2157b50b86bcca7e00070e62f2" name="systemd-sysvinit" arch="x86_64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="84b7383f1e2fa33cbced7f7e54f4b9e960ba9f823afb986979f7b5bc82ea1a17" name="systemd-sysvinit" arch="aarch64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="05a6264f5ae5c7e0af7af31b0a6cefb168f3980a87d2fdeb04b073b9ca156610" name="systemd-sysvinit" arch="x86_64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="8a88b99bddf7f8106eadb33e0b9b56067430df0b7e66a96478fff2dc549a0977" name="tar" arch="aarch64">
  <version epoch="0" ver="1.34" rel="150000.3.22.3"/>
  <changelog author="svalx@svalx.net" date="1491220800">- Use update-alternatives according to current documentation</changelog>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
</package>
<package pkgid="015beb7bf6e0877cc6f6f4995cfced9ed94d529141cdf6e515c11c6e4228570a" name="tar" arch="src">
  <version epoch="0" ver="1.34" rel="150000.3.22.3"/>
  <changelog author="svalx@svalx.net" date="1491220800">- Use update-alternatives according to current documentation</changelog>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
</package>
<package pkgid="71ae127229414f6b32b2e18b29b488bd66ad5209a7e36b416192b18eaf561add" name="tar" arch="x86_64">
  <version epoch="0" ver="1.34" rel="150000.3.22.3"/>
  <changelog author="svalx@svalx.net" date="1491220800">- Use update-alternatives according to current documentation</changelog>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
</package>
<package pkgid="7e87605122633ea88abffa0056e3301b783edf985496f2fdaa16808f772582bc" name="tar" arch="aarch64">
  <version epoch="0" ver="1.34" rel="150000.3.26.1"/>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Fix hang when unpacking test tarball, bsc#1202436
  * bsc1202436.patch</changelog>
</package>
<package pkgid="85554aa2006c0c7ad31d97702db4dd0540e7f76d3a8855b4e0fd94bb9c923c63" name="tar" arch="src">
  <version epoch="0" ver="1.34" rel="150000.3.26.1"/>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Fix hang when unpacking test tarball, bsc#1202436
  * bsc1202436.patch</changelog>
</package>
<package pkgid="abbf2a998c64f592bedfe8ae2e6e391d37e39a745b63d09c6c7bc6eb6dcab337" name="tar" arch="x86_64">
  <version epoch="0" ver="1.34" rel="150000.3.26.1"/>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Fix hang when unpacking test tarball, bsc#1202436
  * bsc1202436.patch</changelog>
</package>
<package pkgid="59e656cb93977c9f2fadace811290923be2fd00e3680b5a230e5eab3be8d401b" name="tar" arch="aarch64">
  <version epoch="0" ver="1.34" rel="150000.3.31.1"/>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Fix hang when unpacking test tarball, bsc#1202436
  * bsc1202436.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676376000">- Fix CVE-2022-48303, tar has a one-byte out-of-bounds read that
  results in use of uninitialized memory for a conditional jump
  (CVE-2022-48303, bsc#1207753)
  * fix-CVE-2022-48303.patch
- Fix hang when unpacking test tarball, bsc#1202436
  * remove bsc1202436.patch
  * bsc1202436-1.patch
  * bsc1202436-1.patch</changelog>
</package>
<package pkgid="b3cf9ef1092da901254617db96cd0b82361b43ed94c71dc90799021d446245c0" name="tar" arch="src">
  <version epoch="0" ver="1.34" rel="150000.3.31.1"/>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Fix hang when unpacking test tarball, bsc#1202436
  * bsc1202436.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676376000">- Fix CVE-2022-48303, tar has a one-byte out-of-bounds read that
  results in use of uninitialized memory for a conditional jump
  (CVE-2022-48303, bsc#1207753)
  * fix-CVE-2022-48303.patch
- Fix hang when unpacking test tarball, bsc#1202436
  * remove bsc1202436.patch
  * bsc1202436-1.patch
  * bsc1202436-1.patch</changelog>
</package>
<package pkgid="4fc7c60f33460d2430c9ed4f5f40881e9d0ee98c2a59172247acf0b4a8b2094f" name="tar" arch="x86_64">
  <version epoch="0" ver="1.34" rel="150000.3.31.1"/>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Fix hang when unpacking test tarball, bsc#1202436
  * bsc1202436.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676376000">- Fix CVE-2022-48303, tar has a one-byte out-of-bounds read that
  results in use of uninitialized memory for a conditional jump
  (CVE-2022-48303, bsc#1207753)
  * fix-CVE-2022-48303.patch
- Fix hang when unpacking test tarball, bsc#1202436
  * remove bsc1202436.patch
  * bsc1202436-1.patch
  * bsc1202436-1.patch</changelog>
</package>
<package pkgid="ee7ffdc57757fa092aeb2f8acdc66812f128ea6d9ba238ca0001094ff683fc01" name="tcl" arch="aarch64">
  <version epoch="0" ver="8.6.12" rel="150300.14.9.1"/>
  <changelog author="max@suse.com" date="1506340800">- Whitelist known-failing tests. Further investigation needed.</changelog>
  <changelog author="max@suse.com" date="1508414400">- Sync SLE12 with Factory to fix a bug in Itcl that was affecting
  iwidgets (bsc#903017).</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1513252800">- Add more tests in Whitelist as bypass boo#1072657
  identified following tests failed on PowerPC
  interp-34.9 interp-34.13 http-3.25 timer-2.1 thread-20.9</changelog>
  <changelog author="mls@suse.de" date="1513252801">- adapt check section for rpm-4.14.0</changelog>
  <changelog author="max@suse.com" date="1514548800">- Version 8.6.8:
  * [array names -regexp] supports backrefs
  * Fix gcc build failures due to #pragma placement
  * (bug)[b50fb2] exec redir append stdout and stderr to file
  * (bug)[2a9465] http state 100 continue handling broken
  * (bug)[0e4d88] replace command, delete trace kills namespace
  * (bug)[1a5655] [info * methods] includes mixins
  * (bug)[fc1409] segfault in method cloning, oo-15.15
  * (bug)[3298012] Stop crash when hash tables overflow 32 bits
  * (bug)[5d6de6] Close failing case of [package prefer stable]
  * (bug)[4f6a1e] Crash when ensemble map and list are same
  * (bug)[ce3a21] file normalize failure when tail is empty
  * (new)[TIP 477] nmake build system reform
  * (bug)[586e71] EvalObjv exception handling at level #0</changelog>
  <changelog author="ro@suse.de" date="1521115200">- handle s390 like s390x (bnc#1085480)</changelog>
  <changelog author="max@suse.com" date="1544616000">- New version: 8.6.9:
  * NR-enable [package require]
  * (bug)[9fd5c6] crash in object deletion, test oo-11.5
  * (bug)[3c32a3] crash deleting object with class mixed in
  * (platform) stop using -lieee, removed from glibc-2.27
    (bsc#1179615, bsc#1181840).
  * (bug)[8e6a9a] bad binary [string match], test string-11.55
  * (bug)[1873ea] repair multi-thread std channel init
  * (bug)[db36fa] broken bytecode for index values
  * (bug) broken compiled [string replace], test string-14.19
  * (bug) [string trim*] engine crashed on invalid UTF
  * (bug) missing trace in compiled [array set], test var-20.11
  * (bug)[46a241] crash in unset array with search, var-13.[23]
  * (bug)[27b682] race made [file delete] raise "no such file"
  * (bug)[925643] 32/64 cleanup of filesystem DIR operations
  * (bug) leaks in TclSetEnv and env cache
  * (bug)[3592747] [yieldto] dying namespace, tailcall-14.1
  * (bug)[270f78] race in [file mkdir]
  * (bug)[3f7af0] [file delete] raised "permission denied"
  * (bug)[d051b7] overflow crash in [format]
  * revised quoting of [exec] args in generated command line
  * HTTP Keep-Alive with pipelined requests
  * (new)[TIP 505] [lreplace] accepts all out of range indices
  * (bug) Prevent crash from NULL keyName in the registry package
  * Update tcltest package for Travis support
  * (bug)[35a8f1] overlong string length of some lists
  * (bug)[00d04c] Repair [binary encode base64]</changelog>
  <changelog author="max@suse.com" date="1547726400">- Fix a regression in the handling of denormalized empty lists
  (tcl-expand-regression.patch, tcl#cc1e91552c).</changelog>
  <changelog author="mliska@suse.cz" date="1561032000">- Use FAT LTO objects in order to provide proper static
  library (boo#1138797).</changelog>
  <changelog author="schwab@suse.de" date="1562673600">- binary-40.3 is expected to fail on riscv64 which does not support NaN
  propagation</changelog>
  <changelog author="max@suse.com" date="1575374400">- New version: 8.6.10:
  * (bug)[7a9dc5] [file normalize ~/~foo] segfault
  * (bug)[3cf3a9] variable 'timezone' deprecated in vc2017
  * (bug)[cc1e91] [list [list {*}[set a " "]]] regression
    obsoletes tcl-expand-regression.patch.
  * (bug)[e3f481] tests var-1.2[01]
  * (new) Update to Unicode 12.0
  * (new)[TIP 527] New command [timerate]
  * (bug)[39fed4] [package require] memory validity
  * (new) New command tcl::unsupported::corotype
  * (bug) memlink when namespace deletion kills linked var
  * (new) README file converted to README.md in Markdown
  * (bug)[8b9854] [info level 0] regression with ensembles
  * (bug)[6bdadf] crash multi-arg write-traced [lappend]
  * (bug)[f8a33c] crash Tcl_Exit before init
  * (bug)[fa6bf3] Bytecode fails epoch recovery at numLevel=0
  * (bug)[fec0c1] C stack overflow compiling bytecode
  * tzdata updated to Olson's tzdata2019c
  * (bug)[16768d] Fix [info hostname] on NetBSD
  * (new) libtommath updated to release 1.2.0
  * (bug)[bcd100] bad fs cache when system encoding changes
  * (bug)[135804] segfault in [next] after destroy
  * (bug)[13657a] application/json us text, not binary</changelog>
  <changelog author="dimstar@opensuse.org" date="1602244800">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  lib64 == lib64.</changelog>
  <changelog author="max@suse.com" date="1605873600">- Add a manpage symlink for tclsh8.6.</changelog>
  <changelog author="max@suse.com" date="1609761600">- New version: 8.6.11:
  * Add tcltest::(Setup|Eval|Cleanup|)Test
  * Update to Unicode-13
  * Add 3 libtommath functions to stub table
  * Many more bug fixes
- Potentially incompatible changes:
  * (bug)[ffeb20] [binary decode base64] ignore invalid chars
  * (bug)[b8e82d] some -maxlen values break uuencode round trip
  * (bug)[085913] Tcl_DStringAppendElement # quoting precision
  * (bug)[81242a] revised documentation for Tcl_UtfAtIndex()
  * (bug)[ed2980] Tcl_UtfToUniChar reads &gt; TCL_UTF_MAX bytes
  * (bug)[a1bd37] [clock scan] new ISO format (clock-34.(19-24))
  * (bug)[501974] [clock scan] +time zone (clock-34.(53-68))
  * (new) force -eofchar \032 when evaluating library scripts
  * (new)[48898a] improve error message consistency
  * (new) revised case of module names</changelog>
  <changelog author="max@suse.com" date="1610625600">- tclConfig.sh: Fix path names and avoid braces in TCL_PACKAGE_PATH
- Set TCL_LIBRARY at configure time for better consistency.</changelog>
  <changelog author="max@suse.com" date="1620216000">- bsc#1185662: Move tcl.macros /usr/lib/rpm/macros.d .
- https://core.tcl-lang.org/thread/tktview?name=98ae20f0f5:
  Add tcl-aa4a13c15516da45.patch to disable lto for the stubs
  libraries.</changelog>
  <changelog author="max@suse.com" date="1636459200">- New version 8.6.12:
  * (bug)[d43f96] [string trim*] broken for Emoji
  * (bug)[22324b] [string reverse] broken for Emoji
  * (bug)[1dab71,7c64aa] BRE broken by uninitialized value use
  * (bug)[8419c5] Unix tty channels tolerate EINTR
  * ** POTENTIAL INCOMPATIBILITY ***
  * (bug)[4c591f] [string compare] EIAS violation
  * (bug)[266494] [concat foo [list #]] EIAS violation
  * (bug)[24b918] Save IO buffers from modern optimizers
  * (new) support for POSIX error EILSEQ
  * (bug)[688fcc] segfault during traced delete of alias
  * (bug)[ccc448] segfault in ensemble rewrite machinery
  * (new) Update to Unicode-14
  * (bug)[a8579d] failed proc argument spec processing
  * Obsoletes tcl-aa4a13c15516da45.patch
- Bump %itclver and ensure it stays in sync.</changelog>
  <changelog author="max@suse.com" date="1648555200">- Remove the SQLite extension and package it as a subpackage of
  sqlite3 to have only a single copy and keep it more up to date
  (bsc#1195773).
- Clean up the lib dependencies in tclConfig.sh and tcl.pc.</changelog>
  <changelog author="max@suse.com" date="1663848000">- Fix a race condition in test socket-13.1
  (tcl-test-socket-13.1.patch).</changelog>
  <changelog author="max@suse.com" date="1673956800">- [bsc#1206623], tcl-string-compare.patch:
  Fix [string compare -length] on big endian and improve
  [string equal] on little endian.</changelog>
</package>
<package pkgid="312e9a0ebd28cc0d3a4c11c688575182d8392962734c6c88a991e20c4853efb1" name="tcl" arch="src">
  <version epoch="0" ver="8.6.12" rel="150300.14.9.1"/>
  <changelog author="max@suse.com" date="1506340800">- Whitelist known-failing tests. Further investigation needed.</changelog>
  <changelog author="max@suse.com" date="1508414400">- Sync SLE12 with Factory to fix a bug in Itcl that was affecting
  iwidgets (bsc#903017).</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1513252800">- Add more tests in Whitelist as bypass boo#1072657
  identified following tests failed on PowerPC
  interp-34.9 interp-34.13 http-3.25 timer-2.1 thread-20.9</changelog>
  <changelog author="mls@suse.de" date="1513252801">- adapt check section for rpm-4.14.0</changelog>
  <changelog author="max@suse.com" date="1514548800">- Version 8.6.8:
  * [array names -regexp] supports backrefs
  * Fix gcc build failures due to #pragma placement
  * (bug)[b50fb2] exec redir append stdout and stderr to file
  * (bug)[2a9465] http state 100 continue handling broken
  * (bug)[0e4d88] replace command, delete trace kills namespace
  * (bug)[1a5655] [info * methods] includes mixins
  * (bug)[fc1409] segfault in method cloning, oo-15.15
  * (bug)[3298012] Stop crash when hash tables overflow 32 bits
  * (bug)[5d6de6] Close failing case of [package prefer stable]
  * (bug)[4f6a1e] Crash when ensemble map and list are same
  * (bug)[ce3a21] file normalize failure when tail is empty
  * (new)[TIP 477] nmake build system reform
  * (bug)[586e71] EvalObjv exception handling at level #0</changelog>
  <changelog author="ro@suse.de" date="1521115200">- handle s390 like s390x (bnc#1085480)</changelog>
  <changelog author="max@suse.com" date="1544616000">- New version: 8.6.9:
  * NR-enable [package require]
  * (bug)[9fd5c6] crash in object deletion, test oo-11.5
  * (bug)[3c32a3] crash deleting object with class mixed in
  * (platform) stop using -lieee, removed from glibc-2.27
    (bsc#1179615, bsc#1181840).
  * (bug)[8e6a9a] bad binary [string match], test string-11.55
  * (bug)[1873ea] repair multi-thread std channel init
  * (bug)[db36fa] broken bytecode for index values
  * (bug) broken compiled [string replace], test string-14.19
  * (bug) [string trim*] engine crashed on invalid UTF
  * (bug) missing trace in compiled [array set], test var-20.11
  * (bug)[46a241] crash in unset array with search, var-13.[23]
  * (bug)[27b682] race made [file delete] raise "no such file"
  * (bug)[925643] 32/64 cleanup of filesystem DIR operations
  * (bug) leaks in TclSetEnv and env cache
  * (bug)[3592747] [yieldto] dying namespace, tailcall-14.1
  * (bug)[270f78] race in [file mkdir]
  * (bug)[3f7af0] [file delete] raised "permission denied"
  * (bug)[d051b7] overflow crash in [format]
  * revised quoting of [exec] args in generated command line
  * HTTP Keep-Alive with pipelined requests
  * (new)[TIP 505] [lreplace] accepts all out of range indices
  * (bug) Prevent crash from NULL keyName in the registry package
  * Update tcltest package for Travis support
  * (bug)[35a8f1] overlong string length of some lists
  * (bug)[00d04c] Repair [binary encode base64]</changelog>
  <changelog author="max@suse.com" date="1547726400">- Fix a regression in the handling of denormalized empty lists
  (tcl-expand-regression.patch, tcl#cc1e91552c).</changelog>
  <changelog author="mliska@suse.cz" date="1561032000">- Use FAT LTO objects in order to provide proper static
  library (boo#1138797).</changelog>
  <changelog author="schwab@suse.de" date="1562673600">- binary-40.3 is expected to fail on riscv64 which does not support NaN
  propagation</changelog>
  <changelog author="max@suse.com" date="1575374400">- New version: 8.6.10:
  * (bug)[7a9dc5] [file normalize ~/~foo] segfault
  * (bug)[3cf3a9] variable 'timezone' deprecated in vc2017
  * (bug)[cc1e91] [list [list {*}[set a " "]]] regression
    obsoletes tcl-expand-regression.patch.
  * (bug)[e3f481] tests var-1.2[01]
  * (new) Update to Unicode 12.0
  * (new)[TIP 527] New command [timerate]
  * (bug)[39fed4] [package require] memory validity
  * (new) New command tcl::unsupported::corotype
  * (bug) memlink when namespace deletion kills linked var
  * (new) README file converted to README.md in Markdown
  * (bug)[8b9854] [info level 0] regression with ensembles
  * (bug)[6bdadf] crash multi-arg write-traced [lappend]
  * (bug)[f8a33c] crash Tcl_Exit before init
  * (bug)[fa6bf3] Bytecode fails epoch recovery at numLevel=0
  * (bug)[fec0c1] C stack overflow compiling bytecode
  * tzdata updated to Olson's tzdata2019c
  * (bug)[16768d] Fix [info hostname] on NetBSD
  * (new) libtommath updated to release 1.2.0
  * (bug)[bcd100] bad fs cache when system encoding changes
  * (bug)[135804] segfault in [next] after destroy
  * (bug)[13657a] application/json us text, not binary</changelog>
  <changelog author="dimstar@opensuse.org" date="1602244800">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  lib64 == lib64.</changelog>
  <changelog author="max@suse.com" date="1605873600">- Add a manpage symlink for tclsh8.6.</changelog>
  <changelog author="max@suse.com" date="1609761600">- New version: 8.6.11:
  * Add tcltest::(Setup|Eval|Cleanup|)Test
  * Update to Unicode-13
  * Add 3 libtommath functions to stub table
  * Many more bug fixes
- Potentially incompatible changes:
  * (bug)[ffeb20] [binary decode base64] ignore invalid chars
  * (bug)[b8e82d] some -maxlen values break uuencode round trip
  * (bug)[085913] Tcl_DStringAppendElement # quoting precision
  * (bug)[81242a] revised documentation for Tcl_UtfAtIndex()
  * (bug)[ed2980] Tcl_UtfToUniChar reads &gt; TCL_UTF_MAX bytes
  * (bug)[a1bd37] [clock scan] new ISO format (clock-34.(19-24))
  * (bug)[501974] [clock scan] +time zone (clock-34.(53-68))
  * (new) force -eofchar \032 when evaluating library scripts
  * (new)[48898a] improve error message consistency
  * (new) revised case of module names</changelog>
  <changelog author="max@suse.com" date="1610625600">- tclConfig.sh: Fix path names and avoid braces in TCL_PACKAGE_PATH
- Set TCL_LIBRARY at configure time for better consistency.</changelog>
  <changelog author="max@suse.com" date="1620216000">- bsc#1185662: Move tcl.macros /usr/lib/rpm/macros.d .
- https://core.tcl-lang.org/thread/tktview?name=98ae20f0f5:
  Add tcl-aa4a13c15516da45.patch to disable lto for the stubs
  libraries.</changelog>
  <changelog author="max@suse.com" date="1636459200">- New version 8.6.12:
  * (bug)[d43f96] [string trim*] broken for Emoji
  * (bug)[22324b] [string reverse] broken for Emoji
  * (bug)[1dab71,7c64aa] BRE broken by uninitialized value use
  * (bug)[8419c5] Unix tty channels tolerate EINTR
  * ** POTENTIAL INCOMPATIBILITY ***
  * (bug)[4c591f] [string compare] EIAS violation
  * (bug)[266494] [concat foo [list #]] EIAS violation
  * (bug)[24b918] Save IO buffers from modern optimizers
  * (new) support for POSIX error EILSEQ
  * (bug)[688fcc] segfault during traced delete of alias
  * (bug)[ccc448] segfault in ensemble rewrite machinery
  * (new) Update to Unicode-14
  * (bug)[a8579d] failed proc argument spec processing
  * Obsoletes tcl-aa4a13c15516da45.patch
- Bump %itclver and ensure it stays in sync.</changelog>
  <changelog author="max@suse.com" date="1648555200">- Remove the SQLite extension and package it as a subpackage of
  sqlite3 to have only a single copy and keep it more up to date
  (bsc#1195773).
- Clean up the lib dependencies in tclConfig.sh and tcl.pc.</changelog>
  <changelog author="max@suse.com" date="1663848000">- Fix a race condition in test socket-13.1
  (tcl-test-socket-13.1.patch).</changelog>
  <changelog author="max@suse.com" date="1673956800">- [bsc#1206623], tcl-string-compare.patch:
  Fix [string compare -length] on big endian and improve
  [string equal] on little endian.</changelog>
</package>
<package pkgid="0c95818637f7c4f636b1af9cedb0880b3ab544306f124f6433c3f2be8385ce15" name="tcl" arch="x86_64">
  <version epoch="0" ver="8.6.12" rel="150300.14.9.1"/>
  <changelog author="max@suse.com" date="1506340800">- Whitelist known-failing tests. Further investigation needed.</changelog>
  <changelog author="max@suse.com" date="1508414400">- Sync SLE12 with Factory to fix a bug in Itcl that was affecting
  iwidgets (bsc#903017).</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1513252800">- Add more tests in Whitelist as bypass boo#1072657
  identified following tests failed on PowerPC
  interp-34.9 interp-34.13 http-3.25 timer-2.1 thread-20.9</changelog>
  <changelog author="mls@suse.de" date="1513252801">- adapt check section for rpm-4.14.0</changelog>
  <changelog author="max@suse.com" date="1514548800">- Version 8.6.8:
  * [array names -regexp] supports backrefs
  * Fix gcc build failures due to #pragma placement
  * (bug)[b50fb2] exec redir append stdout and stderr to file
  * (bug)[2a9465] http state 100 continue handling broken
  * (bug)[0e4d88] replace command, delete trace kills namespace
  * (bug)[1a5655] [info * methods] includes mixins
  * (bug)[fc1409] segfault in method cloning, oo-15.15
  * (bug)[3298012] Stop crash when hash tables overflow 32 bits
  * (bug)[5d6de6] Close failing case of [package prefer stable]
  * (bug)[4f6a1e] Crash when ensemble map and list are same
  * (bug)[ce3a21] file normalize failure when tail is empty
  * (new)[TIP 477] nmake build system reform
  * (bug)[586e71] EvalObjv exception handling at level #0</changelog>
  <changelog author="ro@suse.de" date="1521115200">- handle s390 like s390x (bnc#1085480)</changelog>
  <changelog author="max@suse.com" date="1544616000">- New version: 8.6.9:
  * NR-enable [package require]
  * (bug)[9fd5c6] crash in object deletion, test oo-11.5
  * (bug)[3c32a3] crash deleting object with class mixed in
  * (platform) stop using -lieee, removed from glibc-2.27
    (bsc#1179615, bsc#1181840).
  * (bug)[8e6a9a] bad binary [string match], test string-11.55
  * (bug)[1873ea] repair multi-thread std channel init
  * (bug)[db36fa] broken bytecode for index values
  * (bug) broken compiled [string replace], test string-14.19
  * (bug) [string trim*] engine crashed on invalid UTF
  * (bug) missing trace in compiled [array set], test var-20.11
  * (bug)[46a241] crash in unset array with search, var-13.[23]
  * (bug)[27b682] race made [file delete] raise "no such file"
  * (bug)[925643] 32/64 cleanup of filesystem DIR operations
  * (bug) leaks in TclSetEnv and env cache
  * (bug)[3592747] [yieldto] dying namespace, tailcall-14.1
  * (bug)[270f78] race in [file mkdir]
  * (bug)[3f7af0] [file delete] raised "permission denied"
  * (bug)[d051b7] overflow crash in [format]
  * revised quoting of [exec] args in generated command line
  * HTTP Keep-Alive with pipelined requests
  * (new)[TIP 505] [lreplace] accepts all out of range indices
  * (bug) Prevent crash from NULL keyName in the registry package
  * Update tcltest package for Travis support
  * (bug)[35a8f1] overlong string length of some lists
  * (bug)[00d04c] Repair [binary encode base64]</changelog>
  <changelog author="max@suse.com" date="1547726400">- Fix a regression in the handling of denormalized empty lists
  (tcl-expand-regression.patch, tcl#cc1e91552c).</changelog>
  <changelog author="mliska@suse.cz" date="1561032000">- Use FAT LTO objects in order to provide proper static
  library (boo#1138797).</changelog>
  <changelog author="schwab@suse.de" date="1562673600">- binary-40.3 is expected to fail on riscv64 which does not support NaN
  propagation</changelog>
  <changelog author="max@suse.com" date="1575374400">- New version: 8.6.10:
  * (bug)[7a9dc5] [file normalize ~/~foo] segfault
  * (bug)[3cf3a9] variable 'timezone' deprecated in vc2017
  * (bug)[cc1e91] [list [list {*}[set a " "]]] regression
    obsoletes tcl-expand-regression.patch.
  * (bug)[e3f481] tests var-1.2[01]
  * (new) Update to Unicode 12.0
  * (new)[TIP 527] New command [timerate]
  * (bug)[39fed4] [package require] memory validity
  * (new) New command tcl::unsupported::corotype
  * (bug) memlink when namespace deletion kills linked var
  * (new) README file converted to README.md in Markdown
  * (bug)[8b9854] [info level 0] regression with ensembles
  * (bug)[6bdadf] crash multi-arg write-traced [lappend]
  * (bug)[f8a33c] crash Tcl_Exit before init
  * (bug)[fa6bf3] Bytecode fails epoch recovery at numLevel=0
  * (bug)[fec0c1] C stack overflow compiling bytecode
  * tzdata updated to Olson's tzdata2019c
  * (bug)[16768d] Fix [info hostname] on NetBSD
  * (new) libtommath updated to release 1.2.0
  * (bug)[bcd100] bad fs cache when system encoding changes
  * (bug)[135804] segfault in [next] after destroy
  * (bug)[13657a] application/json us text, not binary</changelog>
  <changelog author="dimstar@opensuse.org" date="1602244800">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  lib64 == lib64.</changelog>
  <changelog author="max@suse.com" date="1605873600">- Add a manpage symlink for tclsh8.6.</changelog>
  <changelog author="max@suse.com" date="1609761600">- New version: 8.6.11:
  * Add tcltest::(Setup|Eval|Cleanup|)Test
  * Update to Unicode-13
  * Add 3 libtommath functions to stub table
  * Many more bug fixes
- Potentially incompatible changes:
  * (bug)[ffeb20] [binary decode base64] ignore invalid chars
  * (bug)[b8e82d] some -maxlen values break uuencode round trip
  * (bug)[085913] Tcl_DStringAppendElement # quoting precision
  * (bug)[81242a] revised documentation for Tcl_UtfAtIndex()
  * (bug)[ed2980] Tcl_UtfToUniChar reads &gt; TCL_UTF_MAX bytes
  * (bug)[a1bd37] [clock scan] new ISO format (clock-34.(19-24))
  * (bug)[501974] [clock scan] +time zone (clock-34.(53-68))
  * (new) force -eofchar \032 when evaluating library scripts
  * (new)[48898a] improve error message consistency
  * (new) revised case of module names</changelog>
  <changelog author="max@suse.com" date="1610625600">- tclConfig.sh: Fix path names and avoid braces in TCL_PACKAGE_PATH
- Set TCL_LIBRARY at configure time for better consistency.</changelog>
  <changelog author="max@suse.com" date="1620216000">- bsc#1185662: Move tcl.macros /usr/lib/rpm/macros.d .
- https://core.tcl-lang.org/thread/tktview?name=98ae20f0f5:
  Add tcl-aa4a13c15516da45.patch to disable lto for the stubs
  libraries.</changelog>
  <changelog author="max@suse.com" date="1636459200">- New version 8.6.12:
  * (bug)[d43f96] [string trim*] broken for Emoji
  * (bug)[22324b] [string reverse] broken for Emoji
  * (bug)[1dab71,7c64aa] BRE broken by uninitialized value use
  * (bug)[8419c5] Unix tty channels tolerate EINTR
  * ** POTENTIAL INCOMPATIBILITY ***
  * (bug)[4c591f] [string compare] EIAS violation
  * (bug)[266494] [concat foo [list #]] EIAS violation
  * (bug)[24b918] Save IO buffers from modern optimizers
  * (new) support for POSIX error EILSEQ
  * (bug)[688fcc] segfault during traced delete of alias
  * (bug)[ccc448] segfault in ensemble rewrite machinery
  * (new) Update to Unicode-14
  * (bug)[a8579d] failed proc argument spec processing
  * Obsoletes tcl-aa4a13c15516da45.patch
- Bump %itclver and ensure it stays in sync.</changelog>
  <changelog author="max@suse.com" date="1648555200">- Remove the SQLite extension and package it as a subpackage of
  sqlite3 to have only a single copy and keep it more up to date
  (bsc#1195773).
- Clean up the lib dependencies in tclConfig.sh and tcl.pc.</changelog>
  <changelog author="max@suse.com" date="1663848000">- Fix a race condition in test socket-13.1
  (tcl-test-socket-13.1.patch).</changelog>
  <changelog author="max@suse.com" date="1673956800">- [bsc#1206623], tcl-string-compare.patch:
  Fix [string compare -length] on big endian and improve
  [string equal] on little endian.</changelog>
</package>
<package pkgid="8107e629c6be218b981e0562cb3fc1c7791957d89e7fdf2de577a418f060c971" name="tiff" arch="src">
  <version epoch="0" ver="4.0.9" rel="150000.45.19.1"/>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
</package>
<package pkgid="01115c5d322baca44af9f73054a8c31b7e6bc72aeea077c9d5ce63312ede6223" name="tiff" arch="src">
  <version epoch="0" ver="4.0.9" rel="150000.45.22.1"/>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
</package>
<package pkgid="9145701df961a5b496f4004bf8798a44188d11e6f2b3966b37b5b5f4921b09bd" name="tiff" arch="src">
  <version epoch="0" ver="4.0.9" rel="150000.45.25.1"/>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
</package>
<package pkgid="54af7afb3715b03b155d88b3bddf3430cd02d53b2f29873b3a7e628d646258ee" name="timezone" arch="aarch64">
  <version epoch="0" ver="2022g" rel="150000.75.18.1"/>
  <changelog author="mcalabkova@suse.com" date="1546603200">- timezone update 2018i (bsc#1120402)
  * São Tomé and Príncipe switches from +01 to +00 on 2019-01-01.
- timezone update 2018h
  * Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21
  * New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move
  * Metlakatla, Alaska observes PST this winter only
  * Guess Morocco will continue to adjust clocks around Ramadan
  * Add predictions for Iran from 2038 through 2090</changelog>
  <changelog author="mcalabkova@suse.com" date="1553601600">- timezone update 2019a:
  * Palestine "springs forward" on 2019-03-30 instead of 2019-03-23
  * Metlakatla "fell back" to rejoin Alaska Time on 2019-01-20 at
    02:00
  * Israel observed DST in 1980 (08-02/09-13) and 1984 (05-05/08-25)
  * zic now has an -r option to limit the time range of output data</changelog>
  <changelog author="mcalabkova@suse.com" date="1562068800">- timezone update 2019b (bsc#1140016):
  * Brazil no longer observes DST.
  * 'zic -b slim' outputs smaller TZif files.
  * Palestine's 2019 spring-forward transition was on 03-29,
    not 03-30.
  * Add info about the Crimea situation.</changelog>
  <changelog author="mcalabkova@suse.com" date="1568289600">- timezone update 2019c (bsc#1150451)
  * Fiji observes DST from 2019-11-10 to 2020-01-12.
  * Norfolk Island starts observing Australian-style DST.</changelog>
  <changelog author="mcalabkova@suse.com" date="1587729600">- timezone update 2020a (bsc#1169582)
  * Morocco springs forward on 2020-05-31, not 2020-05-24.
  * Canada's Yukon advanced to -07 year-round on 2020-03-08.
  * America/Nuuk renamed from America/Godthab.
  * zic now supports expiration dates for leap second lists.</changelog>
  <changelog author="mcalabkova@suse.com" date="1590408000">- zdump --version reported "unknown" (boo#1172055)</changelog>
  <changelog author="mcalabkova@suse.com" date="1602158400">- timezone update 2020b (bsc#1177460)
  * Revised predictions for Morocco's changes starting in 2023.
  * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
  * Macquarie Island has stayed in sync with Tasmania since 2011.
  * Casey, Antarctica is at +08 in winter and +11 in summer.
  * zic no longer supports -y, nor the TYPE field of Rules.
- Rebased timezone-2018f-bsc1112310.patch</changelog>
  <changelog author="mcalabkova@suse.com" date="1603108800">- timezone update 2020c (bsc#1177460)
  * Fiji starts DST later than usual, on 2020-12-20.</changelog>
  <changelog author="mcalabkova@suse.com" date="1603368000">- timezone update 2020d (bsc#1177460)
  * Palestine ends DST earlier than predicted, on 2020-10-24.</changelog>
  <changelog author="mcalabkova@suse.com" date="1604318400">- Add fat.patch to generate "fat" timezone files (was default before 2020b)
  bsc#1178346</changelog>
  <changelog author="mmachova@suse.com" date="1608724800">- timezone update 2020e (bsc#1177460)
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.</changelog>
  <changelog author="mmachova@suse.com" date="1609243200">- timezone update 2020f (bsc#1177460)
  * 'make rearguard_tarballs' no longer generates a bad rearguard.zi,
    fixing a 2020e bug.</changelog>
  <changelog author="mmachova@suse.com" date="1611576000">- timezone update 2021a (bsc#1177460)
  * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.</changelog>
  <changelog author="mmachova@suse.com" date="1625745600">- Install tzdata.zi (bsc#1188127)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637150400">- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "-00"
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647518400">- timezone update 2022a (bsc#1177460):
  * Palestine will spring forward on 2022-03-27, not -03-26*
  * zdump -v now outputs better failure indications
  * Bug fixes for code that reads corrupted TZif data</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661515200">- Update to reflect new Chile DST change, bsc#1202310
  * bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665576000">- timezone update 2022e (bsc#1177460):
  * Jordan and Syria switch from +02/+03 with DST to year-round +03
- timezone update 2022d:
  * Palestine transitions are now Saturdays at 02:00
  * Simplify three Ukraine zones into one
- timezone update 2022c:
  * Work around awk bug
  * Improve tzselect on intercontinental Zones
- timezone update 2022b:
  * Chile's DST is delayed by a week in September 2022 boo#1202324
  * Iran no longer observes DST after 2022
  * Rename Europe/Kiev to Europe/Kyiv
  * New zic -R option
  * Vanguard form now uses %z
  * Finish moving duplicate-since-1970 zones to 'backzone'
- Refresh tzdata-china.diff
- Remove upstreamed bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- timezone update 2022f (bsc#1177460):
  * Mexico will no longer observe DST except near the US border
  * Chihuahua moves to year-round -06 on 2022-10-30
  * Fiji no longer observes DST
  * Move links to 'backward'
  * In vanguard form, GMT is now a Zone and Etc/GMT a link
  * zic now supports links to links, and vanguard form uses this
  * Simplify four Ontario zones
  * Fix a Y2438 bug when reading TZif data
  * Enable 64-bit time_t on 32-bit glibc platforms
  * Omit large-file support when no longer needed
  * In C code, use some C23 features if available
  * Remove no-longer-needed workaround for Qt bug 53071
- Refreshed patches:
  * fat.patch
  * tzdata-china.diff</changelog>
  <changelog author="danilo.spinella@suse.com" date="1670241600">- timezone update 2022g (bsc#1177460):
  * In the Mexican state of Chihuahua, the border strip near the US
    will change to agree with nearby US locations on 2022-11-30.
    The strip's western part, represented by Ciudad Juárez, switches
    from -06 all year to -07/-06 with US DST rules, like El Paso, TX.
    The eastern part, represented by Ojinaga, will observe US DST next
    year, like Presidio, TX.
    A new Zone America/Ciudad_Juarez splits from America/Ojinaga.
  * Much of Greenland, represented by America/Nuuk, stops observing
    winter time after March 2023, so its daylight saving time becomes
    standard time.
  * Changes for pre-1996 northern Canada
  * Update to past DST transition in Colombia (1993), Singapore
    (1981)
  * timegm is now supported by default</changelog>
</package>
<package pkgid="31bcba921ff21a44f5493015d9c1113e2b574909d895821c187f942d097a7a67" name="timezone" arch="src">
  <version epoch="0" ver="2022g" rel="150000.75.18.1"/>
  <changelog author="mcalabkova@suse.com" date="1546603200">- timezone update 2018i (bsc#1120402)
  * São Tomé and Príncipe switches from +01 to +00 on 2019-01-01.
- timezone update 2018h
  * Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21
  * New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move
  * Metlakatla, Alaska observes PST this winter only
  * Guess Morocco will continue to adjust clocks around Ramadan
  * Add predictions for Iran from 2038 through 2090</changelog>
  <changelog author="mcalabkova@suse.com" date="1553601600">- timezone update 2019a:
  * Palestine "springs forward" on 2019-03-30 instead of 2019-03-23
  * Metlakatla "fell back" to rejoin Alaska Time on 2019-01-20 at
    02:00
  * Israel observed DST in 1980 (08-02/09-13) and 1984 (05-05/08-25)
  * zic now has an -r option to limit the time range of output data</changelog>
  <changelog author="mcalabkova@suse.com" date="1562068800">- timezone update 2019b (bsc#1140016):
  * Brazil no longer observes DST.
  * 'zic -b slim' outputs smaller TZif files.
  * Palestine's 2019 spring-forward transition was on 03-29,
    not 03-30.
  * Add info about the Crimea situation.</changelog>
  <changelog author="mcalabkova@suse.com" date="1568289600">- timezone update 2019c (bsc#1150451)
  * Fiji observes DST from 2019-11-10 to 2020-01-12.
  * Norfolk Island starts observing Australian-style DST.</changelog>
  <changelog author="mcalabkova@suse.com" date="1587729600">- timezone update 2020a (bsc#1169582)
  * Morocco springs forward on 2020-05-31, not 2020-05-24.
  * Canada's Yukon advanced to -07 year-round on 2020-03-08.
  * America/Nuuk renamed from America/Godthab.
  * zic now supports expiration dates for leap second lists.</changelog>
  <changelog author="mcalabkova@suse.com" date="1590408000">- zdump --version reported "unknown" (boo#1172055)</changelog>
  <changelog author="mcalabkova@suse.com" date="1602158400">- timezone update 2020b (bsc#1177460)
  * Revised predictions for Morocco's changes starting in 2023.
  * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
  * Macquarie Island has stayed in sync with Tasmania since 2011.
  * Casey, Antarctica is at +08 in winter and +11 in summer.
  * zic no longer supports -y, nor the TYPE field of Rules.
- Rebased timezone-2018f-bsc1112310.patch</changelog>
  <changelog author="mcalabkova@suse.com" date="1603108800">- timezone update 2020c (bsc#1177460)
  * Fiji starts DST later than usual, on 2020-12-20.</changelog>
  <changelog author="mcalabkova@suse.com" date="1603368000">- timezone update 2020d (bsc#1177460)
  * Palestine ends DST earlier than predicted, on 2020-10-24.</changelog>
  <changelog author="mcalabkova@suse.com" date="1604318400">- Add fat.patch to generate "fat" timezone files (was default before 2020b)
  bsc#1178346</changelog>
  <changelog author="mmachova@suse.com" date="1608724800">- timezone update 2020e (bsc#1177460)
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.</changelog>
  <changelog author="mmachova@suse.com" date="1609243200">- timezone update 2020f (bsc#1177460)
  * 'make rearguard_tarballs' no longer generates a bad rearguard.zi,
    fixing a 2020e bug.</changelog>
  <changelog author="mmachova@suse.com" date="1611576000">- timezone update 2021a (bsc#1177460)
  * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.</changelog>
  <changelog author="mmachova@suse.com" date="1625745600">- Install tzdata.zi (bsc#1188127)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637150400">- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "-00"
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647518400">- timezone update 2022a (bsc#1177460):
  * Palestine will spring forward on 2022-03-27, not -03-26*
  * zdump -v now outputs better failure indications
  * Bug fixes for code that reads corrupted TZif data</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661515200">- Update to reflect new Chile DST change, bsc#1202310
  * bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665576000">- timezone update 2022e (bsc#1177460):
  * Jordan and Syria switch from +02/+03 with DST to year-round +03
- timezone update 2022d:
  * Palestine transitions are now Saturdays at 02:00
  * Simplify three Ukraine zones into one
- timezone update 2022c:
  * Work around awk bug
  * Improve tzselect on intercontinental Zones
- timezone update 2022b:
  * Chile's DST is delayed by a week in September 2022 boo#1202324
  * Iran no longer observes DST after 2022
  * Rename Europe/Kiev to Europe/Kyiv
  * New zic -R option
  * Vanguard form now uses %z
  * Finish moving duplicate-since-1970 zones to 'backzone'
- Refresh tzdata-china.diff
- Remove upstreamed bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- timezone update 2022f (bsc#1177460):
  * Mexico will no longer observe DST except near the US border
  * Chihuahua moves to year-round -06 on 2022-10-30
  * Fiji no longer observes DST
  * Move links to 'backward'
  * In vanguard form, GMT is now a Zone and Etc/GMT a link
  * zic now supports links to links, and vanguard form uses this
  * Simplify four Ontario zones
  * Fix a Y2438 bug when reading TZif data
  * Enable 64-bit time_t on 32-bit glibc platforms
  * Omit large-file support when no longer needed
  * In C code, use some C23 features if available
  * Remove no-longer-needed workaround for Qt bug 53071
- Refreshed patches:
  * fat.patch
  * tzdata-china.diff</changelog>
  <changelog author="danilo.spinella@suse.com" date="1670241600">- timezone update 2022g (bsc#1177460):
  * In the Mexican state of Chihuahua, the border strip near the US
    will change to agree with nearby US locations on 2022-11-30.
    The strip's western part, represented by Ciudad Juárez, switches
    from -06 all year to -07/-06 with US DST rules, like El Paso, TX.
    The eastern part, represented by Ojinaga, will observe US DST next
    year, like Presidio, TX.
    A new Zone America/Ciudad_Juarez splits from America/Ojinaga.
  * Much of Greenland, represented by America/Nuuk, stops observing
    winter time after March 2023, so its daylight saving time becomes
    standard time.
  * Changes for pre-1996 northern Canada
  * Update to past DST transition in Colombia (1993), Singapore
    (1981)
  * timegm is now supported by default</changelog>
</package>
<package pkgid="cf20e436bd1b5987b0e8717a5167e8ba69d6d274365bb7a4a34c08319d870f5c" name="timezone" arch="x86_64">
  <version epoch="0" ver="2022g" rel="150000.75.18.1"/>
  <changelog author="mcalabkova@suse.com" date="1546603200">- timezone update 2018i (bsc#1120402)
  * São Tomé and Príncipe switches from +01 to +00 on 2019-01-01.
- timezone update 2018h
  * Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21
  * New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move
  * Metlakatla, Alaska observes PST this winter only
  * Guess Morocco will continue to adjust clocks around Ramadan
  * Add predictions for Iran from 2038 through 2090</changelog>
  <changelog author="mcalabkova@suse.com" date="1553601600">- timezone update 2019a:
  * Palestine "springs forward" on 2019-03-30 instead of 2019-03-23
  * Metlakatla "fell back" to rejoin Alaska Time on 2019-01-20 at
    02:00
  * Israel observed DST in 1980 (08-02/09-13) and 1984 (05-05/08-25)
  * zic now has an -r option to limit the time range of output data</changelog>
  <changelog author="mcalabkova@suse.com" date="1562068800">- timezone update 2019b (bsc#1140016):
  * Brazil no longer observes DST.
  * 'zic -b slim' outputs smaller TZif files.
  * Palestine's 2019 spring-forward transition was on 03-29,
    not 03-30.
  * Add info about the Crimea situation.</changelog>
  <changelog author="mcalabkova@suse.com" date="1568289600">- timezone update 2019c (bsc#1150451)
  * Fiji observes DST from 2019-11-10 to 2020-01-12.
  * Norfolk Island starts observing Australian-style DST.</changelog>
  <changelog author="mcalabkova@suse.com" date="1587729600">- timezone update 2020a (bsc#1169582)
  * Morocco springs forward on 2020-05-31, not 2020-05-24.
  * Canada's Yukon advanced to -07 year-round on 2020-03-08.
  * America/Nuuk renamed from America/Godthab.
  * zic now supports expiration dates for leap second lists.</changelog>
  <changelog author="mcalabkova@suse.com" date="1590408000">- zdump --version reported "unknown" (boo#1172055)</changelog>
  <changelog author="mcalabkova@suse.com" date="1602158400">- timezone update 2020b (bsc#1177460)
  * Revised predictions for Morocco's changes starting in 2023.
  * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
  * Macquarie Island has stayed in sync with Tasmania since 2011.
  * Casey, Antarctica is at +08 in winter and +11 in summer.
  * zic no longer supports -y, nor the TYPE field of Rules.
- Rebased timezone-2018f-bsc1112310.patch</changelog>
  <changelog author="mcalabkova@suse.com" date="1603108800">- timezone update 2020c (bsc#1177460)
  * Fiji starts DST later than usual, on 2020-12-20.</changelog>
  <changelog author="mcalabkova@suse.com" date="1603368000">- timezone update 2020d (bsc#1177460)
  * Palestine ends DST earlier than predicted, on 2020-10-24.</changelog>
  <changelog author="mcalabkova@suse.com" date="1604318400">- Add fat.patch to generate "fat" timezone files (was default before 2020b)
  bsc#1178346</changelog>
  <changelog author="mmachova@suse.com" date="1608724800">- timezone update 2020e (bsc#1177460)
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.</changelog>
  <changelog author="mmachova@suse.com" date="1609243200">- timezone update 2020f (bsc#1177460)
  * 'make rearguard_tarballs' no longer generates a bad rearguard.zi,
    fixing a 2020e bug.</changelog>
  <changelog author="mmachova@suse.com" date="1611576000">- timezone update 2021a (bsc#1177460)
  * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.</changelog>
  <changelog author="mmachova@suse.com" date="1625745600">- Install tzdata.zi (bsc#1188127)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637150400">- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "-00"
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647518400">- timezone update 2022a (bsc#1177460):
  * Palestine will spring forward on 2022-03-27, not -03-26*
  * zdump -v now outputs better failure indications
  * Bug fixes for code that reads corrupted TZif data</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661515200">- Update to reflect new Chile DST change, bsc#1202310
  * bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665576000">- timezone update 2022e (bsc#1177460):
  * Jordan and Syria switch from +02/+03 with DST to year-round +03
- timezone update 2022d:
  * Palestine transitions are now Saturdays at 02:00
  * Simplify three Ukraine zones into one
- timezone update 2022c:
  * Work around awk bug
  * Improve tzselect on intercontinental Zones
- timezone update 2022b:
  * Chile's DST is delayed by a week in September 2022 boo#1202324
  * Iran no longer observes DST after 2022
  * Rename Europe/Kiev to Europe/Kyiv
  * New zic -R option
  * Vanguard form now uses %z
  * Finish moving duplicate-since-1970 zones to 'backzone'
- Refresh tzdata-china.diff
- Remove upstreamed bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- timezone update 2022f (bsc#1177460):
  * Mexico will no longer observe DST except near the US border
  * Chihuahua moves to year-round -06 on 2022-10-30
  * Fiji no longer observes DST
  * Move links to 'backward'
  * In vanguard form, GMT is now a Zone and Etc/GMT a link
  * zic now supports links to links, and vanguard form uses this
  * Simplify four Ontario zones
  * Fix a Y2438 bug when reading TZif data
  * Enable 64-bit time_t on 32-bit glibc platforms
  * Omit large-file support when no longer needed
  * In C code, use some C23 features if available
  * Remove no-longer-needed workaround for Qt bug 53071
- Refreshed patches:
  * fat.patch
  * tzdata-china.diff</changelog>
  <changelog author="danilo.spinella@suse.com" date="1670241600">- timezone update 2022g (bsc#1177460):
  * In the Mexican state of Chihuahua, the border strip near the US
    will change to agree with nearby US locations on 2022-11-30.
    The strip's western part, represented by Ciudad Juárez, switches
    from -06 all year to -07/-06 with US DST rules, like El Paso, TX.
    The eastern part, represented by Ojinaga, will observe US DST next
    year, like Presidio, TX.
    A new Zone America/Ciudad_Juarez splits from America/Ojinaga.
  * Much of Greenland, represented by America/Nuuk, stops observing
    winter time after March 2023, so its daylight saving time becomes
    standard time.
  * Changes for pre-1996 northern Canada
  * Update to past DST transition in Colombia (1993), Singapore
    (1981)
  * timegm is now supported by default</changelog>
</package>
<package pkgid="66c31c786a53f39273f268d3890690ef64ad49c7f15b19d57a528f038cc4dd81" name="tpm2-0-tss" arch="aarch64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="7517387a0b4689e09259483ff8a54e07ea8c05571e8c155ba83c9b4fd0887b90" name="tpm2-0-tss" arch="src">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="c4480f6c70d91906466e5cc0bbb62c31305a1323ad0a0d4fbc3bcf939131538f" name="tpm2-0-tss" arch="x86_64">
  <version epoch="0" ver="3.1.0" rel="150400.3.3.1"/>
  <changelog author="matthias.gerstner@suse.com" date="1530619200">- Explicitly require udev to fix missing ownership for /usr/lib/udev.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0
  and sys0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537272000">- also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't
  properly updated (at least on SLES-12-SP4)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1537963200">- update to upstream version 2.0.1 (FATE#324477):
  - Fixed problems with doxygan failing make distcheck
  - Fixed conversion of gcrypt mpi numbers to binary data
  - Fixed an error in parsing socket address in MSSIM TCTI
  - Fixed compilation error with --disable-tcti-mssim
  - Added initialization function for gcrypt to suppress warning
  - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters
  - Fixed invalid RSA encryption with exponent equal to 0
  - Fixed checking of return codes in ESAPI commands
  - Added checks for programs required by the test harness @ configure time
  - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup
  - Checked for 1.2 TPM type response
  - Changed constants values in esys header file to unsigned</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1551873600">- update to upstream version 2.2.1:
  - changes from version 2.2.0:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - Added support for QNX build
  - Added support for partial reads in device TCTI
  - changes from version 2.1.1:
  - Fixed leak of hkey on success in iesys_cryptossl_hmac_start
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
  - changes from version 2.1.0:
  - Fixed handling of the default TCTI
  - Changed logging to be ISO-C99 compatible
  - Fixed leak of dlopen handle
  - Fixed logging of a response header tag in Tss2_Sys_Execute
  - Fixed marshaling of TPM2B parameters in SAPI commands
  - Fixed unnecessary warning in Esys_Startup
  - Fixed warnings in doxygen documentation
  - Added Esys_Free wrapper function for systems using different C runtime libraries
  - Added Windows TBS TCTI
  - Added non-blocking mode of operation in tcti-device
  - Added tests for Esys_HMAC and Esys_Hash
  - Enabled integration tests on physical TPM device
  - Added openssl libcrypto backend
  - Added Doxygen documentation to integration tests
  - Refactored SetDecryptParam
  - Enabled OpenSSL crypto backend by default
  - changes from 2.0.2:
  - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth
  - Fixed NULL ptr issue in sequenceHandleNode
  - Fixed NULL ptr auth handling in Esys_TR_SetAuth
  - Fixed NULL auth handling in iesys_compute_session_value
  - Fixed marshaling of TPM2Bs with sub types.
  - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes
  - Fixed the way size of the hmac value of a session without authorization
  - Added missing MU functions for TPM2_NT type
  - Added missing MU functions for TPMA_ID_OBJECT type
  - Added missing type TPM2_NT into tss2_tpm2_types.h
  - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h
  - Fixed build breakage when --with-maxloglevel is not 'trace'
  - Fixed build breakage in generated configure script when CFLAGS is set
  - Fixed configure scritp ERROR_IF_NO_PROG macro
  - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest
  - Fixed unmarshaling of the TPM2B type with invalid size
  - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM
- introduce _service file for syncing with upstream tags</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566561600">- update to upstream version 2.2.3:
  - changes in version 2.2.3:
  * Fix computation of session name
  * Fixed PolicyPassword handling of session Attributes
  * Fixed windows build from dist ball
  * Fixed default tcti configure option
  * Fixed nonce size calculation in ESYS sessions
  - changes in version 2.2.2:
  * Fixed wrong encryption flag in EncryptDecrypt
  * Fixing openssl engine invocation</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to upstream version 2.3.0:
  - changes in version 2.3.0:
  - tss2-tctildr: A new library that helps with tcti initialization
    Recommend to use this in place of custom tcti loading code now !
  - tss2-rc: A new library that provides textual representations for return
    codes
  - Option to disable NIST-deprecated crypto (--disable-weak-crypto)
  - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext)
  - map-files with correct symbol lists for tss2-sys and tss2-esys
    This may lead to unresolved symbols in linked applications
  - Support to call Tss2_Sys_Execute repeatedly on certain errors
  - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change
  - Automated session attribution clearing for esys (decrypt and encrypt)
    per cmd
  - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
    Needs to be added explicitely now
  - All fixes from 2.2.1, 2.2.2 and 2.2.3
  - Fixed SPDX License Identifiers
  - Fixed Null-pointer problems in tcti-tbs
  - Fixed Default locality for tcti-mssim set to LOC_0
  - Fixed coverity and valgrind leaks detected in test programs (not library
    code)</changelog>
  <changelog author="mardnh@gmx.de" date="1577620800">- update to upstream version 2.3.2:
  - changes since version 2.3.0:
  - Fix unit tests on S390 architectures
  - Fixed HMAC generation for policy sessions</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="msuchanek@suse.com" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="mardnh@gmx.de" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="meissner@suse.com" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="aplanas@suse.com" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.</changelog>
</package>
<package pkgid="3d6e670e6a35240a842c2be0434fdeefe12945524a65da16081c20389b07f599" name="typelib-1_0-AppIndicator3-0_1" arch="aarch64">
  <version epoch="0" ver="12.10.1+bzr20170215" rel="150200.3.3.1"/>
  <changelog author="schwab@suse.de" date="1425556800">- Allow building without mono support</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1430827200">- Update to 12.10.1+bzr20141110:
  * scroll-event: change parameter to the right type.
- Rebase 0001_Fix_mono_dir.patch.
- Remove no-deprecated.patch: merged upstream.
- Remove dont-build-examples.patch: fixed upstream.
- Minor spec cleanup.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1465819200">- Little spec cleanup.</changelog>
  <changelog author="t.gruner@katodev.de" date="1467892800">- Allow building with mono support in case without mono is set</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1492603200">- Update to version 12.10.1+bzr20170215 (changes since
  12.10.1+bzr20141110):
  * Handle watcher service appearing and disappearing.
  * Make test-simple-app really working.
  * Fix icon and theme paths when running in $SNAP environment
    (lp#1600136).
  * Do not emit label changes when guide is still empty.
  * Do not append the snap prefix if the icon is saved in a well
    known readable path.
- Add libappindicator-activate-support.patch: Open menu on the
  left-click action (lp#1403449).
- Rename python-appindicator to python2-appindicator.</changelog>
  <changelog author="jengelh@inai.de" date="1493380800">- Rename %soname to %sover to better reflect its purpose.
- Update summaries.
- Remove redundant pkgconfig() reqiures; these are already
  autodiscovered.</changelog>
  <changelog author="dimstar@opensuse.org" date="1504526400">- Disable building of -doc subpackage (source not compatible with
  gtk-doc 1.26 - and the doc is available online anyway):
  + Remove gtk-doc BuildRequires.
  + Replace --enable-gtk-doc configure parameter with
  - -disable-gtk-doc,
  + Drop the -doc subpackage.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520683200">- Add libappindicator-no-Werror.patch: the libappindicator code is
  aging and is not keeping up well with the moving world around it.</changelog>
  <changelog author="ximi.obs@gmail.com" date="1547294400">- Changed the activate-support patch to signal an "activate-event"
  so users can create callbacks themselves.
  Original patch from Yichao Yu &lt;yyc1992@gmail.com&gt;.</changelog>
  <changelog author="maurizio.galli@gmail.com" date="1557921600">- Drop libappindicator-activate-support.patch as it's no longer needed and
  breaks context menu / actions in fall-back mode (boo#1132659)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1568808000">- Split gtk2 and gtk3 builds using _multibuild. Python2 and Mono
  bindings are only available for GTK2, so the GTK3 version has
  significantly less build dependencies,
  add only_require_python_for_gtk2.patch
- Drop dependency on deprecated gnome-common, see
  https://wiki.gnome.org/Projects/GnomeCommon/Migration
- Allow configure run to succeed even when gtk-doc is not installed,
  add make_gtk_doc_optional.patch</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1569931200">- Make sure the OBS spec file parser does not apply the gtk3 psuffix
  for the default ("") multibuild flavor.</changelog>
  <changelog author="mailaender@opensuse.org" date="1580644800">- Use the vanilla nunit for compatibility with newer Mono</changelog>
  <changelog author="maurizio.galli@gmail.com" date="1581508800">- Added xappstatusicon.patch. It adds support for XAppStatus Icon by
  Linux Mint.</changelog>
  <changelog author="tchvatal@suse.com" date="1584964800">- Fix build on py2 less system</changelog>
  <changelog author="dleuenberger@suse.com" date="1586433600">- Do not apply xappstatusicon.patch: pulls half of Mate into Ring1.</changelog>
  <changelog author="mliska@suse.cz" date="1586865600">- Add -fcommon in order to fix boo#1164492.</changelog>
  <changelog author="yfjiang@suse.com" date="1673611200">- Provide RH/Fedora used libappindicator-gtk3 symbol required by
  Slack (bsc#1207112).</changelog>
</package>
<package pkgid="41d258e9f298d179b035e8adc4a32dd4eaed647d52fb9c1c869ec17f82f1fe3a" name="typelib-1_0-AppIndicator3-0_1" arch="x86_64">
  <version epoch="0" ver="12.10.1+bzr20170215" rel="150200.3.3.1"/>
  <changelog author="schwab@suse.de" date="1425556800">- Allow building without mono support</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1430827200">- Update to 12.10.1+bzr20141110:
  * scroll-event: change parameter to the right type.
- Rebase 0001_Fix_mono_dir.patch.
- Remove no-deprecated.patch: merged upstream.
- Remove dont-build-examples.patch: fixed upstream.
- Minor spec cleanup.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1465819200">- Little spec cleanup.</changelog>
  <changelog author="t.gruner@katodev.de" date="1467892800">- Allow building with mono support in case without mono is set</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1492603200">- Update to version 12.10.1+bzr20170215 (changes since
  12.10.1+bzr20141110):
  * Handle watcher service appearing and disappearing.
  * Make test-simple-app really working.
  * Fix icon and theme paths when running in $SNAP environment
    (lp#1600136).
  * Do not emit label changes when guide is still empty.
  * Do not append the snap prefix if the icon is saved in a well
    known readable path.
- Add libappindicator-activate-support.patch: Open menu on the
  left-click action (lp#1403449).
- Rename python-appindicator to python2-appindicator.</changelog>
  <changelog author="jengelh@inai.de" date="1493380800">- Rename %soname to %sover to better reflect its purpose.
- Update summaries.
- Remove redundant pkgconfig() reqiures; these are already
  autodiscovered.</changelog>
  <changelog author="dimstar@opensuse.org" date="1504526400">- Disable building of -doc subpackage (source not compatible with
  gtk-doc 1.26 - and the doc is available online anyway):
  + Remove gtk-doc BuildRequires.
  + Replace --enable-gtk-doc configure parameter with
  - -disable-gtk-doc,
  + Drop the -doc subpackage.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520683200">- Add libappindicator-no-Werror.patch: the libappindicator code is
  aging and is not keeping up well with the moving world around it.</changelog>
  <changelog author="ximi.obs@gmail.com" date="1547294400">- Changed the activate-support patch to signal an "activate-event"
  so users can create callbacks themselves.
  Original patch from Yichao Yu &lt;yyc1992@gmail.com&gt;.</changelog>
  <changelog author="maurizio.galli@gmail.com" date="1557921600">- Drop libappindicator-activate-support.patch as it's no longer needed and
  breaks context menu / actions in fall-back mode (boo#1132659)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1568808000">- Split gtk2 and gtk3 builds using _multibuild. Python2 and Mono
  bindings are only available for GTK2, so the GTK3 version has
  significantly less build dependencies,
  add only_require_python_for_gtk2.patch
- Drop dependency on deprecated gnome-common, see
  https://wiki.gnome.org/Projects/GnomeCommon/Migration
- Allow configure run to succeed even when gtk-doc is not installed,
  add make_gtk_doc_optional.patch</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1569931200">- Make sure the OBS spec file parser does not apply the gtk3 psuffix
  for the default ("") multibuild flavor.</changelog>
  <changelog author="mailaender@opensuse.org" date="1580644800">- Use the vanilla nunit for compatibility with newer Mono</changelog>
  <changelog author="maurizio.galli@gmail.com" date="1581508800">- Added xappstatusicon.patch. It adds support for XAppStatus Icon by
  Linux Mint.</changelog>
  <changelog author="tchvatal@suse.com" date="1584964800">- Fix build on py2 less system</changelog>
  <changelog author="dleuenberger@suse.com" date="1586433600">- Do not apply xappstatusicon.patch: pulls half of Mate into Ring1.</changelog>
  <changelog author="mliska@suse.cz" date="1586865600">- Add -fcommon in order to fix boo#1164492.</changelog>
  <changelog author="yfjiang@suse.com" date="1673611200">- Provide RH/Fedora used libappindicator-gtk3 symbol required by
  Slack (bsc#1207112).</changelog>
</package>
<package pkgid="be0e8a96f2e0613857aecafd79e5c68a572761dd311fcb876ca79d2a899aaa94" name="ucode-intel" arch="src">
  <version epoch="0" ver="20230214" rel="150200.21.1"/>
  <changelog author="meissner@suse.com" date="1568894400">- Updated to 20190918 bugfix release (bsc#1151232 bsc#1138185)
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- updated platforms ------------------------------------
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002d-&gt;0000002e Core Gen5
  HSX-EX       E0       6-3f-4/80 00000014-&gt;00000016 Xeon E7 v3
  BDW-H/E3     E0/G0    6-47-1/22 00000020-&gt;00000021 Core Gen5
  BDX-ML       B0/M0/R0 6-4f-1/ef 0b000036-&gt;0b000038 Xeon E5/E7 v4; Core i7-69xx/68xx
  BDX-DE       V1       6-56-2/10 0000001a-&gt;0000001c Xeon D-1520/40
  BDX-DE       V2/3     6-56-3/10 07000017-&gt;07000019 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  BDX-DE       Y0       6-56-4/10 0f000015-&gt;0f000017 Xeon D-1557/59/67/71/77/81/87
  BDX-NS       A0       6-56-5/10 0e00000d-&gt;0e00000f Xeon D-1513N/23/33/43/53
  SKX-SP       H0/M0/U0 6-55-4/b7 0200005e-&gt;00000064 Xeon Scalable
  SKX-D        M1       6-55-4/b7 0200005e-&gt;00000064 Xeon D-21xx
  CLX-SP       B1       6-55-7/bf 05000021-&gt;0500002b Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1573041600">- Updated to 20191112 security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000150 Xeon Scalable
  - ICL U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKL H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1573646400">- Updated to 20191112 official security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - AVN          B0/C0    6-4d-8/01           0000012d Atom C2xxx
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000151 Xeon Scalable
  - CLX-SP       B0       6-55-6/bf           0400002c Xeon Scalable Gen2
  - GLK-R        R0       6-7a-8/01           00000016 Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  - ICL-U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable
  - SKX-D        M1       6-55-4/b7 02000064-&gt;02000065 Xeon D-21xx
  - CLX-SP       B1       6-55-7/bf 0500002b-&gt;0500002c Xeon Scalable Gen2
  - SKL-H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - GLK          B0       6-7a-1/01 0000002e-&gt;00000032 Pentium J5005/N5000, Celeron J4005/J4105/N4000/N4100
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
  - ---- removed platforms ------------------------------------
  - CFL-H/S      P0       6-9e-c/22 000000a2           Core Gen9
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1574164800">- Updated to 20191115 release (bsc#1157004)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-U23e     K1       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-H/S/E3   N0/R0/S0 6-5e-3/36 000000d4-&gt;000000d6 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - KBL-U23e     J1       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-R U      Y0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000c6-&gt;000000ca Core Gen8 Mobile
  - AML-Y42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen8 Mobile
  - CML-U42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - KBL-G/H/S/X/E3 B0     6-9e-9/2a 000000c6-&gt;000000ca Core Gen7 Desktop, Mobile, Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000c6-&gt;000000ca Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000c6-&gt;000000ca Core Gen8
  - CFL-S        P0       6-9e-c/22 000000c6-&gt;000000ca Core Gen9 Desktop
  - CFL-H/S/E3   R0       6-9e-d/22 000000c6-&gt;000000ca Core Gen9 Desktop, Mobile, Xeon E
  - CML-U62      A0       6-a6-0/80 000000c6-&gt;000000ca Core Gen10 Mobile
- Updated to 20191113 release
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - CFL-S        P0       6-9e-c/22 000000a2-&gt;000000c6 Core Gen9 Desktop</changelog>
  <changelog author="meissner@suse.com" date="1579089600">- reverted the entry below to 02000064 due to occasional faults (bsc#1160478)
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable</changelog>
  <changelog author="meissner@suse.com" date="1587470400">- updated skylake microcode to the current version. (bsc#1169570)
  - 02000064-&gt;02006901</changelog>
  <changelog author="meissner@suse.com" date="1591185600">- Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466)
  Fixes for:
  - CVE-2020-0543: Fixed a side channel attack against special registers
    which could have resulted in leaking of read values to cores other
    than the one which called it.  This attack is known as Special Register
    Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824).
  - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to
    mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack"
    attacks. (bsc#1156353)
  == 20200602_DEMO Release ==
  - - Updates upon 20200520 release --
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  HSW          C0       6-3c-3/32 00000027-&gt;00000028 Core Gen4
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002e-&gt;0000002f Core Gen5
  HSW-U        C0/D0    6-45-1/72 00000025-&gt;00000026 Core Gen4
  HSW-H        C0       6-46-1/32 0000001b-&gt;0000001c Core Gen4
  BDW-H/E3     E0/G0    6-47-1/22 00000021-&gt;00000022 Core Gen5
  SKL-U/Y      D0       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKL-U23e     K1       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKX-SP       B1       6-55-3/97 01000151-&gt;01000157 Xeon Scalable
  SKX-SP       H0/M0/U0 6-55-4/b7 02000065-&gt;02006906 Xeon Scalable
  SKX-D        M1       6-55-4/b7 02000065-&gt;02006906 Xeon D-21xx
  CLX-SP       B0       6-55-6/bf 0400002c-&gt;04002f01 Xeon Scalable Gen2
  CLX-SP       B1       6-55-7/bf 0500002c-&gt;04002f01 Xeon Scalable Gen2
  SKL-H/S      R0/N0    6-5e-3/36 000000d6-&gt;000000dc Core Gen6; Xeon E3 v5
  AML-Y22      H0       6-8e-9/10 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-U/Y      H0       6-8e-9/c0 000000ca-&gt;000000d6 Core Gen7 Mobile
  CFL-U43e     D0       6-8e-a/c0 000000ca-&gt;000000d6 Core Gen8 Mobile
  WHL-U        W0       6-8e-b/d0 000000ca-&gt;000000d6 Core Gen8 Mobile
  AML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  CML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  WHL-U        V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-G/H/S/E3 B0       6-9e-9/2a 000000ca-&gt;000000d6 Core Gen7; Xeon E3 v6
  CFL-H/S/E3   U0       6-9e-a/22 000000ca-&gt;000000d6 Core Gen8 Desktop, Mobile, Xeon E
  CFL-S        B0       6-9e-b/02 000000ca-&gt;000000d6 Core Gen8
  CFL-H/S      P0       6-9e-c/22 000000ca-&gt;000000d6 Core Gen9
  CFL-H        R0       6-9e-d/22 000000ca-&gt;000000d6 Core Gen9 Mobile
- Updated Intel CPU Microcode to 20200520
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  SNB-E/EN/EP  C1/M0    6-2d-6/6d 0000061f-&gt;00000621 Xeon E3/E5, Core X
  SNB-E/EN/EP  C2/M1    6-2d-7/6d 00000718-&gt;0000071a Xeon E3/E5, Core X</changelog>
  <changelog author="meissner@suse.com" date="1592222400">- Updated Intel CPU Microcode to 20200609 official release (bsc#1172466)
  - no changes to 20200602 prerelease</changelog>
  <changelog author="meissner@suse.com" date="1592395200">- Updated Intel CPU Microcode to 20200616 official release (bsc#1172856)
  - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release
  - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release,
    as both cause stability issues.  (bsc#1172856)</changelog>
  <changelog author="meissner@suse.com" date="1604491200">- Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446)
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX)
  [#] New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#] Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605096000">- Updated Intel CPU Microcode to 20201110 official release.
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446)
  - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594)
  - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592)
- Releasenotes:
  - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html).
  - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html).
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core? Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
  - Update for functional issues. Refer to [8th and 9th Gen Intel Core? Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
  - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
  - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
  [#]## New Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | LKF            | B2/B3    | 06-8a-01/10 |          | 00000028 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#]## Updated Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605787200">- Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971)
  - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms.</changelog>
  <changelog author="meissner@suse.com" date="1607342400">- Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224)
  - SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable
  - SKX-D          | M1       | 06-55-04/b7 | 02006906 | Xeon D-21xx
  - CLX-SP         | B0       | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2
  - CLX-SP         | B1       | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1613563200">- Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224)
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1623153600">- Updated to Intel CPU Microcode 20210525 release.
  - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833)
    See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html
  - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html
- Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details.
- Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
- Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
- Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
- Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
- Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
- Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
- Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
- Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
- New platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CLX-SP         | A0       | 06-55-05/b7 |          | 03000010 | Xeon Scalable Gen2
  | ICX-SP         | C0       | 06-6a-05/87 |          | 0c0002f0 | Xeon Scalable Gen3
  | ICX-SP         | D0       | 06-6a-06/87 |          | 0d0002a0 | Xeon Scalable Gen3
  | SNR            | B0       | 06-86-04/01 |          | 0b00000f | Atom P59xxB
  | SNR            | B1       | 06-86-05/01 |          | 0b00000f | Atom P59xxB
  | TGL            | B1       | 06-8c-01/80 |          | 00000088 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 |          | 00000016 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 |          | 0000002c | Core Gen11 Mobile
  | EHL            | B1       | 06-96-01/01 |          | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 |          | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | RKL-S          | B0       | 06-a7-01/02 |          | 00000040 | Core Gen11
- Updated platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3
  | HSX-EX         | E0       | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | BDX-ML         | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx
  | SKX-SP         | B1       | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3
  | BDX-DE         | V2/V3    | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  | BDX-DE         | Y0       | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87
  | BDX-NS         | A0       | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53
  | APL            | D0       | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series
  | GLK            | B0       | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology
  | AML-Y22        | H0       | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10
  | CML-U62        | A0       | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile
  | CML-U62 V2     | K0       | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1644494400">- Updated to Intel CPU Microcode 20220207 release.
  - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615)
  - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779)
  - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780)
  - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781)
  - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html)
  - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html)
  - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details.
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details.
  - Update for functional issues. Refer to [10th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details.
  - Update for functional issues. Refer to [8th Generation Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details.
  - Update for functional issues. Refer to [8th Gen Intel Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [7th and 8th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details.
  - Update for functional issues. Refer to [6th Generation Intel Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Pentium Silver and Intel Celeron Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details.</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- Updated to Intel CPU Microcode 20220419 release. (bsc#1198717)
  - Update for functional issues. Refer to errata
    APLI-11 in [Intel Atom Processor E3900
    Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details.
  - Changed Microcodes:
  - | APL            | E0       | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx</changelog>
  <changelog author="meissner@suse.com" date="1652270400">- Updated to Intel CPU Microcode 20220510 release. (bsc#1199423)
  - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html)
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details.
  - New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | ADL            | C0       | 06-97-02/03 |          | 0000001f | Core Gen12
  | ADL            | C0       | 06-97-05/03 |          | 0000001f | Core Gen12
  | ADL            | L0       | 06-9a-03/80 |          | 0000041c | Core Gen12
  | ADL            | L0       | 06-9a-04/80 |          | 0000041c | Core Gen12
  | ADL            | C0       | 06-bf-02/03 |          | 0000001f | Core Gen12
  | ADL            | C0       | 06-bf-02/03 |          | 0000001f | Core Gen12
  - Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | VLV            | D0       | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3
  | APL            | D0       | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile
  | EHL            | B1       | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10
  | CML-U62 V1     | A0       | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile
  | CML-U62 V2     | K1       | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile
  | RKL-S          | B0       | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11</changelog>
  <changelog author="meissner@suse.com" date="1660132800">- Updated to Intel CPU Microcode 20220809 release. (bsc#1201727)
  - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html).
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification
  +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.  - Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | B1       | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GLK-R          | R0       | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile
  | RKL-S          | B0       | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11
  | ADL            | C0       | 06-97-02/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | C0       | 06-97-05/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | L0       | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12
  | ADL            | L0       | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12
  | ADL            | C0       | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | C0       | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12</changelog>
  <changelog author="meissner@suse.com" date="1676462400">- Updated to Intel CPU Microcode 20230214 release.
  Security issues fixed:
  - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275)
  - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276)
  - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277)
  New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SPR-SP         | E2       | 06-8f-05/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-SP         | E3       | 06-8f-06/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-SP         | E4       | 06-8f-07/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-SP         | E5       | 06-8f-08/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-HBM        | B3       | 06-8f-08/10 |          | 2c000170 | Xeon Max
  | RPL-P 6+8      | J0       | 06-ba-02/07 |          | 0000410e | Core Gen13
  | RPL-H 6+8      | J0       | 06-ba-02/07 |          | 0000410e | Core Gen13
  | RPL-U 2+8      | Q0       | 06-ba-02/07 |          | 0000410e | Core Gen13
  Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | ADL            | C0       | 06-97-02/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | C0       | 06-97-05/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | C0       | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | C0       | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | L0       | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12
  | ADL            | L0       | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12
  | CLX-SP         | B0       | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GLK-R          | R0       | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-D          | B0       | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3
  | JSL            | A0/A1    | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | LKF            | B2/B3    | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology
  | RKL-S          | B0       | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11
  | RPL-S          | S0       | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13
  | SKX-SP         | B1       | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable</changelog>
</package>
<package pkgid="93eaa957349ad9eec5946e89da0429be829165add2d3cdfbd0f8de42d989f067" name="ucode-intel" arch="x86_64">
  <version epoch="0" ver="20230214" rel="150200.21.1"/>
  <changelog author="meissner@suse.com" date="1568894400">- Updated to 20190918 bugfix release (bsc#1151232 bsc#1138185)
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- updated platforms ------------------------------------
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002d-&gt;0000002e Core Gen5
  HSX-EX       E0       6-3f-4/80 00000014-&gt;00000016 Xeon E7 v3
  BDW-H/E3     E0/G0    6-47-1/22 00000020-&gt;00000021 Core Gen5
  BDX-ML       B0/M0/R0 6-4f-1/ef 0b000036-&gt;0b000038 Xeon E5/E7 v4; Core i7-69xx/68xx
  BDX-DE       V1       6-56-2/10 0000001a-&gt;0000001c Xeon D-1520/40
  BDX-DE       V2/3     6-56-3/10 07000017-&gt;07000019 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  BDX-DE       Y0       6-56-4/10 0f000015-&gt;0f000017 Xeon D-1557/59/67/71/77/81/87
  BDX-NS       A0       6-56-5/10 0e00000d-&gt;0e00000f Xeon D-1513N/23/33/43/53
  SKX-SP       H0/M0/U0 6-55-4/b7 0200005e-&gt;00000064 Xeon Scalable
  SKX-D        M1       6-55-4/b7 0200005e-&gt;00000064 Xeon D-21xx
  CLX-SP       B1       6-55-7/bf 05000021-&gt;0500002b Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1573041600">- Updated to 20191112 security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000150 Xeon Scalable
  - ICL U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKL H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1573646400">- Updated to 20191112 official security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - AVN          B0/C0    6-4d-8/01           0000012d Atom C2xxx
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000151 Xeon Scalable
  - CLX-SP       B0       6-55-6/bf           0400002c Xeon Scalable Gen2
  - GLK-R        R0       6-7a-8/01           00000016 Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  - ICL-U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable
  - SKX-D        M1       6-55-4/b7 02000064-&gt;02000065 Xeon D-21xx
  - CLX-SP       B1       6-55-7/bf 0500002b-&gt;0500002c Xeon Scalable Gen2
  - SKL-H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - GLK          B0       6-7a-1/01 0000002e-&gt;00000032 Pentium J5005/N5000, Celeron J4005/J4105/N4000/N4100
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
  - ---- removed platforms ------------------------------------
  - CFL-H/S      P0       6-9e-c/22 000000a2           Core Gen9
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1574164800">- Updated to 20191115 release (bsc#1157004)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-U23e     K1       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-H/S/E3   N0/R0/S0 6-5e-3/36 000000d4-&gt;000000d6 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - KBL-U23e     J1       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-R U      Y0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000c6-&gt;000000ca Core Gen8 Mobile
  - AML-Y42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen8 Mobile
  - CML-U42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - KBL-G/H/S/X/E3 B0     6-9e-9/2a 000000c6-&gt;000000ca Core Gen7 Desktop, Mobile, Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000c6-&gt;000000ca Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000c6-&gt;000000ca Core Gen8
  - CFL-S        P0       6-9e-c/22 000000c6-&gt;000000ca Core Gen9 Desktop
  - CFL-H/S/E3   R0       6-9e-d/22 000000c6-&gt;000000ca Core Gen9 Desktop, Mobile, Xeon E
  - CML-U62      A0       6-a6-0/80 000000c6-&gt;000000ca Core Gen10 Mobile
- Updated to 20191113 release
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - CFL-S        P0       6-9e-c/22 000000a2-&gt;000000c6 Core Gen9 Desktop</changelog>
  <changelog author="meissner@suse.com" date="1579089600">- reverted the entry below to 02000064 due to occasional faults (bsc#1160478)
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable</changelog>
  <changelog author="meissner@suse.com" date="1587470400">- updated skylake microcode to the current version. (bsc#1169570)
  - 02000064-&gt;02006901</changelog>
  <changelog author="meissner@suse.com" date="1591185600">- Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466)
  Fixes for:
  - CVE-2020-0543: Fixed a side channel attack against special registers
    which could have resulted in leaking of read values to cores other
    than the one which called it.  This attack is known as Special Register
    Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824).
  - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to
    mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack"
    attacks. (bsc#1156353)
  == 20200602_DEMO Release ==
  - - Updates upon 20200520 release --
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  HSW          C0       6-3c-3/32 00000027-&gt;00000028 Core Gen4
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002e-&gt;0000002f Core Gen5
  HSW-U        C0/D0    6-45-1/72 00000025-&gt;00000026 Core Gen4
  HSW-H        C0       6-46-1/32 0000001b-&gt;0000001c Core Gen4
  BDW-H/E3     E0/G0    6-47-1/22 00000021-&gt;00000022 Core Gen5
  SKL-U/Y      D0       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKL-U23e     K1       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKX-SP       B1       6-55-3/97 01000151-&gt;01000157 Xeon Scalable
  SKX-SP       H0/M0/U0 6-55-4/b7 02000065-&gt;02006906 Xeon Scalable
  SKX-D        M1       6-55-4/b7 02000065-&gt;02006906 Xeon D-21xx
  CLX-SP       B0       6-55-6/bf 0400002c-&gt;04002f01 Xeon Scalable Gen2
  CLX-SP       B1       6-55-7/bf 0500002c-&gt;04002f01 Xeon Scalable Gen2
  SKL-H/S      R0/N0    6-5e-3/36 000000d6-&gt;000000dc Core Gen6; Xeon E3 v5
  AML-Y22      H0       6-8e-9/10 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-U/Y      H0       6-8e-9/c0 000000ca-&gt;000000d6 Core Gen7 Mobile
  CFL-U43e     D0       6-8e-a/c0 000000ca-&gt;000000d6 Core Gen8 Mobile
  WHL-U        W0       6-8e-b/d0 000000ca-&gt;000000d6 Core Gen8 Mobile
  AML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  CML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  WHL-U        V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-G/H/S/E3 B0       6-9e-9/2a 000000ca-&gt;000000d6 Core Gen7; Xeon E3 v6
  CFL-H/S/E3   U0       6-9e-a/22 000000ca-&gt;000000d6 Core Gen8 Desktop, Mobile, Xeon E
  CFL-S        B0       6-9e-b/02 000000ca-&gt;000000d6 Core Gen8
  CFL-H/S      P0       6-9e-c/22 000000ca-&gt;000000d6 Core Gen9
  CFL-H        R0       6-9e-d/22 000000ca-&gt;000000d6 Core Gen9 Mobile
- Updated Intel CPU Microcode to 20200520
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  SNB-E/EN/EP  C1/M0    6-2d-6/6d 0000061f-&gt;00000621 Xeon E3/E5, Core X
  SNB-E/EN/EP  C2/M1    6-2d-7/6d 00000718-&gt;0000071a Xeon E3/E5, Core X</changelog>
  <changelog author="meissner@suse.com" date="1592222400">- Updated Intel CPU Microcode to 20200609 official release (bsc#1172466)
  - no changes to 20200602 prerelease</changelog>
  <changelog author="meissner@suse.com" date="1592395200">- Updated Intel CPU Microcode to 20200616 official release (bsc#1172856)
  - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release
  - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release,
    as both cause stability issues.  (bsc#1172856)</changelog>
  <changelog author="meissner@suse.com" date="1604491200">- Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446)
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX)
  [#] New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#] Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605096000">- Updated Intel CPU Microcode to 20201110 official release.
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446)
  - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594)
  - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592)
- Releasenotes:
  - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html).
  - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html).
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core? Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
  - Update for functional issues. Refer to [8th and 9th Gen Intel Core? Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
  - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
  - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
  [#]## New Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | LKF            | B2/B3    | 06-8a-01/10 |          | 00000028 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#]## Updated Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605787200">- Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971)
  - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms.</changelog>
  <changelog author="meissner@suse.com" date="1607342400">- Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224)
  - SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable
  - SKX-D          | M1       | 06-55-04/b7 | 02006906 | Xeon D-21xx
  - CLX-SP         | B0       | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2
  - CLX-SP         | B1       | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1613563200">- Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224)
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1623153600">- Updated to Intel CPU Microcode 20210525 release.
  - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833)
    See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html
  - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html
- Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details.
- Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
- Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
- Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
- Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
- Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
- Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
- Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
- Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
- New platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CLX-SP         | A0       | 06-55-05/b7 |          | 03000010 | Xeon Scalable Gen2
  | ICX-SP         | C0       | 06-6a-05/87 |          | 0c0002f0 | Xeon Scalable Gen3
  | ICX-SP         | D0       | 06-6a-06/87 |          | 0d0002a0 | Xeon Scalable Gen3
  | SNR            | B0       | 06-86-04/01 |          | 0b00000f | Atom P59xxB
  | SNR            | B1       | 06-86-05/01 |          | 0b00000f | Atom P59xxB
  | TGL            | B1       | 06-8c-01/80 |          | 00000088 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 |          | 00000016 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 |          | 0000002c | Core Gen11 Mobile
  | EHL            | B1       | 06-96-01/01 |          | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 |          | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | RKL-S          | B0       | 06-a7-01/02 |          | 00000040 | Core Gen11
- Updated platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3
  | HSX-EX         | E0       | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | BDX-ML         | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx
  | SKX-SP         | B1       | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3
  | BDX-DE         | V2/V3    | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  | BDX-DE         | Y0       | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87
  | BDX-NS         | A0       | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53
  | APL            | D0       | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series
  | GLK            | B0       | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology
  | AML-Y22        | H0       | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10
  | CML-U62        | A0       | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile
  | CML-U62 V2     | K0       | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1644494400">- Updated to Intel CPU Microcode 20220207 release.
  - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615)
  - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779)
  - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780)
  - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781)
  - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html)
  - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html)
  - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details.
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details.
  - Update for functional issues. Refer to [10th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details.
  - Update for functional issues. Refer to [8th Generation Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details.
  - Update for functional issues. Refer to [8th Gen Intel Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [7th and 8th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details.
  - Update for functional issues. Refer to [6th Generation Intel Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Pentium Silver and Intel Celeron Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details.</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- Updated to Intel CPU Microcode 20220419 release. (bsc#1198717)
  - Update for functional issues. Refer to errata
    APLI-11 in [Intel Atom Processor E3900
    Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details.
  - Changed Microcodes:
  - | APL            | E0       | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx</changelog>
  <changelog author="meissner@suse.com" date="1652270400">- Updated to Intel CPU Microcode 20220510 release. (bsc#1199423)
  - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html)
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details.
  - New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | ADL            | C0       | 06-97-02/03 |          | 0000001f | Core Gen12
  | ADL            | C0       | 06-97-05/03 |          | 0000001f | Core Gen12
  | ADL            | L0       | 06-9a-03/80 |          | 0000041c | Core Gen12
  | ADL            | L0       | 06-9a-04/80 |          | 0000041c | Core Gen12
  | ADL            | C0       | 06-bf-02/03 |          | 0000001f | Core Gen12
  | ADL            | C0       | 06-bf-02/03 |          | 0000001f | Core Gen12
  - Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | VLV            | D0       | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3
  | APL            | D0       | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile
  | EHL            | B1       | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10
  | CML-U62 V1     | A0       | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile
  | CML-U62 V2     | K1       | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile
  | RKL-S          | B0       | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11</changelog>
  <changelog author="meissner@suse.com" date="1660132800">- Updated to Intel CPU Microcode 20220809 release. (bsc#1201727)
  - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html).
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification
  +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.  - Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | B1       | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GLK-R          | R0       | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile
  | RKL-S          | B0       | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11
  | ADL            | C0       | 06-97-02/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | C0       | 06-97-05/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | L0       | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12
  | ADL            | L0       | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12
  | ADL            | C0       | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | C0       | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12</changelog>
  <changelog author="meissner@suse.com" date="1676462400">- Updated to Intel CPU Microcode 20230214 release.
  Security issues fixed:
  - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275)
  - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276)
  - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277)
  New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SPR-SP         | E2       | 06-8f-05/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-SP         | E3       | 06-8f-06/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-SP         | E4       | 06-8f-07/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-SP         | E5       | 06-8f-08/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-HBM        | B3       | 06-8f-08/10 |          | 2c000170 | Xeon Max
  | RPL-P 6+8      | J0       | 06-ba-02/07 |          | 0000410e | Core Gen13
  | RPL-H 6+8      | J0       | 06-ba-02/07 |          | 0000410e | Core Gen13
  | RPL-U 2+8      | Q0       | 06-ba-02/07 |          | 0000410e | Core Gen13
  Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | ADL            | C0       | 06-97-02/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | C0       | 06-97-05/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | C0       | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | C0       | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | L0       | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12
  | ADL            | L0       | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12
  | CLX-SP         | B0       | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GLK-R          | R0       | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-D          | B0       | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3
  | JSL            | A0/A1    | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | LKF            | B2/B3    | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology
  | RKL-S          | B0       | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11
  | RPL-S          | S0       | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13
  | SKX-SP         | B1       | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable</changelog>
</package>
<package pkgid="2f68f13977240ecde0c5352de61955077bd12355a774c0642414c4a9e1c3efb7" name="udev" arch="aarch64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="120978cc7b0d0b198b772cd7af48f177fb444179108801230e0473c3a0450207" name="udev" arch="x86_64">
  <version epoch="0" ver="249.12" rel="150400.8.16.1"/>
  <changelog author="fbui@suse.com" date="1646740800">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1647432000">- Import commit 23b6a8633186a2b5b2487621c81ec7e7bb068db1
  f19292f18d udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3349f636dc man: tweak description of auto/noauto (bsc#1191502)</changelog>
  <changelog author="fbui@suse.com" date="1647432001">- Import commit 5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c (merge of v249.11)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/23b6a8633186a2b5b2487621c81ec7e7bb068db1...5b022ce3dbad3189b7ce1e7b0f018b18ac6e583c</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1648468800">- spec: enable 'efi' support regardless of whether sd_boot is enabled or not
  We should support EFI systems even if systemd-boot is not enabled.</changelog>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="77255c23f6a0cbfbcbf6462f86e9e2f4ce973228657704cb67fb80b1fb9b3ec9" name="udev" arch="aarch64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="955574c31a5caa1df60f93bd2419377518b7acd66e65d950b4e8dfdd54d0809c" name="udev" arch="x86_64">
  <version epoch="0" ver="249.14" rel="150400.8.19.1"/>
  <changelog author="fbui@suse.com" date="1649073600">- spec: make sure /lib exists when installing conf files in /lib/modprobe.d</changelog>
  <changelog author="fbui@suse.com" date="1649160000">- Import commit e62acb68de9bccfa272bef98fe5b38effc37528a
  b70267d883 journald: make use of CLAMP() in cache_space_refresh()
  3953e685cb journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  d03a5f79bf fs-util: make sure openat_report_new() initializes return param also on shortcut
  05499d5a30 fs-util: fix typos in comments
  9f77c8fae1 journal-file: port journal_file_open() to openat_report_new()
  4d07c034da fs-util: add openat_report_new() wrapper around openat()
  258c04836d meson: build kernel-install man page when necessary
  23da9cc83a man: do not install sd-boot man pages when -Dgnu-efi=false is set
  d452b8738c unit: install the systemd-bless-boot.service only if we have gnu-efi
  98f44dc500 boot: don't build bootctl when -Dgnu-efi=false is set (bsc#1198093)
  9145684460 build: include status of TPM2 in the feature string show by --version</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 2bc0b2c447319a9156e7c5a18fe971f946554a6b
  6256b14446 test: adapt install_pam() for openSUSE
  3ea5b7e295 test: add test checking tmpfiles conf file precedence
  e63e641ee8 test tmpfiles: add a test for 'w+'
  b531758614 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  ea98492c53 cryptsetup: fall back to traditional unlocking if any TPM2 operation fails
- Move coredumpctl completion files into systemd-coredump sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 17d488c53ad150de59f7d842e870e0c3d141d8ff
  6b3bb1161c core/device: device_coldplug(): don't set DEVICE_DEAD
  1e4058a0bc core/device: do not downgrade device state if it is already enumerated
  f1d33c466e core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  fdaad2ff3a core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1657281600">- Make {/etc,/usr/lib}/systemd/network owned by both udev and systemd-network (bsc#1201276)
  This configuration files put in these directories are read by both udevd and
  systemd-networkd.</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 4949659dd6ce81845e13034504fe06b85a02f08b
  0f096f16ba tmpfiles: check the directory we were supposed to create, not its parent
  82c3793e43 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  2191a9ae95 logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1658318401">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
</package>
<package pkgid="e8808f0522512014941be09b133ce0374497caa18686b5499bdc4fd30eecc6be" name="udev" arch="aarch64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="b02434cec1ddf42eaff3cb9a63f39007364f81895618034a435342cba0107062" name="udev" arch="x86_64">
  <version epoch="0" ver="249.15" rel="150400.8.22.1"/>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit 7b70d88264a588fdba36c6e7655d1feea2b0e0a0 (merge of v249.12)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/4949659dd6ce81845e13034504fe06b85a02f08b...7b70d88264a588fdba36c6e7655d1feea2b0e0a0</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1660824000">- Don't replace /etc/systemd/system/tmp.mount symlink with a dangling one
  pointing to /usr/lib/systemd/ (bsc#1201795)</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1012-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)
- Make "sle15-sp3" net naming scheme still available for backward compatibility
  reason</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 0cd50eedcc0692c1f907b24424215f8db7d3b428
  ae2067b062 time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  0469b9f2bc pstore: do not try to load all known pstore modules
  ad05f54439 pstore: Run after modules are loaded
  ccad817445 core: Add trigger limit for path units
  281d818fe3 core/mount: also add default before dependency for automount mount units
  ffe5b4afa8 logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit bcf040075f682f67370ddf7ab93d7a0d8b9cd9cc
  ab0f962e4c core/device: Log on every event received from udev
  2dcb7c77fe udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  5b824103e0 udev/net_id: add debug logging for construction of device names
  cb6925410b udev: add one more assertion
  82e343153a udev: drop assertion which is always false
  cef726986b udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  00b34f08d9 tests: minor simplification in test-execute
  e5b4571c20 tests: make test-execute pass on openSUSE
- Drop the following patches since they have been merged in 'SUSE/v249' branch:
  6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
  <changelog author="fbui@suse.com" date="1673265600">- Import commit 540e0bd5374f9f42f1e645eb15971431ebb4b8c8
  29fb8a2dd0 core/unit: try to submit stop_when_unneeded queue on removing dependencies
  bd63eab381 core/device: start units specified in SYSTEMD_WANTS if it is not running
  e0898fa873 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  119424f96e coredump: adjust whitespace
  3833d5a408 coredump: drop an unused variable
  36728edcfd coredump: Fix format string type mismatch
  34f6867a8a analyze: use DumpUnitsMatchingPatternsByFileDescriptor
  e67a7087ec manager: add DumpUnitsMatchingPatternsByFileDescriptor()
  feb8f2a983 manager: rename dbus method
  98fed27339 analyze: extend the dump command to accept patterns
  a06d9470af man: document the Dump() calls of the PID 1 D-Bus interface, and what they are
  79eb37a5e0 cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944)
- Drop 5000-coredump-Fix-format-string-type-mismatch.patch
    5001-coredump-drop-an-unused-variable.patch
    5002-coredump-adjust-whitespace.patch
    5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
  They have been merged into SUSE/v249 branch.</changelog>
  <changelog author="fbui@suse.com" date="1673265601">- Ship systemd-pstore with udev (jsc#PED-2663)</changelog>
  <changelog author="fbui@suse.com" date="1674129600">- Don't overwrite /etc/pam.d/systemd-user on update (bsc#1207264)
  Regression introduced when systemd was forked for 15.4.</changelog>
  <changelog author="fbui@suse.com" date="1674302400">- Import commit 1bfa716e7fb6d7169cece864e75dfe9e52914c99 (merge of v249.14)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/540e0bd5374f9f42f1e645eb15971431ebb4b8c8...1bfa716e7fb6d7169cece864e75dfe9e52914c99
- Rebase 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch</changelog>
  <changelog author="fbui@suse.com" date="1674475200">- Make sure that /lib/udev exists and is a symlink to /usr/lib/udev when the
  testsuite is run.</changelog>
  <changelog author="fbui@suse.com" date="1674734400">- Move systemd-cryptenroll into udev package.</changelog>
  <changelog author="fbui@suse.com" date="1675684800">- systemd-testsuite: move the integration tests in a dedicated sub directory.</changelog>
  <changelog author="fbui@suse.com" date="1675684801">- Make sure we apply the presets on units shipped by systemd package</changelog>
  <changelog author="fbui@suse.com" date="1675684802">- machines.target belongs to systemd-container, do its init/cleanup steps from
  the scriptlets of this sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1675771200">- Make use of the %systemd_* rpm macros consistently. Using the upstream
  variants will ease the backports of Factory changes to SLE since Factory
  systemd uses the upstream variants exclusively.</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771203">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
</package>
<package pkgid="ce20e4dc38f4e3f63d1f4d374137779bd03da62398dbe30f065f41b6b399bd21" name="update-alternatives" arch="aarch64">
  <version epoch="0" ver="1.19.0.4" rel="150000.4.4.1"/>
  <changelog author="p.drouand@gmail.com" date="1424174400">- Update to version 1.17.23
  + Use a matching group instead of ${^MATCH} in s/// in dselect build script.
  + Skip tar extractor tests if tar is not GNU tar &gt;= 1.27.
  + Reset the trigger cycle tracking on unsatisfied dependencies during
    trigger processing. Closes: bdo#771730
  + Fix out-of-bounds buffer read accesses when parsing field and trigger
    names or checking package ownership of conffiles and directories.
  + Add versioned Breaks on packages creating trigger cycles. Namely auctex,
    apt-cudf, ccache, cups, distcc, fusionforge-plugin-mediawiki, gap-core,
    gxine, hoogle, icecc, libjs-protoaculous, mcollective, pypy, wordpress
    and xfonts-traditional.
  + Update translations
- Remove unapplied patches; SLE11 support is disabled in project home
  + dpkg-pod2man-no-utf8.patch
  + dpkg-old-File-Path.patch
  + dpkg-old-Test-More.patch
- Remove obsolete patches
  * dpkg-ppc64le.diff
  * dpkg-archive_tar_format_gnu.patch
  * dpkg-archtable-suse.patch
- Rename updated patch
  pdate-alternatives-1.16.8-suse.patch &gt; pdate-alternatives-suse.patch
- Clean up a bit specfile</changelog>
  <changelog author="tchvatal@suse.com" date="1427889600">- Update to 1.11.24:
  * Translation updates
  * Various small fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1427889601">- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1433419200">- Verion bump to 1.18.1:
  * Bump to latest upstream release
  * Plenty of fixes with too long changelog, see changelog file in
    documentation
  * Also fixes bnc#926749 CVE-2015-0840
  * Refresh patch:
    + update-alternatives-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1433505600">- Adjust to the new manpage location</changelog>
  <changelog author="tchvatal@suse.com" date="1458907200">- Update to the 1.18.4:
  * Rebase patch update-alternatives-suse.patch
  * Touch the gost file in post</changelog>
  <changelog author="tchvatal@suse.com" date="1459944000">- The logfile for update-alternatives is /var/log/alternatives.log
  so stop using update-alternatives.log file which is empty</changelog>
  <changelog author="tchvatal@suse.com" date="1459944001">- Fix bnc#969171 by updating even with equal priority
  * 0001-In-case-of-equal-priority-rather-update.patch
- Try to autorefresh all the alternatives in post in case some of
  them were broken</changelog>
  <changelog author="tchvatal@suse.com" date="1463140800">- Provide alternatives binary and alternatives = %{version} symbol</changelog>
  <changelog author="tchvatal@suse.com" date="1464696000">- Require touch in post phase bnc#982336</changelog>
  <changelog author="tchvatal@suse.com" date="1473249600">- Use ls . instead of * to avoid error when nothing is in alternatives
  directory</changelog>
  <changelog author="tchvatal@suse.com" date="1473249601">- Version update to 1.18.10:
  * Various few fixes, see changelog file in the package
  * Refresh patch update-alternatives-suse.patch
  * Remove patch dpkg-sparc.diff</changelog>
  <changelog author="tchvatal@suse.com" date="1490616000">- Update to 1.18.23:
  * Various small fixes and memleaks removed
- Make sure to generate manpage
- Refresh patch update-alternatives-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502280000">- Silence the update-alternatives regen output wrt bsc#1050848
  it causes more confusion than benefits</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Use dbpath macro for locationg rpm state directory
- Require exactly same version of rpm we had when building to make
  sure dbpath matches</changelog>
  <changelog author="mpluskal@suse.com" date="1511179200">- Move update alternatives database to new location
- Update rpm requirements to avoid unnecessary builds</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Migrate u-a data from /var/lib/rpm instead of relying on dbpath:
  no u-a version ever installed files explicitly into dbpath, but
  always hard specified /var/lib/rpm. The fact that RPM moved its
  database is irrelevant to update-alternatives. In case RPM moved
  it's database, our files are still accessible via the
  /var/lib/rpm symlink being put in place.
- Drop the arbitrary depenency on a specific rpm version: the idea
  was to ensure to have an rpm with the new dbpath location in
  place. For one, the dependency does not work as intended, and
  2nd, as the migration now happens explicitly from the old u-a
  admindir without relying on dbpath, is no longer needed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516104000">- Update to 1.19.0.4:
  * No changes in update-alternatives just match step with dpkg
- Drop patch 0001-In-case-of-equal-priority-rather-update.patch
  * Causes issues on too eagerly regenerating stuff bsc#1075971
  * Reason for this patch should no longer be needed as all python
    packages are singlespec
  * Also drop the post override</changelog>
  <changelog author="pgajdos@suse.com" date="1644580800">- break bash &lt;-&gt; update-alternatives cycle by coolo's rewrite
  of %post in lua [bsc#1195654]</changelog>
</package>
<package pkgid="6b8fa5db0c68cd65e7aa4f3b9b703af36d147cd947f3a617fa8ae808ac4c36ca" name="update-alternatives" arch="src">
  <version epoch="0" ver="1.19.0.4" rel="150000.4.4.1"/>
  <changelog author="tchvatal@suse.com" date="1399896000">- Use SUSE not SuSE.</changelog>
  <changelog author="p.drouand@gmail.com" date="1424174400">- Update to version 1.17.23
  + Use a matching group instead of ${^MATCH} in s/// in dselect build script.
  + Skip tar extractor tests if tar is not GNU tar &gt;= 1.27.
  + Reset the trigger cycle tracking on unsatisfied dependencies during
    trigger processing. Closes: bdo#771730
  + Fix out-of-bounds buffer read accesses when parsing field and trigger
    names or checking package ownership of conffiles and directories.
  + Add versioned Breaks on packages creating trigger cycles. Namely auctex,
    apt-cudf, ccache, cups, distcc, fusionforge-plugin-mediawiki, gap-core,
    gxine, hoogle, icecc, libjs-protoaculous, mcollective, pypy, wordpress
    and xfonts-traditional.
  + Update translations
- Remove unapplied patches; SLE11 support is disabled in project home
  + dpkg-pod2man-no-utf8.patch
  + dpkg-old-File-Path.patch
  + dpkg-old-Test-More.patch
- Remove obsolete patches
  * dpkg-ppc64le.diff
  * dpkg-archive_tar_format_gnu.patch
  * dpkg-archtable-suse.patch
- Rename updated patch
  pdate-alternatives-1.16.8-suse.patch &gt; pdate-alternatives-suse.patch
- Clean up a bit specfile</changelog>
  <changelog author="tchvatal@suse.com" date="1427889600">- Update to 1.11.24:
  * Translation updates
  * Various small fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1427889601">- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1433419200">- Verion bump to 1.18.1:
  * Bump to latest upstream release
  * Plenty of fixes with too long changelog, see changelog file in
    documentation
  * Also fixes bnc#926749 CVE-2015-0840
  * Refresh patch:
    + update-alternatives-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1433505600">- Adjust to the new manpage location</changelog>
  <changelog author="tchvatal@suse.com" date="1458907200">- Update to the 1.18.4:
  * Rebase patch update-alternatives-suse.patch
  * Touch the gost file in post</changelog>
  <changelog author="tchvatal@suse.com" date="1459944000">- The logfile for update-alternatives is /var/log/alternatives.log
  so stop using update-alternatives.log file which is empty</changelog>
  <changelog author="tchvatal@suse.com" date="1459944001">- Fix bnc#969171 by updating even with equal priority
  * 0001-In-case-of-equal-priority-rather-update.patch
- Try to autorefresh all the alternatives in post in case some of
  them were broken</changelog>
  <changelog author="tchvatal@suse.com" date="1463140800">- Provide alternatives binary and alternatives = %{version} symbol</changelog>
  <changelog author="tchvatal@suse.com" date="1464696000">- Require touch in post phase bnc#982336</changelog>
  <changelog author="tchvatal@suse.com" date="1473249600">- Use ls . instead of * to avoid error when nothing is in alternatives
  directory</changelog>
  <changelog author="tchvatal@suse.com" date="1473249601">- Version update to 1.18.10:
  * Various few fixes, see changelog file in the package
  * Refresh patch update-alternatives-suse.patch
  * Remove patch dpkg-sparc.diff</changelog>
  <changelog author="tchvatal@suse.com" date="1490616000">- Update to 1.18.23:
  * Various small fixes and memleaks removed
- Make sure to generate manpage
- Refresh patch update-alternatives-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502280000">- Silence the update-alternatives regen output wrt bsc#1050848
  it causes more confusion than benefits</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Use dbpath macro for locationg rpm state directory
- Require exactly same version of rpm we had when building to make
  sure dbpath matches</changelog>
  <changelog author="mpluskal@suse.com" date="1511179200">- Move update alternatives database to new location
- Update rpm requirements to avoid unnecessary builds</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Migrate u-a data from /var/lib/rpm instead of relying on dbpath:
  no u-a version ever installed files explicitly into dbpath, but
  always hard specified /var/lib/rpm. The fact that RPM moved its
  database is irrelevant to update-alternatives. In case RPM moved
  it's database, our files are still accessible via the
  /var/lib/rpm symlink being put in place.
- Drop the arbitrary depenency on a specific rpm version: the idea
  was to ensure to have an rpm with the new dbpath location in
  place. For one, the dependency does not work as intended, and
  2nd, as the migration now happens explicitly from the old u-a
  admindir without relying on dbpath, is no longer needed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516104000">- Update to 1.19.0.4:
  * No changes in update-alternatives just match step with dpkg
- Drop patch 0001-In-case-of-equal-priority-rather-update.patch
  * Causes issues on too eagerly regenerating stuff bsc#1075971
  * Reason for this patch should no longer be needed as all python
    packages are singlespec
  * Also drop the post override</changelog>
  <changelog author="pgajdos@suse.com" date="1644580800">- break bash &lt;-&gt; update-alternatives cycle by coolo's rewrite
  of %post in lua [bsc#1195654]</changelog>
</package>
<package pkgid="908392e61a0da1c7728e1a9cd56a5966c178b05c0ff703c4247d31af2294fc46" name="update-alternatives" arch="x86_64">
  <version epoch="0" ver="1.19.0.4" rel="150000.4.4.1"/>
  <changelog author="p.drouand@gmail.com" date="1424174400">- Update to version 1.17.23
  + Use a matching group instead of ${^MATCH} in s/// in dselect build script.
  + Skip tar extractor tests if tar is not GNU tar &gt;= 1.27.
  + Reset the trigger cycle tracking on unsatisfied dependencies during
    trigger processing. Closes: bdo#771730
  + Fix out-of-bounds buffer read accesses when parsing field and trigger
    names or checking package ownership of conffiles and directories.
  + Add versioned Breaks on packages creating trigger cycles. Namely auctex,
    apt-cudf, ccache, cups, distcc, fusionforge-plugin-mediawiki, gap-core,
    gxine, hoogle, icecc, libjs-protoaculous, mcollective, pypy, wordpress
    and xfonts-traditional.
  + Update translations
- Remove unapplied patches; SLE11 support is disabled in project home
  + dpkg-pod2man-no-utf8.patch
  + dpkg-old-File-Path.patch
  + dpkg-old-Test-More.patch
- Remove obsolete patches
  * dpkg-ppc64le.diff
  * dpkg-archive_tar_format_gnu.patch
  * dpkg-archtable-suse.patch
- Rename updated patch
  pdate-alternatives-1.16.8-suse.patch &gt; pdate-alternatives-suse.patch
- Clean up a bit specfile</changelog>
  <changelog author="tchvatal@suse.com" date="1427889600">- Update to 1.11.24:
  * Translation updates
  * Various small fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1427889601">- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1433419200">- Verion bump to 1.18.1:
  * Bump to latest upstream release
  * Plenty of fixes with too long changelog, see changelog file in
    documentation
  * Also fixes bnc#926749 CVE-2015-0840
  * Refresh patch:
    + update-alternatives-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1433505600">- Adjust to the new manpage location</changelog>
  <changelog author="tchvatal@suse.com" date="1458907200">- Update to the 1.18.4:
  * Rebase patch update-alternatives-suse.patch
  * Touch the gost file in post</changelog>
  <changelog author="tchvatal@suse.com" date="1459944000">- The logfile for update-alternatives is /var/log/alternatives.log
  so stop using update-alternatives.log file which is empty</changelog>
  <changelog author="tchvatal@suse.com" date="1459944001">- Fix bnc#969171 by updating even with equal priority
  * 0001-In-case-of-equal-priority-rather-update.patch
- Try to autorefresh all the alternatives in post in case some of
  them were broken</changelog>
  <changelog author="tchvatal@suse.com" date="1463140800">- Provide alternatives binary and alternatives = %{version} symbol</changelog>
  <changelog author="tchvatal@suse.com" date="1464696000">- Require touch in post phase bnc#982336</changelog>
  <changelog author="tchvatal@suse.com" date="1473249600">- Use ls . instead of * to avoid error when nothing is in alternatives
  directory</changelog>
  <changelog author="tchvatal@suse.com" date="1473249601">- Version update to 1.18.10:
  * Various few fixes, see changelog file in the package
  * Refresh patch update-alternatives-suse.patch
  * Remove patch dpkg-sparc.diff</changelog>
  <changelog author="tchvatal@suse.com" date="1490616000">- Update to 1.18.23:
  * Various small fixes and memleaks removed
- Make sure to generate manpage
- Refresh patch update-alternatives-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502280000">- Silence the update-alternatives regen output wrt bsc#1050848
  it causes more confusion than benefits</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Use dbpath macro for locationg rpm state directory
- Require exactly same version of rpm we had when building to make
  sure dbpath matches</changelog>
  <changelog author="mpluskal@suse.com" date="1511179200">- Move update alternatives database to new location
- Update rpm requirements to avoid unnecessary builds</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Migrate u-a data from /var/lib/rpm instead of relying on dbpath:
  no u-a version ever installed files explicitly into dbpath, but
  always hard specified /var/lib/rpm. The fact that RPM moved its
  database is irrelevant to update-alternatives. In case RPM moved
  it's database, our files are still accessible via the
  /var/lib/rpm symlink being put in place.
- Drop the arbitrary depenency on a specific rpm version: the idea
  was to ensure to have an rpm with the new dbpath location in
  place. For one, the dependency does not work as intended, and
  2nd, as the migration now happens explicitly from the old u-a
  admindir without relying on dbpath, is no longer needed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516104000">- Update to 1.19.0.4:
  * No changes in update-alternatives just match step with dpkg
- Drop patch 0001-In-case-of-equal-priority-rather-update.patch
  * Causes issues on too eagerly regenerating stuff bsc#1075971
  * Reason for this patch should no longer be needed as all python
    packages are singlespec
  * Also drop the post override</changelog>
  <changelog author="pgajdos@suse.com" date="1644580800">- break bash &lt;-&gt; update-alternatives cycle by coolo's rewrite
  of %post in lua [bsc#1195654]</changelog>
</package>
<package pkgid="de545c5df2345527c418a3681121c3eb85a1bc11751768f6381f4e449915f5ae" name="util-linux" arch="aarch64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="3cca58ca7ed6acbc9afd3769db9175f634d5be187bc6d39be8fdd1f9d47889fc" name="util-linux" arch="src">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="04cd3fabd9b4043b7c991d21d114a5f29e11268f9acc419025299c346e38041d" name="util-linux" arch="x86_64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="7f703613484f285216c2bdbc7895d3304245fdc8fa45506b0173990d9441c5f8" name="util-linux-systemd" arch="aarch64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
</package>
<package pkgid="5434edfb07c63e17ba4df8fd8ce325baf5c794293921ed0917d142a0a536361e" name="util-linux-systemd" arch="src">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
</package>
<package pkgid="3d0964e96d6de8495ff6063d07ddd26361b940a128547868e597ae1138a66ae4" name="util-linux-systemd" arch="x86_64">
  <version epoch="0" ver="2.37.2" rel="150400.8.14.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1637150400">- Update to version 2.37.2:
  * No longer uses Groff to maintain man-pages.
  * New implementation of hardlink.
  * lscpu reimplemented.
  * uclampset: new util to manipulate the utilization clamping
    attributes of the system or a process.
  * hexdump automatically uses -C when called as "hd".
  * dmesg supports new command-line options --since and --until.
  * findmnt supports new command-line options --shadowed to print
    only filesystems over-mounted by another filesystem.
  * mount supports --read-only command-line option for non-root
    users too.
  * umount(8) can umount also all over-mounted filesystems (more
    filesystems on the the same mount point) when executed with
  - -recursive.
  * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type
    names on input, ignoring the case of the characters and all
    non-alphanumeric and non-digit characters in the name
    (e.g. type="Linux /usr x86" is the same as type="linux usr-x86"
    for sfdisk).
  * libmount no longer contains a workaround to detect inconsistent
    /proc/self/mountinfo reads.
  * libblkid supports "probing hints" now. The hints are the
    optional way how to force probing functions to check for
    example another location -- for example specific session on
    multi-session UDF. The command blkid(8) supports this
    functionality with a new --hint option. The library has been
    also extended to support others ISO9660 and UDF identifiers.
  * blkzone provides a new "capacity" command.
  * cfdisk is possible to start in read-only mode by a new
    command-line option --read-only
  * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column
    MOUNTPOINTS is used in the default output now and this new
    column prints all mount points where the device is used (btrfs
    subvolumes, bind mounts, etc).
  * losetup uses LOOP_CONFIG ioctl now.
  * column supports a new command-line option --table-columns-limit
    to specify a maximal number of the input columns. The last
    column will contain all remaining line data if the limit is
    smaller than the number of the columns in the input data.
  * Obsoletes util-linux-ipcs-shmall-overflow-1.patch,
    util-linux-ipcs-shmall-overflow-2.patch,
    util-linux-ipcs-shmall-overflow-ts.patch,
    util-linux-ipcutils-overflow-CVE-2021-37600.patch.
  * Many other new features and fixes. For the complete list see
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes
    https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes
- Update util-linux-login_defs-check.sh and
  login_defs-support-for-util-linux to version 2.37
  (new variable LOGIN_KEEP_USERNAME).
- INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is
  not even built any more with the latest kernel.</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643630400">- Implement "X-fstrim.notrim" fstab mount option that skips fstrim
  for selected device (jsc#SLE-17942,
  util-linux-fstrim-implement-X-fstrim.notrim.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
</package>
<package pkgid="1877d76255e12ac7f6f24acf53e52361c9005c9509c93e003b70f4b167ccf9be" name="vim" arch="src">
  <version epoch="0" ver="9.0.0814" rel="150000.5.28.1"/>
  <changelog author="idonmez@suse.com" date="1516795200">- Make vim require vim-data bsc#1077352 bsc#1075541 bsc#1074790</changelog>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
</package>
<package pkgid="ba54c02af20c5c78ac4380b81bba3a78bb3d4a7900ebf65b8eb7c2e10e396cc5" name="vim" arch="src">
  <version epoch="0" ver="9.0.1040" rel="150000.5.31.1"/>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
</package>
<package pkgid="f5e151d408bbc41ae25938d4e4ecb7668a8a87e6f542e44c675c605bfbaa3d10" name="vim" arch="src">
  <version epoch="0" ver="9.0.1234" rel="150000.5.34.1"/>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
  <changelog author="zbalogh@suse.com" date="1674648000">- Updated to version 9.0 with patch level 1234, fixes the following security problems
  * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225
  * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
  * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
  * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- refreshed vim-7.4-highlight_fstab.patch
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234</changelog>
</package>
<package pkgid="37b1589b45786dffa498020ff108d2bcdf30ac446572fd596cbcc017be089697" name="vim" arch="src">
  <version epoch="0" ver="9.0.1386" rel="150000.5.37.1"/>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
  <changelog author="zbalogh@suse.com" date="1674648000">- Updated to version 9.0 with patch level 1234, fixes the following security problems
  * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225
  * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
  * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
  * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- refreshed vim-7.4-highlight_fstab.patch
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234</changelog>
  <changelog author="zbalogh@suse.com" date="1678190400">- Updated to version 9.0 with patch level 1386, fixes the following security problems
  * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247
  * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size
  * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376
  * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown()
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386</changelog>
</package>
<package pkgid="c7d13b7b72a00f7543f2fb5627e318623f88fd27abc6089646e98c6c542acdc0" name="vim-data-common" arch="noarch">
  <version epoch="0" ver="9.0.0814" rel="150000.5.28.1"/>
  <changelog author="idonmez@suse.com" date="1516795200">- Make vim require vim-data bsc#1077352 bsc#1075541 bsc#1074790</changelog>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
</package>
<package pkgid="668211e335f92e658fd169f37d4038436275573f3796de44fa8d03159c7263d3" name="vim-data-common" arch="noarch">
  <version epoch="0" ver="9.0.1040" rel="150000.5.31.1"/>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
</package>
<package pkgid="36357e2ba9c1b00bb3e4a070f0b9933b0a2eb809ba47ec0c00665035e5f9620b" name="vim-data-common" arch="noarch">
  <version epoch="0" ver="9.0.1234" rel="150000.5.34.1"/>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
  <changelog author="zbalogh@suse.com" date="1674648000">- Updated to version 9.0 with patch level 1234, fixes the following security problems
  * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225
  * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
  * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
  * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- refreshed vim-7.4-highlight_fstab.patch
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234</changelog>
</package>
<package pkgid="89f3a0d6983f55436fe91ef92c37ce3f3de2f2c52899a4eaf1157b1d478549cc" name="vim-data-common" arch="noarch">
  <version epoch="0" ver="9.0.1386" rel="150000.5.37.1"/>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
  <changelog author="zbalogh@suse.com" date="1674648000">- Updated to version 9.0 with patch level 1234, fixes the following security problems
  * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225
  * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
  * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
  * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- refreshed vim-7.4-highlight_fstab.patch
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234</changelog>
  <changelog author="zbalogh@suse.com" date="1678190400">- Updated to version 9.0 with patch level 1386, fixes the following security problems
  * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247
  * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size
  * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376
  * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown()
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386</changelog>
</package>
<package pkgid="c7176bd7cfc5708afa2a39b57fd40d237a2b003077b90f8acfb1e7af496c047a" name="vim-small" arch="aarch64">
  <version epoch="0" ver="9.0.0814" rel="150000.5.28.1"/>
  <changelog author="idonmez@suse.com" date="1516795200">- Make vim require vim-data bsc#1077352 bsc#1075541 bsc#1074790</changelog>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
</package>
<package pkgid="97f48867c672998c803b9f5acc14f7a76137cbab206f5952cff5f0bc8db75d8e" name="vim-small" arch="x86_64">
  <version epoch="0" ver="9.0.0814" rel="150000.5.28.1"/>
  <changelog author="idonmez@suse.com" date="1516795200">- Make vim require vim-data bsc#1077352 bsc#1075541 bsc#1074790</changelog>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
</package>
<package pkgid="e177865df54cb83f848f9f9b3847b2413e56c29d1a0501a86f3583d9028a9fcb" name="vim-small" arch="aarch64">
  <version epoch="0" ver="9.0.1040" rel="150000.5.31.1"/>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
</package>
<package pkgid="92ce85ae2ad56484b46efb8f30031f2b04a18cb297b2b9d4fac6300450c36203" name="vim-small" arch="x86_64">
  <version epoch="0" ver="9.0.1040" rel="150000.5.31.1"/>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
</package>
<package pkgid="c81171abe024c24a43da12936f4769666edab1c5315193a3ced121ebb90ecea0" name="vim-small" arch="aarch64">
  <version epoch="0" ver="9.0.1234" rel="150000.5.34.1"/>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
  <changelog author="zbalogh@suse.com" date="1674648000">- Updated to version 9.0 with patch level 1234, fixes the following security problems
  * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225
  * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
  * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
  * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- refreshed vim-7.4-highlight_fstab.patch
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234</changelog>
</package>
<package pkgid="494667535ca179ad637812e12a2cb0e3215ba2ba6951656d6d1754a55c0d9d43" name="vim-small" arch="x86_64">
  <version epoch="0" ver="9.0.1234" rel="150000.5.34.1"/>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
  <changelog author="zbalogh@suse.com" date="1674648000">- Updated to version 9.0 with patch level 1234, fixes the following security problems
  * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225
  * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
  * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
  * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- refreshed vim-7.4-highlight_fstab.patch
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234</changelog>
</package>
<package pkgid="06b9ff94bde83fef2de6d68dbfe9df1b20ace704c6892dcd5c9050fe7c9e4f56" name="vim-small" arch="aarch64">
  <version epoch="0" ver="9.0.1386" rel="150000.5.37.1"/>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
  <changelog author="zbalogh@suse.com" date="1674648000">- Updated to version 9.0 with patch level 1234, fixes the following security problems
  * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225
  * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
  * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
  * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- refreshed vim-7.4-highlight_fstab.patch
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234</changelog>
  <changelog author="zbalogh@suse.com" date="1678190400">- Updated to version 9.0 with patch level 1386, fixes the following security problems
  * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247
  * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size
  * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376
  * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown()
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386</changelog>
</package>
<package pkgid="7ec80990cf3cdab072178df8897c88fe8e50d262e70af7939db8e862c6ad98ce" name="vim-small" arch="x86_64">
  <version epoch="0" ver="9.0.1386" rel="150000.5.37.1"/>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
  <changelog author="zbalogh@suse.com" date="1674648000">- Updated to version 9.0 with patch level 1234, fixes the following security problems
  * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225
  * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
  * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
  * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- refreshed vim-7.4-highlight_fstab.patch
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234</changelog>
  <changelog author="zbalogh@suse.com" date="1678190400">- Updated to version 9.0 with patch level 1386, fixes the following security problems
  * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247
  * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size
  * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376
  * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown()
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386</changelog>
</package>
<package pkgid="b3e3deaf747c73787f11f5e52e913d9d002822b44c65f9c1efef6339d556b830" name="xen" arch="src">
  <version epoch="0" ver="4.16.3_02" rel="150400.4.19.1"/>
  <changelog author="carnold@suse.com" date="1649851200">- Update to Xen 4.16.1 bug fix release (bsc#1027519)
  xen-4.16.1-testing-src.tar.bz2
- Drop patches contained in new tarball
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  61d6ea2d-VT-d-split-domid-map-cleanup-check-into-a-function.patch
  61d6ea7b-VT-d-dont-leak-domid-mapping-on-error-path.patch
  61e0296a-x86-time-calibration-relative-counts.patch
  61e029c8-x86-time-TSC-freq-calibration-accuracy.patch
  61e02a1c-libxl-PCI-PV-hotplug-stubdom-coldplug.patch
  61e98e88-x86-introduce-get-set-reg-infra.patch
  61e98e89-x86-MSR-split-SPEC_CTRL-handling.patch
  61e98e8a-x86-spec-ctrl-drop-ENTRY-EXIT-HVM.patch
  61e98e8b-VT-x-SPEC_CTRL-NMI-race-condition.patch
  61eaaa23-x86-get-set-reg-infra-build.patch
  61efec1d-Arm-P2M-always-clear-entry-on-mapping-removal.patch
  61efec4d-gnttab-only-decrement-refcounter-on-final-unmap.patch
  61efec96-IOMMU-x86-stop-pirq-iteration-immediately-on-error.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  6229ba46-VT-d-drop-undue-address-of-from-check_cleanup_domid_map.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch
  xsa400-12.patch</changelog>
  <changelog author="dmueller@suse.com" date="1652184000">- fix python3 &gt;= 3.10 version detection</changelog>
  <changelog author="jbeulich@suse.com" date="1653998400">- Upstream bug fixes (bsc#1027519)
  625fca42-VT-d-reserved-CAP-ND.patch
  626f7ee8-x86-MSR-handle-P5-MC-reads.patch
  627549d6-IO-shutdown-race.patch
- bsc#1199965 - VUL-0: EMBARGOED: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  xsa401-1.patch
  xsa401-2.patch
- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="schubi@suse.com" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch
- Fix gcc13 compilation error
  62c56cc0-libxc-fix-compilation-error-with-gcc13.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657713600">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ed-x86-honour-spec-ctrl-0-for-unpriv-mmio.patch
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62a99614-IOMMU-x86-gcc12.patch
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657713601">- Added --disable-pvshim when running configure in xen.spec.
  We have never shipped the shim and don't need to build it.</changelog>
  <changelog author="ohering@suse.de" date="1659009600">- bsc#1167608, bsc#1201631 - fix built-in default of max_event_channels
  A previous change to the built-in default had a logic error,
  effectively restoring the upstream limit of 1023 channels per domU.
  Fix the logic to calculate the default based on the number of vcpus.
  adjust libxl.max_event_channels.patch</changelog>
  <changelog author="carnold@suse.com" date="1660824000">- Update to Xen 4.16.2 bug fix release (bsc#1027519)
  xen-4.16.2-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Drop patches contained in new tarball
  625fca42-VT-d-reserved-CAP-ND.patch
  626f7ee8-x86-MSR-handle-P5-MC-reads.patch
  627549d6-IO-shutdown-race.patch
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
  62a99614-IOMMU-x86-gcc12.patch
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
  62c56cc0-libxc-fix-compilation-error-with-gcc13.patch
  62cc31ed-x86-honour-spec-ctrl-0-for-unpriv-mmio.patch
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
  xsa408.patch</changelog>
  <changelog author="carnold@suse.com" date="1661256000">- Things are compiling fine now with gcc12.
  Drop gcc12-fixes.patch</changelog>
  <changelog author="carnold@suse.com" date="1661774400">- bsc#1201994 - Xen DomU unable to emulate audio device
  62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch</changelog>
  <changelog author="carnold@suse.com" date="1664366400">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180800">- bsc#1204483 - VUL-0: CVE-2022-42327: xen: x86: unintended memory
  sharing between guests (XSA-412)
  xsa412.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180801">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
- bsc#1204485 - VUL-0: CVE-2022-42309: xen: Xenstore: Guests can
  crash xenstored (XSA-414)
  xsa414.patch
- bsc#1204487 - VUL-0: CVE-2022-42310: xen: Xenstore: Guests can
  create orphaned Xenstore nodes (XSA-415)
  xsa415.patch
- bsc#1204488 - VUL-0: CVE-2022-42319: xen: Xenstore: Guests can
  cause Xenstore to not free temporary memory (XSA-416)
  xsa416.patch
- bsc#1204489 - VUL-0: CVE-2022-42320: xen: Xenstore: Guests can
  get access to Xenstore nodes of deleted domains (XSA-417)
  xsa417.patch
- bsc#1204490 - VUL-0: CVE-2022-42321: xen: Xenstore: Guests can
  crash xenstored via exhausting the stack (XSA-418)
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
  xsa418-07.patch
- bsc#1204494 - VUL-0: CVE-2022-42322,CVE-2022-42323: xen:
  Xenstore: cooperating guests can create arbitrary numbers of
  nodes (XSA-419)
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
- bsc#1204496 - VUL-0: CVE-2022-42325,CVE-2022-42326: xen:
  Xenstore: Guests can create arbitray number of nodes via
  transactions (XSA-421)
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699200">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
- bcs#1203804 - VUL-0: CVE-2022-33747: xen: unbounded memory consumption
  for 2nd-level page tables on ARM systems (XSA-409)
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
- Upstream bug fixes (bsc#1027519)
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  631b5ba6-gnttab-acquire-resource-vaddrs.patch
  634561f1-x86emul-respect-NSCB.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
- Drop patches replaced by upstream versions:
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666958400">- bsc#1193923 - VUL-1: xen: Frontends vulnerable to backends
  (XSA-376)
  61dd5f64-limit-support-statement-for-Linux-and-Windows-frontends.patch</changelog>
  <changelog author="carnold@suse.com" date="1668081600">- bsc#1205209 - VUL-0: CVE-2022-23824: xen: x86: Multiple
  speculative security issues (XSA-422)
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch</changelog>
  <changelog author="carnold@suse.com" date="1671451200">- Update to Xen 4.16.3 bug fix release (bsc#1027519)
  xen-4.16.3-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Drop patches contained in new tarball
  62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  631b5ba6-gnttab-acquire-resource-vaddrs.patch
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
  634561f1-x86emul-respect-NSCB.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
  xsa412.patch
  xsa414.patch
  xsa415.patch
  xsa416.patch
  xsa417.patch
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
  xsa418-07.patch
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1671537600">- Upstream bug fixes (bsc#1027519)
  63a03e28-x86-high-freq-TSC-overflow.patch</changelog>
</package>
<package pkgid="6810e1ff2bd1691d42bd68c5bc98de7f144216a93d006c96478dec5f50919562" name="xen" arch="src">
  <version epoch="0" ver="4.16.3_04" rel="150400.4.22.1"/>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="schubi@suse.com" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch
- Fix gcc13 compilation error
  62c56cc0-libxc-fix-compilation-error-with-gcc13.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657713600">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ed-x86-honour-spec-ctrl-0-for-unpriv-mmio.patch
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62a99614-IOMMU-x86-gcc12.patch
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657713601">- Added --disable-pvshim when running configure in xen.spec.
  We have never shipped the shim and don't need to build it.</changelog>
  <changelog author="ohering@suse.de" date="1659009600">- bsc#1167608, bsc#1201631 - fix built-in default of max_event_channels
  A previous change to the built-in default had a logic error,
  effectively restoring the upstream limit of 1023 channels per domU.
  Fix the logic to calculate the default based on the number of vcpus.
  adjust libxl.max_event_channels.patch</changelog>
  <changelog author="carnold@suse.com" date="1660824000">- Update to Xen 4.16.2 bug fix release (bsc#1027519)
  xen-4.16.2-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Drop patches contained in new tarball
  625fca42-VT-d-reserved-CAP-ND.patch
  626f7ee8-x86-MSR-handle-P5-MC-reads.patch
  627549d6-IO-shutdown-race.patch
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
  62a99614-IOMMU-x86-gcc12.patch
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
  62c56cc0-libxc-fix-compilation-error-with-gcc13.patch
  62cc31ed-x86-honour-spec-ctrl-0-for-unpriv-mmio.patch
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
  xsa408.patch</changelog>
  <changelog author="carnold@suse.com" date="1661256000">- Things are compiling fine now with gcc12.
  Drop gcc12-fixes.patch</changelog>
  <changelog author="carnold@suse.com" date="1661774400">- bsc#1201994 - Xen DomU unable to emulate audio device
  62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch</changelog>
  <changelog author="carnold@suse.com" date="1664366400">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180800">- bsc#1204483 - VUL-0: CVE-2022-42327: xen: x86: unintended memory
  sharing between guests (XSA-412)
  xsa412.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180801">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
- bsc#1204485 - VUL-0: CVE-2022-42309: xen: Xenstore: Guests can
  crash xenstored (XSA-414)
  xsa414.patch
- bsc#1204487 - VUL-0: CVE-2022-42310: xen: Xenstore: Guests can
  create orphaned Xenstore nodes (XSA-415)
  xsa415.patch
- bsc#1204488 - VUL-0: CVE-2022-42319: xen: Xenstore: Guests can
  cause Xenstore to not free temporary memory (XSA-416)
  xsa416.patch
- bsc#1204489 - VUL-0: CVE-2022-42320: xen: Xenstore: Guests can
  get access to Xenstore nodes of deleted domains (XSA-417)
  xsa417.patch
- bsc#1204490 - VUL-0: CVE-2022-42321: xen: Xenstore: Guests can
  crash xenstored via exhausting the stack (XSA-418)
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
  xsa418-07.patch
- bsc#1204494 - VUL-0: CVE-2022-42322,CVE-2022-42323: xen:
  Xenstore: cooperating guests can create arbitrary numbers of
  nodes (XSA-419)
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
- bsc#1204496 - VUL-0: CVE-2022-42325,CVE-2022-42326: xen:
  Xenstore: Guests can create arbitray number of nodes via
  transactions (XSA-421)
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699200">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
- bcs#1203804 - VUL-0: CVE-2022-33747: xen: unbounded memory consumption
  for 2nd-level page tables on ARM systems (XSA-409)
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
- Upstream bug fixes (bsc#1027519)
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  631b5ba6-gnttab-acquire-resource-vaddrs.patch
  634561f1-x86emul-respect-NSCB.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
- Drop patches replaced by upstream versions:
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666958400">- bsc#1193923 - VUL-1: xen: Frontends vulnerable to backends
  (XSA-376)
  61dd5f64-limit-support-statement-for-Linux-and-Windows-frontends.patch</changelog>
  <changelog author="carnold@suse.com" date="1668081600">- bsc#1205209 - VUL-0: CVE-2022-23824: xen: x86: Multiple
  speculative security issues (XSA-422)
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch</changelog>
  <changelog author="carnold@suse.com" date="1671451200">- Update to Xen 4.16.3 bug fix release (bsc#1027519)
  xen-4.16.3-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Drop patches contained in new tarball
  62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  631b5ba6-gnttab-acquire-resource-vaddrs.patch
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
  634561f1-x86emul-respect-NSCB.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
  xsa412.patch
  xsa414.patch
  xsa415.patch
  xsa416.patch
  xsa417.patch
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
  xsa418-07.patch
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1671537600">- Upstream bug fixes (bsc#1027519)
  63a03e28-x86-high-freq-TSC-overflow.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1675684800">- Upstream bug fixes (bsc#1027519)
  63c05478-VMX-calculate-model-specific-LBRs-once.patch
  63c05478-VMX-support-CPUs-without-model-specific-LBR.patch</changelog>
  <changelog author="carnold@suse.com" date="1675944000">- bsc#1205792 - Partner-L3: launch-xenstore error messages show in
  SLES15 SP4 xen kernel.
  63e4da00-dont-log-errors-when-trying-to-load-PVH-xenstore-stubdom.patch</changelog>
  <changelog author="carnold@suse.com" date="1676462400">- bsc#1208286 - VUL-0: CVE-2022-27672: xen: Cross-Thread Return
  Address Predictions (XSA-426)
  63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch</changelog>
</package>
<package pkgid="34e1070a16b7a641a80f2bd65d06f0ec9cbd74b7ef440fa5cc0b86dcb2cc4089" name="xen" arch="src">
  <version epoch="0" ver="4.16.3_06" rel="150400.4.25.1"/>
  <changelog author="schubi@suse.com" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch
- Fix gcc13 compilation error
  62c56cc0-libxc-fix-compilation-error-with-gcc13.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657713600">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ed-x86-honour-spec-ctrl-0-for-unpriv-mmio.patch
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62a99614-IOMMU-x86-gcc12.patch
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657713601">- Added --disable-pvshim when running configure in xen.spec.
  We have never shipped the shim and don't need to build it.</changelog>
  <changelog author="ohering@suse.de" date="1659009600">- bsc#1167608, bsc#1201631 - fix built-in default of max_event_channels
  A previous change to the built-in default had a logic error,
  effectively restoring the upstream limit of 1023 channels per domU.
  Fix the logic to calculate the default based on the number of vcpus.
  adjust libxl.max_event_channels.patch</changelog>
  <changelog author="carnold@suse.com" date="1660824000">- Update to Xen 4.16.2 bug fix release (bsc#1027519)
  xen-4.16.2-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Drop patches contained in new tarball
  625fca42-VT-d-reserved-CAP-ND.patch
  626f7ee8-x86-MSR-handle-P5-MC-reads.patch
  627549d6-IO-shutdown-race.patch
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
  62a99614-IOMMU-x86-gcc12.patch
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
  62c56cc0-libxc-fix-compilation-error-with-gcc13.patch
  62cc31ed-x86-honour-spec-ctrl-0-for-unpriv-mmio.patch
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
  xsa408.patch</changelog>
  <changelog author="carnold@suse.com" date="1661256000">- Things are compiling fine now with gcc12.
  Drop gcc12-fixes.patch</changelog>
  <changelog author="carnold@suse.com" date="1661774400">- bsc#1201994 - Xen DomU unable to emulate audio device
  62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch</changelog>
  <changelog author="carnold@suse.com" date="1664366400">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180800">- bsc#1204483 - VUL-0: CVE-2022-42327: xen: x86: unintended memory
  sharing between guests (XSA-412)
  xsa412.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180801">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
- bsc#1204485 - VUL-0: CVE-2022-42309: xen: Xenstore: Guests can
  crash xenstored (XSA-414)
  xsa414.patch
- bsc#1204487 - VUL-0: CVE-2022-42310: xen: Xenstore: Guests can
  create orphaned Xenstore nodes (XSA-415)
  xsa415.patch
- bsc#1204488 - VUL-0: CVE-2022-42319: xen: Xenstore: Guests can
  cause Xenstore to not free temporary memory (XSA-416)
  xsa416.patch
- bsc#1204489 - VUL-0: CVE-2022-42320: xen: Xenstore: Guests can
  get access to Xenstore nodes of deleted domains (XSA-417)
  xsa417.patch
- bsc#1204490 - VUL-0: CVE-2022-42321: xen: Xenstore: Guests can
  crash xenstored via exhausting the stack (XSA-418)
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
  xsa418-07.patch
- bsc#1204494 - VUL-0: CVE-2022-42322,CVE-2022-42323: xen:
  Xenstore: cooperating guests can create arbitrary numbers of
  nodes (XSA-419)
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
- bsc#1204496 - VUL-0: CVE-2022-42325,CVE-2022-42326: xen:
  Xenstore: Guests can create arbitray number of nodes via
  transactions (XSA-421)
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699200">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
- bcs#1203804 - VUL-0: CVE-2022-33747: xen: unbounded memory consumption
  for 2nd-level page tables on ARM systems (XSA-409)
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
- Upstream bug fixes (bsc#1027519)
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  631b5ba6-gnttab-acquire-resource-vaddrs.patch
  634561f1-x86emul-respect-NSCB.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
- Drop patches replaced by upstream versions:
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666958400">- bsc#1193923 - VUL-1: xen: Frontends vulnerable to backends
  (XSA-376)
  61dd5f64-limit-support-statement-for-Linux-and-Windows-frontends.patch</changelog>
  <changelog author="carnold@suse.com" date="1668081600">- bsc#1205209 - VUL-0: CVE-2022-23824: xen: x86: Multiple
  speculative security issues (XSA-422)
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch</changelog>
  <changelog author="carnold@suse.com" date="1671451200">- Update to Xen 4.16.3 bug fix release (bsc#1027519)
  xen-4.16.3-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Drop patches contained in new tarball
  62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  631b5ba6-gnttab-acquire-resource-vaddrs.patch
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
  634561f1-x86emul-respect-NSCB.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
  xsa412.patch
  xsa414.patch
  xsa415.patch
  xsa416.patch
  xsa417.patch
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
  xsa418-07.patch
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1671537600">- Upstream bug fixes (bsc#1027519)
  63a03e28-x86-high-freq-TSC-overflow.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1675684800">- Upstream bug fixes (bsc#1027519)
  63c05478-VMX-calculate-model-specific-LBRs-once.patch
  63c05478-VMX-support-CPUs-without-model-specific-LBR.patch</changelog>
  <changelog author="carnold@suse.com" date="1675944000">- bsc#1205792 - Partner-L3: launch-xenstore error messages show in
  SLES15 SP4 xen kernel.
  63e4da00-dont-log-errors-when-trying-to-load-PVH-xenstore-stubdom.patch</changelog>
  <changelog author="carnold@suse.com" date="1676462400">- bsc#1208286 - VUL-0: CVE-2022-27672: xen: Cross-Thread Return
  Address Predictions (XSA-426)
  63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch</changelog>
  <changelog author="carnold@suse.com" date="1678190400">- bsc#1209017 - VUL-0: CVE-2022-42332: xen: x86 shadow plus
  log-dirty mode use-after-free (XSA-427)
  xsa427.patch
- bsc#1209018 - VUL-0: CVE-2022-42333,CVE-2022-42334: xen: x86/HVM
  pinned cache attributes mis-handling (XSA-428)
  xsa428-1.patch
  xsa428-2.patch
- bsc#1209019 - VUL-0: CVE-2022-42331: xen: x86: speculative
  vulnerability in 32bit SYSCALL path (XSA-429)
  xsa429.patch</changelog>
</package>
<package pkgid="242ecb73cddeaee6268b05e65798031d48eaff7b57c309f6bf37204d1223f010" name="xen-libs" arch="x86_64">
  <version epoch="0" ver="4.16.3_02" rel="150400.4.19.1"/>
  <changelog author="carnold@suse.com" date="1649851200">- Update to Xen 4.16.1 bug fix release (bsc#1027519)
  xen-4.16.1-testing-src.tar.bz2
- Drop patches contained in new tarball
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  61d6ea2d-VT-d-split-domid-map-cleanup-check-into-a-function.patch
  61d6ea7b-VT-d-dont-leak-domid-mapping-on-error-path.patch
  61e0296a-x86-time-calibration-relative-counts.patch
  61e029c8-x86-time-TSC-freq-calibration-accuracy.patch
  61e02a1c-libxl-PCI-PV-hotplug-stubdom-coldplug.patch
  61e98e88-x86-introduce-get-set-reg-infra.patch
  61e98e89-x86-MSR-split-SPEC_CTRL-handling.patch
  61e98e8a-x86-spec-ctrl-drop-ENTRY-EXIT-HVM.patch
  61e98e8b-VT-x-SPEC_CTRL-NMI-race-condition.patch
  61eaaa23-x86-get-set-reg-infra-build.patch
  61efec1d-Arm-P2M-always-clear-entry-on-mapping-removal.patch
  61efec4d-gnttab-only-decrement-refcounter-on-final-unmap.patch
  61efec96-IOMMU-x86-stop-pirq-iteration-immediately-on-error.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  6229ba46-VT-d-drop-undue-address-of-from-check_cleanup_domid_map.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch
  xsa400-12.patch</changelog>
  <changelog author="dmueller@suse.com" date="1652184000">- fix python3 &gt;= 3.10 version detection</changelog>
  <changelog author="jbeulich@suse.com" date="1653998400">- Upstream bug fixes (bsc#1027519)
  625fca42-VT-d-reserved-CAP-ND.patch
  626f7ee8-x86-MSR-handle-P5-MC-reads.patch
  627549d6-IO-shutdown-race.patch
- bsc#1199965 - VUL-0: EMBARGOED: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  xsa401-1.patch
  xsa401-2.patch
- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="schubi@suse.com" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch
- Fix gcc13 compilation error
  62c56cc0-libxc-fix-compilation-error-with-gcc13.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657713600">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ed-x86-honour-spec-ctrl-0-for-unpriv-mmio.patch
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62a99614-IOMMU-x86-gcc12.patch
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657713601">- Added --disable-pvshim when running configure in xen.spec.
  We have never shipped the shim and don't need to build it.</changelog>
  <changelog author="ohering@suse.de" date="1659009600">- bsc#1167608, bsc#1201631 - fix built-in default of max_event_channels
  A previous change to the built-in default had a logic error,
  effectively restoring the upstream limit of 1023 channels per domU.
  Fix the logic to calculate the default based on the number of vcpus.
  adjust libxl.max_event_channels.patch</changelog>
  <changelog author="carnold@suse.com" date="1660824000">- Update to Xen 4.16.2 bug fix release (bsc#1027519)
  xen-4.16.2-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Drop patches contained in new tarball
  625fca42-VT-d-reserved-CAP-ND.patch
  626f7ee8-x86-MSR-handle-P5-MC-reads.patch
  627549d6-IO-shutdown-race.patch
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
  62a99614-IOMMU-x86-gcc12.patch
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
  62c56cc0-libxc-fix-compilation-error-with-gcc13.patch
  62cc31ed-x86-honour-spec-ctrl-0-for-unpriv-mmio.patch
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
  xsa408.patch</changelog>
  <changelog author="carnold@suse.com" date="1661256000">- Things are compiling fine now with gcc12.
  Drop gcc12-fixes.patch</changelog>
  <changelog author="carnold@suse.com" date="1661774400">- bsc#1201994 - Xen DomU unable to emulate audio device
  62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch</changelog>
  <changelog author="carnold@suse.com" date="1664366400">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180800">- bsc#1204483 - VUL-0: CVE-2022-42327: xen: x86: unintended memory
  sharing between guests (XSA-412)
  xsa412.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180801">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
- bsc#1204485 - VUL-0: CVE-2022-42309: xen: Xenstore: Guests can
  crash xenstored (XSA-414)
  xsa414.patch
- bsc#1204487 - VUL-0: CVE-2022-42310: xen: Xenstore: Guests can
  create orphaned Xenstore nodes (XSA-415)
  xsa415.patch
- bsc#1204488 - VUL-0: CVE-2022-42319: xen: Xenstore: Guests can
  cause Xenstore to not free temporary memory (XSA-416)
  xsa416.patch
- bsc#1204489 - VUL-0: CVE-2022-42320: xen: Xenstore: Guests can
  get access to Xenstore nodes of deleted domains (XSA-417)
  xsa417.patch
- bsc#1204490 - VUL-0: CVE-2022-42321: xen: Xenstore: Guests can
  crash xenstored via exhausting the stack (XSA-418)
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
  xsa418-07.patch
- bsc#1204494 - VUL-0: CVE-2022-42322,CVE-2022-42323: xen:
  Xenstore: cooperating guests can create arbitrary numbers of
  nodes (XSA-419)
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
- bsc#1204496 - VUL-0: CVE-2022-42325,CVE-2022-42326: xen:
  Xenstore: Guests can create arbitray number of nodes via
  transactions (XSA-421)
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699200">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
- bcs#1203804 - VUL-0: CVE-2022-33747: xen: unbounded memory consumption
  for 2nd-level page tables on ARM systems (XSA-409)
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
- Upstream bug fixes (bsc#1027519)
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  631b5ba6-gnttab-acquire-resource-vaddrs.patch
  634561f1-x86emul-respect-NSCB.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
- Drop patches replaced by upstream versions:
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666958400">- bsc#1193923 - VUL-1: xen: Frontends vulnerable to backends
  (XSA-376)
  61dd5f64-limit-support-statement-for-Linux-and-Windows-frontends.patch</changelog>
  <changelog author="carnold@suse.com" date="1668081600">- bsc#1205209 - VUL-0: CVE-2022-23824: xen: x86: Multiple
  speculative security issues (XSA-422)
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch</changelog>
  <changelog author="carnold@suse.com" date="1671451200">- Update to Xen 4.16.3 bug fix release (bsc#1027519)
  xen-4.16.3-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Drop patches contained in new tarball
  62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  631b5ba6-gnttab-acquire-resource-vaddrs.patch
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
  634561f1-x86emul-respect-NSCB.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
  xsa412.patch
  xsa414.patch
  xsa415.patch
  xsa416.patch
  xsa417.patch
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
  xsa418-07.patch
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1671537600">- Upstream bug fixes (bsc#1027519)
  63a03e28-x86-high-freq-TSC-overflow.patch</changelog>
</package>
<package pkgid="43b3a342ed8eedf5bee7318a8e6bbe2de2c55ba3cf77cbf29808c4cc0bbb1747" name="xen-libs" arch="x86_64">
  <version epoch="0" ver="4.16.3_04" rel="150400.4.22.1"/>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="schubi@suse.com" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch
- Fix gcc13 compilation error
  62c56cc0-libxc-fix-compilation-error-with-gcc13.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657713600">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ed-x86-honour-spec-ctrl-0-for-unpriv-mmio.patch
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62a99614-IOMMU-x86-gcc12.patch
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657713601">- Added --disable-pvshim when running configure in xen.spec.
  We have never shipped the shim and don't need to build it.</changelog>
  <changelog author="ohering@suse.de" date="1659009600">- bsc#1167608, bsc#1201631 - fix built-in default of max_event_channels
  A previous change to the built-in default had a logic error,
  effectively restoring the upstream limit of 1023 channels per domU.
  Fix the logic to calculate the default based on the number of vcpus.
  adjust libxl.max_event_channels.patch</changelog>
  <changelog author="carnold@suse.com" date="1660824000">- Update to Xen 4.16.2 bug fix release (bsc#1027519)
  xen-4.16.2-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Drop patches contained in new tarball
  625fca42-VT-d-reserved-CAP-ND.patch
  626f7ee8-x86-MSR-handle-P5-MC-reads.patch
  627549d6-IO-shutdown-race.patch
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
  62a99614-IOMMU-x86-gcc12.patch
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
  62c56cc0-libxc-fix-compilation-error-with-gcc13.patch
  62cc31ed-x86-honour-spec-ctrl-0-for-unpriv-mmio.patch
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
  xsa408.patch</changelog>
  <changelog author="carnold@suse.com" date="1661256000">- Things are compiling fine now with gcc12.
  Drop gcc12-fixes.patch</changelog>
  <changelog author="carnold@suse.com" date="1661774400">- bsc#1201994 - Xen DomU unable to emulate audio device
  62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch</changelog>
  <changelog author="carnold@suse.com" date="1664366400">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180800">- bsc#1204483 - VUL-0: CVE-2022-42327: xen: x86: unintended memory
  sharing between guests (XSA-412)
  xsa412.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180801">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
- bsc#1204485 - VUL-0: CVE-2022-42309: xen: Xenstore: Guests can
  crash xenstored (XSA-414)
  xsa414.patch
- bsc#1204487 - VUL-0: CVE-2022-42310: xen: Xenstore: Guests can
  create orphaned Xenstore nodes (XSA-415)
  xsa415.patch
- bsc#1204488 - VUL-0: CVE-2022-42319: xen: Xenstore: Guests can
  cause Xenstore to not free temporary memory (XSA-416)
  xsa416.patch
- bsc#1204489 - VUL-0: CVE-2022-42320: xen: Xenstore: Guests can
  get access to Xenstore nodes of deleted domains (XSA-417)
  xsa417.patch
- bsc#1204490 - VUL-0: CVE-2022-42321: xen: Xenstore: Guests can
  crash xenstored via exhausting the stack (XSA-418)
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
  xsa418-07.patch
- bsc#1204494 - VUL-0: CVE-2022-42322,CVE-2022-42323: xen:
  Xenstore: cooperating guests can create arbitrary numbers of
  nodes (XSA-419)
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
- bsc#1204496 - VUL-0: CVE-2022-42325,CVE-2022-42326: xen:
  Xenstore: Guests can create arbitray number of nodes via
  transactions (XSA-421)
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699200">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
- bcs#1203804 - VUL-0: CVE-2022-33747: xen: unbounded memory consumption
  for 2nd-level page tables on ARM systems (XSA-409)
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
- Upstream bug fixes (bsc#1027519)
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  631b5ba6-gnttab-acquire-resource-vaddrs.patch
  634561f1-x86emul-respect-NSCB.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
- Drop patches replaced by upstream versions:
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666958400">- bsc#1193923 - VUL-1: xen: Frontends vulnerable to backends
  (XSA-376)
  61dd5f64-limit-support-statement-for-Linux-and-Windows-frontends.patch</changelog>
  <changelog author="carnold@suse.com" date="1668081600">- bsc#1205209 - VUL-0: CVE-2022-23824: xen: x86: Multiple
  speculative security issues (XSA-422)
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch</changelog>
  <changelog author="carnold@suse.com" date="1671451200">- Update to Xen 4.16.3 bug fix release (bsc#1027519)
  xen-4.16.3-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Drop patches contained in new tarball
  62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  631b5ba6-gnttab-acquire-resource-vaddrs.patch
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
  634561f1-x86emul-respect-NSCB.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
  xsa412.patch
  xsa414.patch
  xsa415.patch
  xsa416.patch
  xsa417.patch
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
  xsa418-07.patch
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1671537600">- Upstream bug fixes (bsc#1027519)
  63a03e28-x86-high-freq-TSC-overflow.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1675684800">- Upstream bug fixes (bsc#1027519)
  63c05478-VMX-calculate-model-specific-LBRs-once.patch
  63c05478-VMX-support-CPUs-without-model-specific-LBR.patch</changelog>
  <changelog author="carnold@suse.com" date="1675944000">- bsc#1205792 - Partner-L3: launch-xenstore error messages show in
  SLES15 SP4 xen kernel.
  63e4da00-dont-log-errors-when-trying-to-load-PVH-xenstore-stubdom.patch</changelog>
  <changelog author="carnold@suse.com" date="1676462400">- bsc#1208286 - VUL-0: CVE-2022-27672: xen: Cross-Thread Return
  Address Predictions (XSA-426)
  63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch</changelog>
</package>
<package pkgid="4dea380890b9958efb875c1dd5022eb83e558aac21984f745af1419e0d527ac6" name="xen-libs" arch="x86_64">
  <version epoch="0" ver="4.16.3_06" rel="150400.4.25.1"/>
  <changelog author="schubi@suse.com" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch
- Fix gcc13 compilation error
  62c56cc0-libxc-fix-compilation-error-with-gcc13.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657713600">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ed-x86-honour-spec-ctrl-0-for-unpriv-mmio.patch
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62a99614-IOMMU-x86-gcc12.patch
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657713601">- Added --disable-pvshim when running configure in xen.spec.
  We have never shipped the shim and don't need to build it.</changelog>
  <changelog author="ohering@suse.de" date="1659009600">- bsc#1167608, bsc#1201631 - fix built-in default of max_event_channels
  A previous change to the built-in default had a logic error,
  effectively restoring the upstream limit of 1023 channels per domU.
  Fix the logic to calculate the default based on the number of vcpus.
  adjust libxl.max_event_channels.patch</changelog>
  <changelog author="carnold@suse.com" date="1660824000">- Update to Xen 4.16.2 bug fix release (bsc#1027519)
  xen-4.16.2-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Drop patches contained in new tarball
  625fca42-VT-d-reserved-CAP-ND.patch
  626f7ee8-x86-MSR-handle-P5-MC-reads.patch
  627549d6-IO-shutdown-race.patch
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
  62a99614-IOMMU-x86-gcc12.patch
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
  62c56cc0-libxc-fix-compilation-error-with-gcc13.patch
  62cc31ed-x86-honour-spec-ctrl-0-for-unpriv-mmio.patch
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
  xsa408.patch</changelog>
  <changelog author="carnold@suse.com" date="1661256000">- Things are compiling fine now with gcc12.
  Drop gcc12-fixes.patch</changelog>
  <changelog author="carnold@suse.com" date="1661774400">- bsc#1201994 - Xen DomU unable to emulate audio device
  62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch</changelog>
  <changelog author="carnold@suse.com" date="1664366400">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180800">- bsc#1204483 - VUL-0: CVE-2022-42327: xen: x86: unintended memory
  sharing between guests (XSA-412)
  xsa412.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180801">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
- bsc#1204485 - VUL-0: CVE-2022-42309: xen: Xenstore: Guests can
  crash xenstored (XSA-414)
  xsa414.patch
- bsc#1204487 - VUL-0: CVE-2022-42310: xen: Xenstore: Guests can
  create orphaned Xenstore nodes (XSA-415)
  xsa415.patch
- bsc#1204488 - VUL-0: CVE-2022-42319: xen: Xenstore: Guests can
  cause Xenstore to not free temporary memory (XSA-416)
  xsa416.patch
- bsc#1204489 - VUL-0: CVE-2022-42320: xen: Xenstore: Guests can
  get access to Xenstore nodes of deleted domains (XSA-417)
  xsa417.patch
- bsc#1204490 - VUL-0: CVE-2022-42321: xen: Xenstore: Guests can
  crash xenstored via exhausting the stack (XSA-418)
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
  xsa418-07.patch
- bsc#1204494 - VUL-0: CVE-2022-42322,CVE-2022-42323: xen:
  Xenstore: cooperating guests can create arbitrary numbers of
  nodes (XSA-419)
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
- bsc#1204496 - VUL-0: CVE-2022-42325,CVE-2022-42326: xen:
  Xenstore: Guests can create arbitray number of nodes via
  transactions (XSA-421)
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699200">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
- bcs#1203804 - VUL-0: CVE-2022-33747: xen: unbounded memory consumption
  for 2nd-level page tables on ARM systems (XSA-409)
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
- Upstream bug fixes (bsc#1027519)
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  631b5ba6-gnttab-acquire-resource-vaddrs.patch
  634561f1-x86emul-respect-NSCB.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
- Drop patches replaced by upstream versions:
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666958400">- bsc#1193923 - VUL-1: xen: Frontends vulnerable to backends
  (XSA-376)
  61dd5f64-limit-support-statement-for-Linux-and-Windows-frontends.patch</changelog>
  <changelog author="carnold@suse.com" date="1668081600">- bsc#1205209 - VUL-0: CVE-2022-23824: xen: x86: Multiple
  speculative security issues (XSA-422)
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch</changelog>
  <changelog author="carnold@suse.com" date="1671451200">- Update to Xen 4.16.3 bug fix release (bsc#1027519)
  xen-4.16.3-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Drop patches contained in new tarball
  62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  631b5ba6-gnttab-acquire-resource-vaddrs.patch
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
  634561f1-x86emul-respect-NSCB.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
  xsa412.patch
  xsa414.patch
  xsa415.patch
  xsa416.patch
  xsa417.patch
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
  xsa418-07.patch
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1671537600">- Upstream bug fixes (bsc#1027519)
  63a03e28-x86-high-freq-TSC-overflow.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1675684800">- Upstream bug fixes (bsc#1027519)
  63c05478-VMX-calculate-model-specific-LBRs-once.patch
  63c05478-VMX-support-CPUs-without-model-specific-LBR.patch</changelog>
  <changelog author="carnold@suse.com" date="1675944000">- bsc#1205792 - Partner-L3: launch-xenstore error messages show in
  SLES15 SP4 xen kernel.
  63e4da00-dont-log-errors-when-trying-to-load-PVH-xenstore-stubdom.patch</changelog>
  <changelog author="carnold@suse.com" date="1676462400">- bsc#1208286 - VUL-0: CVE-2022-27672: xen: Cross-Thread Return
  Address Predictions (XSA-426)
  63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch</changelog>
  <changelog author="carnold@suse.com" date="1678190400">- bsc#1209017 - VUL-0: CVE-2022-42332: xen: x86 shadow plus
  log-dirty mode use-after-free (XSA-427)
  xsa427.patch
- bsc#1209018 - VUL-0: CVE-2022-42333,CVE-2022-42334: xen: x86/HVM
  pinned cache attributes mis-handling (XSA-428)
  xsa428-1.patch
  xsa428-2.patch
- bsc#1209019 - VUL-0: CVE-2022-42331: xen: x86: speculative
  vulnerability in 32bit SYSCALL path (XSA-429)
  xsa429.patch</changelog>
</package>
<package pkgid="3ed300fec4bfa7d4693bb28baf691948bec198d730b95fa2e1726033fcad26ce" name="xfsprogs" arch="aarch64">
  <version epoch="0" ver="5.13.0" rel="150400.3.3.1"/>
  <changelog author="jeffm@suse.com" date="1540036800">- Update to v4.18.0
  * xfs_repair: notify user if free inodes are corrupt
  * xfs_repair: use extent size validation helpers
  * xfs_quota: don't stop the directory tree walk at DEPTH
  * xfs_scrub: ongoing updates
  * xfs_io: document shutdown -f
  * xfs_io: wire up online repair ioctls
  * misc: adddebian initramfs hook to package
  * misc: remove unused macros
  * misc: remove many XFS_BUF macros
  * Majority of 4.18 libxfs changes merged from kernel
- Update to v4.17.0
  * mkfs.xfs: only stat block devices during mkfs init
  * xfs_repair: multiple fixes and improvements
  * xfs_repair: check and repair quota metadata
  * xfs_repair: fix shortform root inode parent
  * xfs_db: don't ASSERT on unrecognized metadata
  * xfs_db: add superblock info command ala xfs_info
  * xfs_spaceman: add superblock info command ala xfs_info
  * xfs_info: call xfs_db for unmounted devices
  * xfs_io: add online label command
  * xfs_io: add O_PATH and O_NOFOLLOW options
  * xfs_io: recognize *iB units in copy_range
- Removed now-obsolete patches:
  * xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch</changelog>
  <changelog author="sean@suspend.net" date="1541851200">- Update to v4.19.0
  * Fix up debian subdir build w.r.t. CHECK_CMD
  * Remove non-linux platforms
  * Remove retpoline support
  * Add sparse checking &amp; related fixes/cleanups
  * Fix cross-platform building w.r.t. crc32selftest
  * libxfs: add agfl free deferred op type
  * mkfs.xfs: discard only after all validations
  * xfs_repair: fix segfault in longform_dir2_entry_check
  * xfs_repair: fix ASSERT in xfs_bunmapi
  * xfs_repair: fix redahead thread deadlock/stall
  * xfs_repair: avoid wriing back all inodes
  * xfs_repair: don't treat directory root LEAFN as corrupt
  * xfs_io: add crc32 self test
  * xfs_io: remove useless do_preadv and do_pwritev arguments
  * xfs_scrub: make scrub build config-optional
  * xfs_scrub: lack of kernel support is not a service failure
  * xfs_scrub_all: fix systemd escaping
  * majority of 4.19 libxfs changes merged from kernel
  * big sparse static checker cleanup
  * mkfs.xfs discard fixes
  * xfs_io readv/writev cleanup
  * libxfs transaction commit error checking</changelog>
  <changelog author="seanlew@opensuse.org" date="1550923200">- Update to v4.20.0
  * mkfs.xfs: null-term symlinks created via protofile
  * xfs_repair: allow '.' in attribute names
  * xfs_repair: skip block reservations when fixing freelist
  * xfs_repair: rebuild dir when nonroot blocks corrupt
  * xfs_repair: int nonleaf finobt blocks with proper magic
  * xfs_repair: fix off by one error rebuilding high keys
  * xfs_io: allow open file permissions to be changed
  * xfs_io: open pipes in non-blocking mode
  * xfs_metadump: multiple stale data zeroing fixes
  * xfs_quota: allow reg files w/o prjinherit flag
  * xfs_db: properly decode finobt record w/ sparse inodes
  * xfs_scrub: move all eecutables to /usr/sbin
  * xfs_scrub: handle totally empty inode chunks
  * xfs.5 manpage: remove barrier related options
  * xfs_io.8 manpage: rearrange command listings by section
  * remove generated scrub files under make clean
  * skip scrub manpage install if not configured
  * Merge libxfs from kernel 4.20</changelog>
  <changelog author="seanlew@opensuse.org" date="1556971200">- Update to v5.0.0
  * xfs_db: scan all sparse inodes when using 'frag'
  * Fix build with newer statx headers
  * libxfs: fix buffer &amp; inode lifetimes
  * misc: fix strncpy length complaints from gcc
  * Merge libxfs from kernel 5.0</changelog>
  <changelog author="coolo@suse.com" date="1566043200">- update to v5.2.0
  - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen)
  - libxfs changes merged from kernel 5.2
  - mkfs: enable reflink by default (Darrick Wong)
  - mkfs: fix stripe unit handling (Allison Collins)
  - mkfs: remove useless log options in usage() (Yang Xu)
  - mkfs: validate start and end of aligned logs (Darrick Wong)
  - xfs_quota: fix built-in help for project setup (Eric Sandeen)
  - xfs_io: allow passing an open file to copy_range (Amir Goldstein)
  - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein)
  - man: break out several ioctl man pages (Darrick Wong)
  - man: Fix an inconsistency in the mkfs man page (Alvin Zheng)
  - xfs_scrub: fix background-mode sleep throttling (Darrick Wong)
  - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen)
  - libfrog: fix bitmap return values (Darrick Wong)
  - libfrog: don't set negative errno in conversion f'ns (Darrick Wong)</changelog>
  <changelog author="seanlew@opensuse.org" date="1575547200">- update to v.5.3.0
  * mkfs.xfs: use libfx to write out AGs versus open coding
  * mkfs.xfs: fix incorrect error message during AG init
  * xfs_repair: better info when metadata updates fail
  * xfs_growfs: allow mounted device node as argument
  * xfs_spaceman: always report sick metadata
  * xfs_io: add a bulkstat command
  * xfs_io: encrypt command enhancements
  * xfs_io: copy_file_range fixes
  * man: document several new ioctls
  * xfs_scrub: copious rewriting
  * libfrog: header moves, refactoring, updates
  * libxfs: fix buffer refcounting</changelog>
  <changelog author="ailiopoulos@suse.com" date="1579003200">- update to v5.4.0:
  * xfsprogs: Release v5.4.0
  * xfsprogs: Release v5.4.0-rc1
  * mkfs: tidy up discard notifications
  * mkfs: Break block discard into chunks of 2 GB
  * xfs_admin: enable online label getting and setting
  * xfs_admin: support external log devices
  * xfsprogs: add missing line feeds in libxfs/rdwr.c
  * xfsprogs: remove stray libxfs whitespace
  * xfsprogs: Release v5.4.0-rc0
  * xfs: change the seconds fields in xfs_bulkstat to signed
  * xfs: move local to extent inode logging into bmap helper
  * xfs: remove broken error handling on failed attr sf to leaf change
  * xfs: log the inode on directory sf to block format change
  * xfs: remove unused flags arg from xfs_get_aghdr_buf()
  * xfs: log proper length of superblock
  * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag")
  * xfs: convert inode to extent format after extent merge due to shift
  * xfs: define a flags field for the AG geometry ioctl structure
  * xfs: add a xfs_valid_startblock helper
  * xfs: remove the unused XFS_ALLOC_USERDATA flag
  * xfs: allocate xattr buffer on demand
  * xfs: consolidate attribute value copying
  * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue
  * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue
  * xfs: make attr lookup returns consistent
  * xfs: reverse search directory freespace indexes
  * xfs: speed up directory bestfree block scanning
  * xfs: factor free block index lookup from xfs_dir2_node_addname_int()
  * xfs: factor data block addition from xfs_dir2_node_addname_int()
  * xfs: move xfs_dir2_addname()
  * xfs: remove all *_ITER_CONTINUE values
  * xfs: remove all *_ITER_ABORT values
  * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec
  * xfs: remove unnecessary int returns from deferred bmap functions
  * xfs: remove unnecessary int returns from deferred refcount functions
  * xfs: remove unnecessary int returns from deferred rmap functions
  * xfs: remove unnecessary parameter from xfs_iext_inc_seq
  * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys
  * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys
  * xfs: fix maxicount division by zero error
  * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify'
  * xfs: add kmem allocation trace points
  * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP.</changelog>
  <changelog author="ailiopoulos@suse.com" date="1579003201">- split xfs scrubbing scripts and service files into a separate optional
  package, in order to avoid having python as a dependency in the main
  xfsprogs rpm (bsc#1157438).</changelog>
  <changelog author="ailiopoulos@suse.com" date="1584187200">- update to v5.5.0:
  * xfsprogs: actually check that writes succeeded
  * mkfs.xfs: check root inode location
  * mkfs.xfs: efficient block zeroing
  * xfs_repair: fix broken unit conv. in dir invalidation
  * xfs_repair: fix bad next_unlinked field
  * xfs_repair: don't corrupt attr fork clearing forw/back
  * xfs_repair: check root dir pointer before trashing it
  * xfs_repair: try to fix sb_unit value from secondaries
  * libxfs changes merged from kernel 5.5</changelog>
  <changelog author="ailiopoulos@suse.com" date="1586952000">- update to v5.6.0:
  * xfs_scrub: don't set WorkingDirectory in systemd job
  * xfsprogs: fix silently broken option parsing
  * xfsprogs: various minor Coverity fixes
  * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf
  * libxfs: check retval of device flush when closing
  * xfs_io: set exitcode on failure appropriately
  * libxfs changes merged from kernel 5.6</changelog>
  <changelog author="ailiopoulos@suse.com" date="1595592000">- update to v5.7.0:
  * xfs_io: document '-q' option for sendfile command
  * remove libreadline support
  * xfs_quota: allow individual timer extension
  * xfs_quota: fix unsigned int id comparisons
  * xfs_repair: fix progress reporting
  * xfs_repair: fix minrecs error during phase5 btree rebuild
  * xfs_repair: add missing validations to match xfs_check
  * xfs_repair: use btree bulk loading
  * xfs_io: fix copy_range argument parsing
  * xfs_io: document -q option for pread/pwrite command
  * xfs_metadump: man page fixes
  * xfs_db: fix crc invalidation segfault
  * libxfs changes merged from kernel 5.7</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="ailiop@suse.com" date="1599480000">- update to v5.8.0:
  * xfs_db: set b_ops to NULL for types without verifiers
  * mkfs: allow setting dax flag on root directory
  * xfs_quota: improve reporting and messages
  * xfs_db: use correct inode to set inode type
  * xfs_db: fix nlink usage in check
  * xfs_db: report the inode dax flag
  * man: update mkfs.xfs inode flag option documentation
  * xfsprogs: move custom interface def'ns to new header
  * xfs_repair: check quota counters
  * xfs_io: fix -D vs -R handling
  * libxfs changes merged from kernel 5.8</changelog>
  <changelog author="ailiop@suse.com" date="1603195200">- update to v5.9.0:
  * mkfs.xfs: disallow creation of RT files from proto file
  * mkfs.xfs: fix ASSERT on small device with stripe geom
  * xfs_repair: more fixes from fuzz-testing
  * libhandle: fix potential unterminated string problem
  * libhandle: libfrog: fix a potential null pointer deref
  * man: install all manpages that redirect to another page
  * man: fix ioctl_xfs_geometry manpage naming
  * xfsprogs: various realtime related fixes
  * xfsprogs: ignore autofs mount table entries
  * libxfs: make buffers track the per-ag structures
  * libxfs changes merged from kernel 5.9</changelog>
  <changelog author="dmueller@suse.com" date="1609761600">- update to 5.10.0:
  - xfs_repair: remove old code for mountpoint inodes
  - xfsprogs: Add inode btree counter feature
  - xfsprogs: Add bigtime feature for Y2038
  - xfsprogs: Polish translation update
  - mkfs.xfs: Add config file feature
  - mkfs.xfs: allow users to specify rtinherit=0
  - xfs_repair: simplify bmap_next_offset
  - man: various manpage updates
  - libxfs: remove some old dead code
  - libxfs: add realtime extent tracking
  - libxfs changes merged from kernel 5.10
- refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch
  against libxfs changes</changelog>
  <changelog author="ailiop@suse.com" date="1615636800">- update to v5.11.0:
  - xfs_admin: don't hide xfs_repair output when upgrading
  - man: document attr2, ikeep option deprecation in xfs.5
  - mkfs: make use of xfs_validate_stripe_geometry()
  - mkfs: fix wrong inobtcount usage error output
  - xfs_repair: enable bigtime upgrade via repair
  - xfs_repair: enable inobtcount upgrade via repair
  - xfs_repair: set NEEDSREPAIR on first write
  - xfs_repair: clear the needsrepair flag when done
  - xfs_repair: check dquot id and type
  - xfs_fsr: Verify bulkstat version in qsort's cmp()
  - xfs_fsr: Interpret args of qsort's cmp() correctly
  - xfs_scrub: load and unload libicu properly
  - xfs_scrub: various fixes
  - xfs_admin: support adding features to V5 filesystems
  - xfs_admin: support filesystems with realtime devices
  - man: mark all deprecated V4 format options
  - misc: fix valgrind complaints
  - xfs_db: disallow label/uuid setting if NEEDSREPAIR
  - xfs_db: show NEEDSREPAIR in check &amp; version commands
  - xfs_db: add an ls command
  - xfs_db: add a directory path lookup command
  - libxfs changes merged from kernel 5.11</changelog>
  <changelog author="ailiop@suse.com" date="1621944000">- update to v5.12.0:
  - mkfs: don't default to too-large physical sector size
  - repair: phase 6 speedups
  - man: Add dax mount option to man xfs(5)
  - xfs_admin: pick up log arguments correctly
  - xfs_growfs: support shrinking unused space
  - libfrog: report inobtcount in geometry
  - xfs_logprint: Fix buffer overflow printing quotaoff
  - xfsprogs: include &lt;signal.h&gt; for platform_crash
  - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag
  - workqueue: bound maximum queue depth
  - libxfs changes merged from kernel 5.12</changelog>
  <changelog author="ailiop@suse.com" date="1627473600">- mkfs: disable reflink support by default (jsc#SLE-17360)
  - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch
  Do not format xfs filesystems with reflink support by default, as the
  feature is read-only compatible, and read-write compatibility is
  required to be maintained within product stream (SLE15).
- Dropped all following patches which are now part of upstream xfsprogs,
  and were previously backported to address bugs bsc#1167206,
  bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758,
  bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068.
  make_xfs_scrub_interp_explicit.patch
  xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch
  xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch
  xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch
  xfsprogs-xfs_repair-allow-in-attribute-names.patch
  xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch
  xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch
  xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch
  xfsprogs-xfs_info-move-to-xfs_spaceman.patch
  xfsprogs-xfs_db-add-a-superblock-info-command.patch
  xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch
  xfsprogs-mkfs-use-geometry-generation-helper-functions.patch
  xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch
  xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch
  xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch
  xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch
  xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch
  xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch
  xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch
  xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch
  xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch
  xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch
  xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch
  xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch
  xfsprogs-mkfs-validate-extent-size-hint-parameters.patch
  xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch
  xfsprogs-man-document-some-missing-xfs_db-commands.patch
  xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch</changelog>
  <changelog author="ailiop@suse.com" date="1629633600">- update to v5.13.0:
  - mkfs: validate rtextsz hint when rtinherit is set
  - xfs_repair: invalidate dirhash when junking dirent
  - xfs_repair: validate inherited rtextsz hint alignmt
  - xfs_quota: allow truncate of grp &amp; prj quota files
  - xfs_io: allow callers to dump fs stats individually
  - xfs_io: don't count fsmaps before querying fsmaps
  - xfs_io: print header once when dumping fsmap in csv
  - xfs_io: clean up the funshare command a bit
  - xfs_io: fix broken funshare_cmd usage
  - libxfs changes merged from kernel 5.13</changelog>
  <changelog author="ailiop@suse.com" date="1668340800">- mkfs: don't trample the gid set in the protofile (bsc#1205266)
  - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch
- mkfs: prevent corruption of passed-in suboption string values
  (bsc#1205377)
  - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch
- mkfs: terminate getsubopt arrays properly (bsc#1205284)
  - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch
- xfs_repair: ignore empty xattr leaf blocks (bsc#1205272)
  - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch</changelog>
</package>
<package pkgid="43e547ca2a2a678efed4802937cc0637114118252f616b65872b7635a36f0abb" name="xfsprogs" arch="src">
  <version epoch="0" ver="5.13.0" rel="150400.3.3.1"/>
  <changelog author="jeffm@suse.com" date="1540036800">- Update to v4.18.0
  * xfs_repair: notify user if free inodes are corrupt
  * xfs_repair: use extent size validation helpers
  * xfs_quota: don't stop the directory tree walk at DEPTH
  * xfs_scrub: ongoing updates
  * xfs_io: document shutdown -f
  * xfs_io: wire up online repair ioctls
  * misc: adddebian initramfs hook to package
  * misc: remove unused macros
  * misc: remove many XFS_BUF macros
  * Majority of 4.18 libxfs changes merged from kernel
- Update to v4.17.0
  * mkfs.xfs: only stat block devices during mkfs init
  * xfs_repair: multiple fixes and improvements
  * xfs_repair: check and repair quota metadata
  * xfs_repair: fix shortform root inode parent
  * xfs_db: don't ASSERT on unrecognized metadata
  * xfs_db: add superblock info command ala xfs_info
  * xfs_spaceman: add superblock info command ala xfs_info
  * xfs_info: call xfs_db for unmounted devices
  * xfs_io: add online label command
  * xfs_io: add O_PATH and O_NOFOLLOW options
  * xfs_io: recognize *iB units in copy_range
- Removed now-obsolete patches:
  * xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch</changelog>
  <changelog author="sean@suspend.net" date="1541851200">- Update to v4.19.0
  * Fix up debian subdir build w.r.t. CHECK_CMD
  * Remove non-linux platforms
  * Remove retpoline support
  * Add sparse checking &amp; related fixes/cleanups
  * Fix cross-platform building w.r.t. crc32selftest
  * libxfs: add agfl free deferred op type
  * mkfs.xfs: discard only after all validations
  * xfs_repair: fix segfault in longform_dir2_entry_check
  * xfs_repair: fix ASSERT in xfs_bunmapi
  * xfs_repair: fix redahead thread deadlock/stall
  * xfs_repair: avoid wriing back all inodes
  * xfs_repair: don't treat directory root LEAFN as corrupt
  * xfs_io: add crc32 self test
  * xfs_io: remove useless do_preadv and do_pwritev arguments
  * xfs_scrub: make scrub build config-optional
  * xfs_scrub: lack of kernel support is not a service failure
  * xfs_scrub_all: fix systemd escaping
  * majority of 4.19 libxfs changes merged from kernel
  * big sparse static checker cleanup
  * mkfs.xfs discard fixes
  * xfs_io readv/writev cleanup
  * libxfs transaction commit error checking</changelog>
  <changelog author="seanlew@opensuse.org" date="1550923200">- Update to v4.20.0
  * mkfs.xfs: null-term symlinks created via protofile
  * xfs_repair: allow '.' in attribute names
  * xfs_repair: skip block reservations when fixing freelist
  * xfs_repair: rebuild dir when nonroot blocks corrupt
  * xfs_repair: int nonleaf finobt blocks with proper magic
  * xfs_repair: fix off by one error rebuilding high keys
  * xfs_io: allow open file permissions to be changed
  * xfs_io: open pipes in non-blocking mode
  * xfs_metadump: multiple stale data zeroing fixes
  * xfs_quota: allow reg files w/o prjinherit flag
  * xfs_db: properly decode finobt record w/ sparse inodes
  * xfs_scrub: move all eecutables to /usr/sbin
  * xfs_scrub: handle totally empty inode chunks
  * xfs.5 manpage: remove barrier related options
  * xfs_io.8 manpage: rearrange command listings by section
  * remove generated scrub files under make clean
  * skip scrub manpage install if not configured
  * Merge libxfs from kernel 4.20</changelog>
  <changelog author="seanlew@opensuse.org" date="1556971200">- Update to v5.0.0
  * xfs_db: scan all sparse inodes when using 'frag'
  * Fix build with newer statx headers
  * libxfs: fix buffer &amp; inode lifetimes
  * misc: fix strncpy length complaints from gcc
  * Merge libxfs from kernel 5.0</changelog>
  <changelog author="coolo@suse.com" date="1566043200">- update to v5.2.0
  - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen)
  - libxfs changes merged from kernel 5.2
  - mkfs: enable reflink by default (Darrick Wong)
  - mkfs: fix stripe unit handling (Allison Collins)
  - mkfs: remove useless log options in usage() (Yang Xu)
  - mkfs: validate start and end of aligned logs (Darrick Wong)
  - xfs_quota: fix built-in help for project setup (Eric Sandeen)
  - xfs_io: allow passing an open file to copy_range (Amir Goldstein)
  - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein)
  - man: break out several ioctl man pages (Darrick Wong)
  - man: Fix an inconsistency in the mkfs man page (Alvin Zheng)
  - xfs_scrub: fix background-mode sleep throttling (Darrick Wong)
  - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen)
  - libfrog: fix bitmap return values (Darrick Wong)
  - libfrog: don't set negative errno in conversion f'ns (Darrick Wong)</changelog>
  <changelog author="seanlew@opensuse.org" date="1575547200">- update to v.5.3.0
  * mkfs.xfs: use libfx to write out AGs versus open coding
  * mkfs.xfs: fix incorrect error message during AG init
  * xfs_repair: better info when metadata updates fail
  * xfs_growfs: allow mounted device node as argument
  * xfs_spaceman: always report sick metadata
  * xfs_io: add a bulkstat command
  * xfs_io: encrypt command enhancements
  * xfs_io: copy_file_range fixes
  * man: document several new ioctls
  * xfs_scrub: copious rewriting
  * libfrog: header moves, refactoring, updates
  * libxfs: fix buffer refcounting</changelog>
  <changelog author="ailiopoulos@suse.com" date="1579003200">- update to v5.4.0:
  * xfsprogs: Release v5.4.0
  * xfsprogs: Release v5.4.0-rc1
  * mkfs: tidy up discard notifications
  * mkfs: Break block discard into chunks of 2 GB
  * xfs_admin: enable online label getting and setting
  * xfs_admin: support external log devices
  * xfsprogs: add missing line feeds in libxfs/rdwr.c
  * xfsprogs: remove stray libxfs whitespace
  * xfsprogs: Release v5.4.0-rc0
  * xfs: change the seconds fields in xfs_bulkstat to signed
  * xfs: move local to extent inode logging into bmap helper
  * xfs: remove broken error handling on failed attr sf to leaf change
  * xfs: log the inode on directory sf to block format change
  * xfs: remove unused flags arg from xfs_get_aghdr_buf()
  * xfs: log proper length of superblock
  * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag")
  * xfs: convert inode to extent format after extent merge due to shift
  * xfs: define a flags field for the AG geometry ioctl structure
  * xfs: add a xfs_valid_startblock helper
  * xfs: remove the unused XFS_ALLOC_USERDATA flag
  * xfs: allocate xattr buffer on demand
  * xfs: consolidate attribute value copying
  * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue
  * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue
  * xfs: make attr lookup returns consistent
  * xfs: reverse search directory freespace indexes
  * xfs: speed up directory bestfree block scanning
  * xfs: factor free block index lookup from xfs_dir2_node_addname_int()
  * xfs: factor data block addition from xfs_dir2_node_addname_int()
  * xfs: move xfs_dir2_addname()
  * xfs: remove all *_ITER_CONTINUE values
  * xfs: remove all *_ITER_ABORT values
  * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec
  * xfs: remove unnecessary int returns from deferred bmap functions
  * xfs: remove unnecessary int returns from deferred refcount functions
  * xfs: remove unnecessary int returns from deferred rmap functions
  * xfs: remove unnecessary parameter from xfs_iext_inc_seq
  * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys
  * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys
  * xfs: fix maxicount division by zero error
  * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify'
  * xfs: add kmem allocation trace points
  * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP.</changelog>
  <changelog author="ailiopoulos@suse.com" date="1579003201">- split xfs scrubbing scripts and service files into a separate optional
  package, in order to avoid having python as a dependency in the main
  xfsprogs rpm (bsc#1157438).</changelog>
  <changelog author="ailiopoulos@suse.com" date="1584187200">- update to v5.5.0:
  * xfsprogs: actually check that writes succeeded
  * mkfs.xfs: check root inode location
  * mkfs.xfs: efficient block zeroing
  * xfs_repair: fix broken unit conv. in dir invalidation
  * xfs_repair: fix bad next_unlinked field
  * xfs_repair: don't corrupt attr fork clearing forw/back
  * xfs_repair: check root dir pointer before trashing it
  * xfs_repair: try to fix sb_unit value from secondaries
  * libxfs changes merged from kernel 5.5</changelog>
  <changelog author="ailiopoulos@suse.com" date="1586952000">- update to v5.6.0:
  * xfs_scrub: don't set WorkingDirectory in systemd job
  * xfsprogs: fix silently broken option parsing
  * xfsprogs: various minor Coverity fixes
  * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf
  * libxfs: check retval of device flush when closing
  * xfs_io: set exitcode on failure appropriately
  * libxfs changes merged from kernel 5.6</changelog>
  <changelog author="ailiopoulos@suse.com" date="1595592000">- update to v5.7.0:
  * xfs_io: document '-q' option for sendfile command
  * remove libreadline support
  * xfs_quota: allow individual timer extension
  * xfs_quota: fix unsigned int id comparisons
  * xfs_repair: fix progress reporting
  * xfs_repair: fix minrecs error during phase5 btree rebuild
  * xfs_repair: add missing validations to match xfs_check
  * xfs_repair: use btree bulk loading
  * xfs_io: fix copy_range argument parsing
  * xfs_io: document -q option for pread/pwrite command
  * xfs_metadump: man page fixes
  * xfs_db: fix crc invalidation segfault
  * libxfs changes merged from kernel 5.7</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="ailiop@suse.com" date="1599480000">- update to v5.8.0:
  * xfs_db: set b_ops to NULL for types without verifiers
  * mkfs: allow setting dax flag on root directory
  * xfs_quota: improve reporting and messages
  * xfs_db: use correct inode to set inode type
  * xfs_db: fix nlink usage in check
  * xfs_db: report the inode dax flag
  * man: update mkfs.xfs inode flag option documentation
  * xfsprogs: move custom interface def'ns to new header
  * xfs_repair: check quota counters
  * xfs_io: fix -D vs -R handling
  * libxfs changes merged from kernel 5.8</changelog>
  <changelog author="ailiop@suse.com" date="1603195200">- update to v5.9.0:
  * mkfs.xfs: disallow creation of RT files from proto file
  * mkfs.xfs: fix ASSERT on small device with stripe geom
  * xfs_repair: more fixes from fuzz-testing
  * libhandle: fix potential unterminated string problem
  * libhandle: libfrog: fix a potential null pointer deref
  * man: install all manpages that redirect to another page
  * man: fix ioctl_xfs_geometry manpage naming
  * xfsprogs: various realtime related fixes
  * xfsprogs: ignore autofs mount table entries
  * libxfs: make buffers track the per-ag structures
  * libxfs changes merged from kernel 5.9</changelog>
  <changelog author="dmueller@suse.com" date="1609761600">- update to 5.10.0:
  - xfs_repair: remove old code for mountpoint inodes
  - xfsprogs: Add inode btree counter feature
  - xfsprogs: Add bigtime feature for Y2038
  - xfsprogs: Polish translation update
  - mkfs.xfs: Add config file feature
  - mkfs.xfs: allow users to specify rtinherit=0
  - xfs_repair: simplify bmap_next_offset
  - man: various manpage updates
  - libxfs: remove some old dead code
  - libxfs: add realtime extent tracking
  - libxfs changes merged from kernel 5.10
- refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch
  against libxfs changes</changelog>
  <changelog author="ailiop@suse.com" date="1615636800">- update to v5.11.0:
  - xfs_admin: don't hide xfs_repair output when upgrading
  - man: document attr2, ikeep option deprecation in xfs.5
  - mkfs: make use of xfs_validate_stripe_geometry()
  - mkfs: fix wrong inobtcount usage error output
  - xfs_repair: enable bigtime upgrade via repair
  - xfs_repair: enable inobtcount upgrade via repair
  - xfs_repair: set NEEDSREPAIR on first write
  - xfs_repair: clear the needsrepair flag when done
  - xfs_repair: check dquot id and type
  - xfs_fsr: Verify bulkstat version in qsort's cmp()
  - xfs_fsr: Interpret args of qsort's cmp() correctly
  - xfs_scrub: load and unload libicu properly
  - xfs_scrub: various fixes
  - xfs_admin: support adding features to V5 filesystems
  - xfs_admin: support filesystems with realtime devices
  - man: mark all deprecated V4 format options
  - misc: fix valgrind complaints
  - xfs_db: disallow label/uuid setting if NEEDSREPAIR
  - xfs_db: show NEEDSREPAIR in check &amp; version commands
  - xfs_db: add an ls command
  - xfs_db: add a directory path lookup command
  - libxfs changes merged from kernel 5.11</changelog>
  <changelog author="ailiop@suse.com" date="1621944000">- update to v5.12.0:
  - mkfs: don't default to too-large physical sector size
  - repair: phase 6 speedups
  - man: Add dax mount option to man xfs(5)
  - xfs_admin: pick up log arguments correctly
  - xfs_growfs: support shrinking unused space
  - libfrog: report inobtcount in geometry
  - xfs_logprint: Fix buffer overflow printing quotaoff
  - xfsprogs: include &lt;signal.h&gt; for platform_crash
  - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag
  - workqueue: bound maximum queue depth
  - libxfs changes merged from kernel 5.12</changelog>
  <changelog author="ailiop@suse.com" date="1627473600">- mkfs: disable reflink support by default (jsc#SLE-17360)
  - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch
  Do not format xfs filesystems with reflink support by default, as the
  feature is read-only compatible, and read-write compatibility is
  required to be maintained within product stream (SLE15).
- Dropped all following patches which are now part of upstream xfsprogs,
  and were previously backported to address bugs bsc#1167206,
  bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758,
  bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068.
  make_xfs_scrub_interp_explicit.patch
  xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch
  xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch
  xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch
  xfsprogs-xfs_repair-allow-in-attribute-names.patch
  xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch
  xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch
  xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch
  xfsprogs-xfs_info-move-to-xfs_spaceman.patch
  xfsprogs-xfs_db-add-a-superblock-info-command.patch
  xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch
  xfsprogs-mkfs-use-geometry-generation-helper-functions.patch
  xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch
  xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch
  xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch
  xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch
  xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch
  xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch
  xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch
  xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch
  xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch
  xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch
  xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch
  xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch
  xfsprogs-mkfs-validate-extent-size-hint-parameters.patch
  xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch
  xfsprogs-man-document-some-missing-xfs_db-commands.patch
  xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch</changelog>
  <changelog author="ailiop@suse.com" date="1629633600">- update to v5.13.0:
  - mkfs: validate rtextsz hint when rtinherit is set
  - xfs_repair: invalidate dirhash when junking dirent
  - xfs_repair: validate inherited rtextsz hint alignmt
  - xfs_quota: allow truncate of grp &amp; prj quota files
  - xfs_io: allow callers to dump fs stats individually
  - xfs_io: don't count fsmaps before querying fsmaps
  - xfs_io: print header once when dumping fsmap in csv
  - xfs_io: clean up the funshare command a bit
  - xfs_io: fix broken funshare_cmd usage
  - libxfs changes merged from kernel 5.13</changelog>
  <changelog author="ailiop@suse.com" date="1668340800">- mkfs: don't trample the gid set in the protofile (bsc#1205266)
  - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch
- mkfs: prevent corruption of passed-in suboption string values
  (bsc#1205377)
  - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch
- mkfs: terminate getsubopt arrays properly (bsc#1205284)
  - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch
- xfs_repair: ignore empty xattr leaf blocks (bsc#1205272)
  - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch</changelog>
</package>
<package pkgid="3788c68bd90054e061706c1986d4e3205d1eb55f694ec7c60d2ad5ab6fc65a95" name="xfsprogs" arch="x86_64">
  <version epoch="0" ver="5.13.0" rel="150400.3.3.1"/>
  <changelog author="jeffm@suse.com" date="1540036800">- Update to v4.18.0
  * xfs_repair: notify user if free inodes are corrupt
  * xfs_repair: use extent size validation helpers
  * xfs_quota: don't stop the directory tree walk at DEPTH
  * xfs_scrub: ongoing updates
  * xfs_io: document shutdown -f
  * xfs_io: wire up online repair ioctls
  * misc: adddebian initramfs hook to package
  * misc: remove unused macros
  * misc: remove many XFS_BUF macros
  * Majority of 4.18 libxfs changes merged from kernel
- Update to v4.17.0
  * mkfs.xfs: only stat block devices during mkfs init
  * xfs_repair: multiple fixes and improvements
  * xfs_repair: check and repair quota metadata
  * xfs_repair: fix shortform root inode parent
  * xfs_db: don't ASSERT on unrecognized metadata
  * xfs_db: add superblock info command ala xfs_info
  * xfs_spaceman: add superblock info command ala xfs_info
  * xfs_info: call xfs_db for unmounted devices
  * xfs_io: add online label command
  * xfs_io: add O_PATH and O_NOFOLLOW options
  * xfs_io: recognize *iB units in copy_range
- Removed now-obsolete patches:
  * xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch</changelog>
  <changelog author="sean@suspend.net" date="1541851200">- Update to v4.19.0
  * Fix up debian subdir build w.r.t. CHECK_CMD
  * Remove non-linux platforms
  * Remove retpoline support
  * Add sparse checking &amp; related fixes/cleanups
  * Fix cross-platform building w.r.t. crc32selftest
  * libxfs: add agfl free deferred op type
  * mkfs.xfs: discard only after all validations
  * xfs_repair: fix segfault in longform_dir2_entry_check
  * xfs_repair: fix ASSERT in xfs_bunmapi
  * xfs_repair: fix redahead thread deadlock/stall
  * xfs_repair: avoid wriing back all inodes
  * xfs_repair: don't treat directory root LEAFN as corrupt
  * xfs_io: add crc32 self test
  * xfs_io: remove useless do_preadv and do_pwritev arguments
  * xfs_scrub: make scrub build config-optional
  * xfs_scrub: lack of kernel support is not a service failure
  * xfs_scrub_all: fix systemd escaping
  * majority of 4.19 libxfs changes merged from kernel
  * big sparse static checker cleanup
  * mkfs.xfs discard fixes
  * xfs_io readv/writev cleanup
  * libxfs transaction commit error checking</changelog>
  <changelog author="seanlew@opensuse.org" date="1550923200">- Update to v4.20.0
  * mkfs.xfs: null-term symlinks created via protofile
  * xfs_repair: allow '.' in attribute names
  * xfs_repair: skip block reservations when fixing freelist
  * xfs_repair: rebuild dir when nonroot blocks corrupt
  * xfs_repair: int nonleaf finobt blocks with proper magic
  * xfs_repair: fix off by one error rebuilding high keys
  * xfs_io: allow open file permissions to be changed
  * xfs_io: open pipes in non-blocking mode
  * xfs_metadump: multiple stale data zeroing fixes
  * xfs_quota: allow reg files w/o prjinherit flag
  * xfs_db: properly decode finobt record w/ sparse inodes
  * xfs_scrub: move all eecutables to /usr/sbin
  * xfs_scrub: handle totally empty inode chunks
  * xfs.5 manpage: remove barrier related options
  * xfs_io.8 manpage: rearrange command listings by section
  * remove generated scrub files under make clean
  * skip scrub manpage install if not configured
  * Merge libxfs from kernel 4.20</changelog>
  <changelog author="seanlew@opensuse.org" date="1556971200">- Update to v5.0.0
  * xfs_db: scan all sparse inodes when using 'frag'
  * Fix build with newer statx headers
  * libxfs: fix buffer &amp; inode lifetimes
  * misc: fix strncpy length complaints from gcc
  * Merge libxfs from kernel 5.0</changelog>
  <changelog author="coolo@suse.com" date="1566043200">- update to v5.2.0
  - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen)
  - libxfs changes merged from kernel 5.2
  - mkfs: enable reflink by default (Darrick Wong)
  - mkfs: fix stripe unit handling (Allison Collins)
  - mkfs: remove useless log options in usage() (Yang Xu)
  - mkfs: validate start and end of aligned logs (Darrick Wong)
  - xfs_quota: fix built-in help for project setup (Eric Sandeen)
  - xfs_io: allow passing an open file to copy_range (Amir Goldstein)
  - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein)
  - man: break out several ioctl man pages (Darrick Wong)
  - man: Fix an inconsistency in the mkfs man page (Alvin Zheng)
  - xfs_scrub: fix background-mode sleep throttling (Darrick Wong)
  - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen)
  - libfrog: fix bitmap return values (Darrick Wong)
  - libfrog: don't set negative errno in conversion f'ns (Darrick Wong)</changelog>
  <changelog author="seanlew@opensuse.org" date="1575547200">- update to v.5.3.0
  * mkfs.xfs: use libfx to write out AGs versus open coding
  * mkfs.xfs: fix incorrect error message during AG init
  * xfs_repair: better info when metadata updates fail
  * xfs_growfs: allow mounted device node as argument
  * xfs_spaceman: always report sick metadata
  * xfs_io: add a bulkstat command
  * xfs_io: encrypt command enhancements
  * xfs_io: copy_file_range fixes
  * man: document several new ioctls
  * xfs_scrub: copious rewriting
  * libfrog: header moves, refactoring, updates
  * libxfs: fix buffer refcounting</changelog>
  <changelog author="ailiopoulos@suse.com" date="1579003200">- update to v5.4.0:
  * xfsprogs: Release v5.4.0
  * xfsprogs: Release v5.4.0-rc1
  * mkfs: tidy up discard notifications
  * mkfs: Break block discard into chunks of 2 GB
  * xfs_admin: enable online label getting and setting
  * xfs_admin: support external log devices
  * xfsprogs: add missing line feeds in libxfs/rdwr.c
  * xfsprogs: remove stray libxfs whitespace
  * xfsprogs: Release v5.4.0-rc0
  * xfs: change the seconds fields in xfs_bulkstat to signed
  * xfs: move local to extent inode logging into bmap helper
  * xfs: remove broken error handling on failed attr sf to leaf change
  * xfs: log the inode on directory sf to block format change
  * xfs: remove unused flags arg from xfs_get_aghdr_buf()
  * xfs: log proper length of superblock
  * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag")
  * xfs: convert inode to extent format after extent merge due to shift
  * xfs: define a flags field for the AG geometry ioctl structure
  * xfs: add a xfs_valid_startblock helper
  * xfs: remove the unused XFS_ALLOC_USERDATA flag
  * xfs: allocate xattr buffer on demand
  * xfs: consolidate attribute value copying
  * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue
  * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue
  * xfs: make attr lookup returns consistent
  * xfs: reverse search directory freespace indexes
  * xfs: speed up directory bestfree block scanning
  * xfs: factor free block index lookup from xfs_dir2_node_addname_int()
  * xfs: factor data block addition from xfs_dir2_node_addname_int()
  * xfs: move xfs_dir2_addname()
  * xfs: remove all *_ITER_CONTINUE values
  * xfs: remove all *_ITER_ABORT values
  * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec
  * xfs: remove unnecessary int returns from deferred bmap functions
  * xfs: remove unnecessary int returns from deferred refcount functions
  * xfs: remove unnecessary int returns from deferred rmap functions
  * xfs: remove unnecessary parameter from xfs_iext_inc_seq
  * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys
  * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys
  * xfs: fix maxicount division by zero error
  * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify'
  * xfs: add kmem allocation trace points
  * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP.</changelog>
  <changelog author="ailiopoulos@suse.com" date="1579003201">- split xfs scrubbing scripts and service files into a separate optional
  package, in order to avoid having python as a dependency in the main
  xfsprogs rpm (bsc#1157438).</changelog>
  <changelog author="ailiopoulos@suse.com" date="1584187200">- update to v5.5.0:
  * xfsprogs: actually check that writes succeeded
  * mkfs.xfs: check root inode location
  * mkfs.xfs: efficient block zeroing
  * xfs_repair: fix broken unit conv. in dir invalidation
  * xfs_repair: fix bad next_unlinked field
  * xfs_repair: don't corrupt attr fork clearing forw/back
  * xfs_repair: check root dir pointer before trashing it
  * xfs_repair: try to fix sb_unit value from secondaries
  * libxfs changes merged from kernel 5.5</changelog>
  <changelog author="ailiopoulos@suse.com" date="1586952000">- update to v5.6.0:
  * xfs_scrub: don't set WorkingDirectory in systemd job
  * xfsprogs: fix silently broken option parsing
  * xfsprogs: various minor Coverity fixes
  * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf
  * libxfs: check retval of device flush when closing
  * xfs_io: set exitcode on failure appropriately
  * libxfs changes merged from kernel 5.6</changelog>
  <changelog author="ailiopoulos@suse.com" date="1595592000">- update to v5.7.0:
  * xfs_io: document '-q' option for sendfile command
  * remove libreadline support
  * xfs_quota: allow individual timer extension
  * xfs_quota: fix unsigned int id comparisons
  * xfs_repair: fix progress reporting
  * xfs_repair: fix minrecs error during phase5 btree rebuild
  * xfs_repair: add missing validations to match xfs_check
  * xfs_repair: use btree bulk loading
  * xfs_io: fix copy_range argument parsing
  * xfs_io: document -q option for pread/pwrite command
  * xfs_metadump: man page fixes
  * xfs_db: fix crc invalidation segfault
  * libxfs changes merged from kernel 5.7</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="ailiop@suse.com" date="1599480000">- update to v5.8.0:
  * xfs_db: set b_ops to NULL for types without verifiers
  * mkfs: allow setting dax flag on root directory
  * xfs_quota: improve reporting and messages
  * xfs_db: use correct inode to set inode type
  * xfs_db: fix nlink usage in check
  * xfs_db: report the inode dax flag
  * man: update mkfs.xfs inode flag option documentation
  * xfsprogs: move custom interface def'ns to new header
  * xfs_repair: check quota counters
  * xfs_io: fix -D vs -R handling
  * libxfs changes merged from kernel 5.8</changelog>
  <changelog author="ailiop@suse.com" date="1603195200">- update to v5.9.0:
  * mkfs.xfs: disallow creation of RT files from proto file
  * mkfs.xfs: fix ASSERT on small device with stripe geom
  * xfs_repair: more fixes from fuzz-testing
  * libhandle: fix potential unterminated string problem
  * libhandle: libfrog: fix a potential null pointer deref
  * man: install all manpages that redirect to another page
  * man: fix ioctl_xfs_geometry manpage naming
  * xfsprogs: various realtime related fixes
  * xfsprogs: ignore autofs mount table entries
  * libxfs: make buffers track the per-ag structures
  * libxfs changes merged from kernel 5.9</changelog>
  <changelog author="dmueller@suse.com" date="1609761600">- update to 5.10.0:
  - xfs_repair: remove old code for mountpoint inodes
  - xfsprogs: Add inode btree counter feature
  - xfsprogs: Add bigtime feature for Y2038
  - xfsprogs: Polish translation update
  - mkfs.xfs: Add config file feature
  - mkfs.xfs: allow users to specify rtinherit=0
  - xfs_repair: simplify bmap_next_offset
  - man: various manpage updates
  - libxfs: remove some old dead code
  - libxfs: add realtime extent tracking
  - libxfs changes merged from kernel 5.10
- refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch
  against libxfs changes</changelog>
  <changelog author="ailiop@suse.com" date="1615636800">- update to v5.11.0:
  - xfs_admin: don't hide xfs_repair output when upgrading
  - man: document attr2, ikeep option deprecation in xfs.5
  - mkfs: make use of xfs_validate_stripe_geometry()
  - mkfs: fix wrong inobtcount usage error output
  - xfs_repair: enable bigtime upgrade via repair
  - xfs_repair: enable inobtcount upgrade via repair
  - xfs_repair: set NEEDSREPAIR on first write
  - xfs_repair: clear the needsrepair flag when done
  - xfs_repair: check dquot id and type
  - xfs_fsr: Verify bulkstat version in qsort's cmp()
  - xfs_fsr: Interpret args of qsort's cmp() correctly
  - xfs_scrub: load and unload libicu properly
  - xfs_scrub: various fixes
  - xfs_admin: support adding features to V5 filesystems
  - xfs_admin: support filesystems with realtime devices
  - man: mark all deprecated V4 format options
  - misc: fix valgrind complaints
  - xfs_db: disallow label/uuid setting if NEEDSREPAIR
  - xfs_db: show NEEDSREPAIR in check &amp; version commands
  - xfs_db: add an ls command
  - xfs_db: add a directory path lookup command
  - libxfs changes merged from kernel 5.11</changelog>
  <changelog author="ailiop@suse.com" date="1621944000">- update to v5.12.0:
  - mkfs: don't default to too-large physical sector size
  - repair: phase 6 speedups
  - man: Add dax mount option to man xfs(5)
  - xfs_admin: pick up log arguments correctly
  - xfs_growfs: support shrinking unused space
  - libfrog: report inobtcount in geometry
  - xfs_logprint: Fix buffer overflow printing quotaoff
  - xfsprogs: include &lt;signal.h&gt; for platform_crash
  - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag
  - workqueue: bound maximum queue depth
  - libxfs changes merged from kernel 5.12</changelog>
  <changelog author="ailiop@suse.com" date="1627473600">- mkfs: disable reflink support by default (jsc#SLE-17360)
  - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch
  Do not format xfs filesystems with reflink support by default, as the
  feature is read-only compatible, and read-write compatibility is
  required to be maintained within product stream (SLE15).
- Dropped all following patches which are now part of upstream xfsprogs,
  and were previously backported to address bugs bsc#1167206,
  bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758,
  bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068.
  make_xfs_scrub_interp_explicit.patch
  xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch
  xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch
  xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch
  xfsprogs-xfs_repair-allow-in-attribute-names.patch
  xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch
  xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch
  xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch
  xfsprogs-xfs_info-move-to-xfs_spaceman.patch
  xfsprogs-xfs_db-add-a-superblock-info-command.patch
  xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch
  xfsprogs-mkfs-use-geometry-generation-helper-functions.patch
  xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch
  xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch
  xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch
  xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch
  xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch
  xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch
  xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch
  xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch
  xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch
  xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch
  xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch
  xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch
  xfsprogs-mkfs-validate-extent-size-hint-parameters.patch
  xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch
  xfsprogs-man-document-some-missing-xfs_db-commands.patch
  xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch</changelog>
  <changelog author="ailiop@suse.com" date="1629633600">- update to v5.13.0:
  - mkfs: validate rtextsz hint when rtinherit is set
  - xfs_repair: invalidate dirhash when junking dirent
  - xfs_repair: validate inherited rtextsz hint alignmt
  - xfs_quota: allow truncate of grp &amp; prj quota files
  - xfs_io: allow callers to dump fs stats individually
  - xfs_io: don't count fsmaps before querying fsmaps
  - xfs_io: print header once when dumping fsmap in csv
  - xfs_io: clean up the funshare command a bit
  - xfs_io: fix broken funshare_cmd usage
  - libxfs changes merged from kernel 5.13</changelog>
  <changelog author="ailiop@suse.com" date="1668340800">- mkfs: don't trample the gid set in the protofile (bsc#1205266)
  - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch
- mkfs: prevent corruption of passed-in suboption string values
  (bsc#1205377)
  - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch
- mkfs: terminate getsubopt arrays properly (bsc#1205284)
  - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch
- xfs_repair: ignore empty xattr leaf blocks (bsc#1205272)
  - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch</changelog>
</package>
<package pkgid="36733dfb40cfce77605db71d242093abe70dcc4be4901fd8b2a2251c8fd99fc6" name="zlib" arch="src">
  <version epoch="0" ver="1.2.11" rel="150000.3.39.1"/>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Fix bsc#1203652, inflate() does not update strm.adler if DFLTCC is used
  * bsc1203652.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Follow up fix for bsc#1203652 due to libxml2 breakage
  * bsc1203652-2.patch</changelog>
</package>
<package pkgid="1e675f850fcffaaced84a22ea422af02f067e57e4843e25fe494ae70941d9688" name="zlib-devel" arch="aarch64">
  <version epoch="0" ver="1.2.11" rel="150000.3.39.1"/>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Fix bsc#1203652, inflate() does not update strm.adler if DFLTCC is used
  * bsc1203652.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Follow up fix for bsc#1203652 due to libxml2 breakage
  * bsc1203652-2.patch</changelog>
</package>
<package pkgid="9605e76b2a9bb24f53d1de1022c54b773a94d2464880698bc61949a47236b3fa" name="zlib-devel" arch="x86_64">
  <version epoch="0" ver="1.2.11" rel="150000.3.39.1"/>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Fix bsc#1203652, inflate() does not update strm.adler if DFLTCC is used
  * bsc1203652.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Follow up fix for bsc#1203652 due to libxml2 breakage
  * bsc1203652-2.patch</changelog>
</package>
<package pkgid="4f6d8c88124239cd8587586f629094b594142a4746949280ad6ee0e304a8d589" name="zypper" arch="aarch64">
  <version epoch="0" ver="1.14.59" rel="150400.3.12.2"/>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Update man page and explain '.no_auto_prune' (bsc#1204956)
- Allow to (re)add a service with the same URL (bsc#1203715)
- Explain outdatedness of repos (fixes #463)
- BuildRequires:  libzypp-devel &gt;= 17.31.5
- version 1.14.58</changelog>
  <changelog author="ma@suse.de" date="1671883200">- BuildRequires:  libzypp-devel &gt;= 17.31.7.
- Provide "removeptf" command (bsc#1203249)
  A remove command which prefers replacing dependant packages to
  removing them as well.
  A PTF is typically removed as soon as the fix it provides is
  applied to the latest official update of the dependant packages.
  But you don't want the dependant packages to be removed together
  with the PTF, which is what the remove command would do. The
  removeptf command however will aim to replace the dependant
  packages by their official update versions.
- patterns: Avoid dispylaing superfluous @System entries
  (bsc#1205570)
- version 1.14.59</changelog>
</package>
<package pkgid="2c1b336ac7b31612ee0d80ee9518f7d10d065b65704846a64db397e2b11549de" name="zypper" arch="src">
  <version epoch="0" ver="1.14.59" rel="150400.3.12.2"/>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Update man page and explain '.no_auto_prune' (bsc#1204956)
- Allow to (re)add a service with the same URL (bsc#1203715)
- Explain outdatedness of repos (fixes #463)
- BuildRequires:  libzypp-devel &gt;= 17.31.5
- version 1.14.58</changelog>
  <changelog author="ma@suse.de" date="1671883200">- BuildRequires:  libzypp-devel &gt;= 17.31.7.
- Provide "removeptf" command (bsc#1203249)
  A remove command which prefers replacing dependant packages to
  removing them as well.
  A PTF is typically removed as soon as the fix it provides is
  applied to the latest official update of the dependant packages.
  But you don't want the dependant packages to be removed together
  with the PTF, which is what the remove command would do. The
  removeptf command however will aim to replace the dependant
  packages by their official update versions.
- patterns: Avoid dispylaing superfluous @System entries
  (bsc#1205570)
- version 1.14.59</changelog>
</package>
<package pkgid="be0c7a7207ee7830254cf18006aad820f7ce6014b6bd3538d63897f39f72dc5e" name="zypper" arch="x86_64">
  <version epoch="0" ver="1.14.59" rel="150400.3.12.2"/>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Update man page and explain '.no_auto_prune' (bsc#1204956)
- Allow to (re)add a service with the same URL (bsc#1203715)
- Explain outdatedness of repos (fixes #463)
- BuildRequires:  libzypp-devel &gt;= 17.31.5
- version 1.14.58</changelog>
  <changelog author="ma@suse.de" date="1671883200">- BuildRequires:  libzypp-devel &gt;= 17.31.7.
- Provide "removeptf" command (bsc#1203249)
  A remove command which prefers replacing dependant packages to
  removing them as well.
  A PTF is typically removed as soon as the fix it provides is
  applied to the latest official update of the dependant packages.
  But you don't want the dependant packages to be removed together
  with the PTF, which is what the remove command would do. The
  removeptf command however will aim to replace the dependant
  packages by their official update versions.
- patterns: Avoid dispylaing superfluous @System entries
  (bsc#1205570)
- version 1.14.59</changelog>
</package>
<package pkgid="8541ac38dee50dd612795faa92a649957cf2982ea8d77a2855455248e47566b2" name="zypper-needs-restarting" arch="noarch">
  <version epoch="0" ver="1.14.59" rel="150400.3.12.2"/>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
  <changelog author="ma@suse.de" date="1667822400">- Update man page and explain '.no_auto_prune' (bsc#1204956)
- Allow to (re)add a service with the same URL (bsc#1203715)
- Explain outdatedness of repos (fixes #463)
- BuildRequires:  libzypp-devel &gt;= 17.31.5
- version 1.14.58</changelog>
  <changelog author="ma@suse.de" date="1671883200">- BuildRequires:  libzypp-devel &gt;= 17.31.7.
- Provide "removeptf" command (bsc#1203249)
  A remove command which prefers replacing dependant packages to
  removing them as well.
  A PTF is typically removed as soon as the fix it provides is
  applied to the latest official update of the dependant packages.
  But you don't want the dependant packages to be removed together
  with the PTF, which is what the remove command would do. The
  removeptf command however will aim to replace the dependant
  packages by their official update versions.
- patterns: Avoid dispylaing superfluous @System entries
  (bsc#1205570)
- version 1.14.59</changelog>
</package>
</otherdata>